| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.11.2013, 09:05
| #1 |
| |  conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! Hallo, Ich habe seit gestern das Prroblem das der Prozess conhost.exe ständig 2fach auftaucht und sofort wieder verschwindet Mein Rechenleistung ist daurch stark beansprucht Einfachste Sachen wie am FTP Server arbeiten oder Emails bearbeiten wurde dadurch zur Qual Brauche schnelle Hilfe Gruß Olli |
|
22.11.2013, 09:56
| #2 |
| /// the machine /// TB-Ausbilder    |  conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
22.11.2013, 10:03
| #3 |
| | conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!!FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by Urmel (administrator) on KRISTINA-PC on 22-11-2013 09:57:33
Running from C:\Users\Urmel\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Haufe-Lexware GmbH & Co. KG) C:\Program Files (x86)\lexware\installer service\LxInstallerService.exe
(iAnywhere Solutions, Inc.) C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\ProviderRegistryService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe
(Winstep Software Technologies) C:\Program Files (x86)\Winstep\WsxService.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\WSConnectorUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\LANConfigSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\Launchpad.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Winstep Software Technologies) C:\Program Files (x86)\Winstep\Nexus.exe
(Sanford, L.P.) C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Dropbox, Inc.) C:\Users\Urmel\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
() C:\Program Files (x86)\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\HPLamp.exe
(Sanford, L.P.) C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launchpad] - C:\Program Files\Windows Server\Bin\Launchpad.exe [1096576 2011-07-12] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [Seagull Drivers] - ssdal_nc.exe startup
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKCU\...\Run: [NeXuS] - C:\Program Files (x86)\Winstep\Nexus.exe [16957056 2012-03-28] (Winstep Software Technologies)
HKCU\...\Run: [DymoQuickPrint] - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1885512 2010-05-11] (Sanford, L.P.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [AppleIEDAV] - C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1315144 2013-09-04] (Apple Inc.)
MountPoints2: {48d94db8-11d5-11e1-ae79-001d7d08b2d6} - E:\LxSetup.exe
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Lamp] - C:\Program Files (x86)\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\HPLamp.exe [53248 2001-04-27] ()
HKLM-x32\...\Run: [DLSService] - C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe [55808 2010-05-11] (Sanford, L.P.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3478752 2012-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [746176 2013-11-20] ()
HKU\UpdatusUser\...\Run: [NeXuS] - C:\Program Files (x86)\Winstep\Nexus.exe [16957056 2012-03-28] (Winstep Software Technologies)
HKU\UpdatusUser\...\Run: [DymoQuickPrint] - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1885512 2010-05-11] (Sanford, L.P.)
HKU\UpdatusUser\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\UpdatusUser\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\UpdatusUser\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\UpdatusUser\...\Run: [com.apple.dav.bookmarks.daemon] - C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
Startup: C:\Users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Urmel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBDF28CCCE161CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.6.0_22\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {707ABFC2-1D27-4A10-A6E4-6BE6BDF9FB11} hxxp://192.168.177.188/UltraMJCamX.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Urmel\AppData\Roaming\Mozilla\Firefox\C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-804452622-1444586035-2189579611-1126\FireFox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_37 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
Chrome:
=======
CHR RestoreOnStartup: "hxxp://feed.snapdo.com/?publisher=Sien&dpid=Sien&co=DE&userid=b7caad74-5cd0-0498-889d-9db7b68f11b3&searchtype=hp&installDate=20/11/2013", "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Retro Games) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgejkohjndfiooaomnpbacoeekdonkak\2.3.1_0
CHR Extension: (YouTube) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Angry Birds Star Wars Destkop) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbdlnkbmhompldpnfjanghikanjhabfg\1.0_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\11.0.0.379_0
CHR Extension: (Safe Money) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Google Maps) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.7_0
CHR Extension: (Need for Speed World) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnelgnkomjdakpkjpkfehdipjifjmbk\1.0.0.4_0
CHR Extension: (Mail this link) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngjdhjgbagpeimgpgloofkfoipgpdgdb\1.1.1_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Angry Birds Star Wars Unlock) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\okiblihknemleojmompjioapdeblkndn\1.0_0
CHR Extension: (Gmail) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR Extension: (Space Planet) - C:\Users\Urmel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppcocpoeoiajndepaaimnnglicichmbb\1.1_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
R2 HealthAlertsSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
S2 initMonitor; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 Lexware Installations Dienst; C:\Program Files (x86)\lexware\installer service\LxInstallerService.exe [24064 2012-10-07] (Haufe-Lexware GmbH & Co. KG)
R2 Lexware_Professional_Datenbank; C:\Program Files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe [141176 2012-06-01] (iAnywhere Solutions, Inc.)
R2 NotificationsProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 providers_system; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 ServiceProviderRegistry; C:\Program Files\Windows Server\Bin\ProviderRegistryService.exe [40832 2011-03-02] (Microsoft Corporation)
R2 SqmProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2409272 2013-10-11] (TuneUp Software)
R2 WSS_ComputerBackupProviderSvc; C:\Program Files\Windows Server\Bin\SharedServiceHost.exe [30592 2011-03-02] (Microsoft Corporation)
R2 Winstep Xtreme Service; C:\Program Files (x86)\Winstep\WsxService [x]
==================== Drivers (Whitelisted) ====================
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-10-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-10] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-20] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-24] (Kaspersky Lab ZAO)
S3 Lycosa; C:\Windows\System32\drivers\Lycosa.sys [18816 2008-01-17] (Razer USA Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-11-16] (TuneUp Software)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-04-24] (Kaspersky Lab ZAO)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-22 09:57 - 2013-11-22 09:58 - 00027213 _____ C:\Users\Urmel\Downloads\FRST.txt
2013-11-22 09:57 - 2013-11-22 09:57 - 01957964 _____ (Farbar) C:\Users\Urmel\Downloads\FRST64.exe
2013-11-22 09:57 - 2013-11-22 09:57 - 00000000 ____D C:\FRST
2013-11-22 09:37 - 2013-11-22 09:42 - 00002480 _____ C:\Windows\logboot_22.11.2013.tureg.log
2013-11-22 09:26 - 2013-10-11 13:59 - 00038200 _____ (TuneUp Software) C:\Windows\system32\uxtuneup.dll
2013-11-22 09:26 - 2013-10-11 13:59 - 00030520 _____ (TuneUp Software) C:\Windows\SysWOW64\uxtuneup.dll
2013-11-22 09:12 - 2013-11-22 09:15 - 00000000 ____D C:\AdwCleaner
2013-11-22 09:12 - 2013-11-22 09:12 - 01085542 _____ C:\Users\Urmel\Downloads\adwcleaner.exe
2013-11-22 08:16 - 2013-11-22 08:16 - 00000181 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (9).csv
2013-11-21 17:12 - 2013-11-21 17:13 - 04334752 _____ (Systweak Inc ) C:\Users\Urmel\Downloads\rcpsetup_2005.exe
2013-11-21 17:01 - 2013-11-21 17:01 - 00003826 _____ C:\Windows\System32\Tasks\Lexware-Online-Aktualisierungsprogramm
2013-11-21 16:53 - 2013-11-22 09:26 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-11-21 16:53 - 2013-11-21 16:53 - 00002209 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-21 16:53 - 2013-11-21 16:53 - 00002189 _____ C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-11-21 16:53 - 2013-10-11 13:59 - 00035640 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2013-11-21 16:53 - 2013-10-11 13:59 - 00026936 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2013-11-21 16:53 - 2013-10-11 13:59 - 00022328 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2013-11-21 13:06 - 2013-11-22 09:44 - 00002982 _____ C:\Windows\System32\Tasks\AutoKMS
2013-11-21 12:43 - 2013-11-21 12:44 - 00000000 ____D C:\Users\Urmel\Desktop\Scheinwerfer 2
2013-11-21 11:21 - 2013-11-21 11:21 - 00000247 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (8).csv
2013-11-20 11:14 - 2013-11-20 11:14 - 00000181 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (7).csv
2013-11-20 11:00 - 2013-11-20 11:00 - 00000262 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (6).csv
2013-11-20 10:23 - 2013-11-20 10:23 - 00052372 _____ C:\Users\Urmel\Documents\GewSt2011_Skyheros_Oliver_Prinsloo.elfo
2013-11-20 10:21 - 2013-11-20 10:22 - 00124191 _____ C:\Users\Urmel\Documents\USt2011_Skyheros_Oliver_Prinsloo.elfo
2013-11-20 10:19 - 2013-11-22 09:36 - 00001105 _____ C:\Users\Urmel\daemonprocess.txt
2013-11-20 10:19 - 2013-11-20 10:35 - 00000000 ____D C:\Users\Urmel\AppData\Local\cache
2013-11-20 10:19 - 2013-11-20 10:34 - 00000000 ____D C:\Users\Urmel\AppData\Local\Mobogenie
2013-11-20 10:19 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\Documents\Mobogenie
2013-11-20 10:19 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2013-11-20 10:18 - 2013-11-21 10:44 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-11-20 10:18 - 2013-11-20 10:18 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (4).exe
2013-11-20 10:16 - 2013-11-20 10:16 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\HP laserjet 4100 user guide
2013-11-20 10:15 - 2013-11-20 10:15 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (3).exe
2013-11-20 09:57 - 2013-11-20 09:57 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (2).exe
2013-11-20 09:57 - 2013-11-20 09:57 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (1).exe
2013-11-20 09:56 - 2013-11-20 09:56 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com.exe
2013-11-19 15:08 - 2013-11-19 15:08 - 00001229 _____ C:\Users\Public\Desktop\ElsterFormular.lnk
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\elsterformular
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\ProgramData\elsterformular
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-11-19 15:02 - 2013-11-19 15:05 - 111421608 _____ (Landesfinanzdirektion Thüringen) C:\Users\Urmel\Downloads\ElsterFormular-14.4.20130909u.exe
2013-11-19 11:46 - 2013-11-19 11:46 - 00000417 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (5).csv
2013-11-18 12:58 - 2013-11-20 10:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-18 12:51 - 2013-11-18 12:51 - 00000420 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (4).csv
2013-11-15 09:44 - 2013-11-15 09:44 - 00000192 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (3).csv
2013-11-14 10:09 - 2013-11-14 10:09 - 00000201 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (2).csv
2013-11-13 18:46 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-13 18:46 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-13 18:46 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-13 18:46 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-13 18:46 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-13 18:46 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-13 18:46 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-13 18:46 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-13 18:46 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-13 18:46 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-13 18:46 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-13 18:46 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 12:15 - 2013-11-13 12:15 - 00008833 _____ C:\Users\Urmel\Documents\AUSPUFFTEILE.xlsx
2013-11-13 12:01 - 2013-11-13 16:33 - 00000000 ____D C:\Users\Urmel\Documents\Auspuffanlagen
2013-11-13 09:54 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 09:54 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 09:54 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 09:54 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 09:54 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 09:53 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 09:53 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 09:53 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 09:53 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 09:53 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 09:53 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 09:53 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 09:53 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 09:53 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 09:53 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 09:53 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 09:53 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 09:53 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 09:53 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 09:53 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 09:53 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 09:53 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 09:53 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 09:53 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 09:53 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 09:53 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 09:53 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 09:53 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 09:53 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 09:53 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 12:54 - 2013-11-12 12:54 - 00000501 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (1).csv
2013-11-08 11:01 - 2013-11-08 11:01 - 00000186 _____ C:\Users\Urmel\Downloads\delivery_internetmarke(1).csv
2013-11-06 12:30 - 2013-11-07 09:37 - 00000179 _____ C:\Users\Urmel\Downloads\delivery_internetmarke.csv
2013-10-30 16:37 - 2013-10-30 16:37 - 00000711 _____ C:\Users\Urmel\Documents\BEHR HELLA SERVICE Kupplung, Kühlerlüfter (Kühlun 8MV376732401.txt
2013-10-30 15:24 - 2013-10-30 15:25 - 35327024 _____ (Dropbox, Inc.) C:\Users\Urmel\Downloads\Dropbox 2.4.5.exe
2013-10-30 13:05 - 2013-10-30 13:05 - 00119296 _____ C:\Users\Urmel\Documents\Kopie von Speditionsauftrag Hopp.xls
2013-10-30 13:01 - 2013-10-30 13:01 - 00119296 _____ C:\Users\Urmel\Documents\Kopie von Speditionsauftrag Schlier.xls
2013-10-29 18:30 - 2013-10-29 18:30 - 00008833 _____ C:\Users\Urmel\Documents\Microsoft Excel-Arbeitsblatt (neu) (2).xlsx
2013-10-29 18:28 - 2013-10-29 18:28 - 00000099 _____ C:\Users\Urmel\Documents\GK Wasserpumpe (Kühlung) 980511.txt
2013-10-29 18:25 - 2013-10-30 18:43 - 00011262 _____ C:\Users\Urmel\Documents\Microsoft Excel-Arbeitsblatt (neu).xlsx
2013-10-29 18:24 - 2013-10-29 18:24 - 00004099 _____ C:\Users\Urmel\Documents\AQUAPLUS Wasserpumpe (Kühlung) 855805.txt
2013-10-29 15:21 - 2013-10-29 18:41 - 00027572 _____ C:\Users\Urmel\Downloads\GESAMT LISTE.xlsx
2013-10-29 15:21 - 2013-10-29 15:21 - 00027850 _____ C:\Users\Urmel\Downloads\B9E29D0E.tmp
2013-10-24 13:28 - 2013-10-24 13:28 - 00000200 _____ C:\Windows\ODBCINST.INI
2013-10-24 13:28 - 2002-04-30 08:25 - 00041232 ____R (Microsoft Corporation) C:\Windows\SysWOW64\ODBCCP32.CPL
2013-10-24 13:28 - 2002-02-19 13:24 - 00004656 ____R (Microsoft Corporation) C:\Windows\SysWOW64\DS16GT.DLL
2013-10-24 13:28 - 1999-09-28 21:42 - 01050896 ____R (Microsoft Corporation) C:\Windows\SysWOW64\MSJET35.DLL
2013-10-24 13:28 - 1999-09-09 22:06 - 00168720 ____R (Microsoft Corporation) C:\Windows\SysWOW64\MSLTUS35.DLL
2013-10-24 13:28 - 1998-06-01 13:37 - 00163840 ____R (Microsoft Corporation) C:\Windows\SysWOW64\MSJINT35.DLL
2013-10-24 13:28 - 1998-05-18 02:06 - 00368912 ____R (Microsoft Corporation) C:\Windows\SysWOW64\VBAR332.DLL
2013-10-24 13:28 - 1998-05-13 18:49 - 00072704 ____R (Microsoft Corporation) C:\Windows\SysWOW64\ODBCTL32.DLL
2013-10-24 13:28 - 1998-04-24 00:00 - 00024848 ____R (Microsoft Corporation) C:\Windows\SysWOW64\MSJTER35.DLL
2013-10-24 13:20 - 2013-11-21 16:39 - 00000425 _____ C:\Windows\setup.iss
2013-10-24 13:20 - 2013-11-21 16:38 - 00000000 ____D C:\CARKFZ
==================== One Month Modified Files and Folders =======
2013-11-22 09:58 - 2013-11-22 09:57 - 00027213 _____ C:\Users\Urmel\Downloads\FRST.txt
2013-11-22 09:57 - 2013-11-22 09:57 - 01957964 _____ (Farbar) C:\Users\Urmel\Downloads\FRST64.exe
2013-11-22 09:57 - 2013-11-22 09:57 - 00000000 ____D C:\FRST
2013-11-22 09:52 - 2009-07-14 05:45 - 00020880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-22 09:52 - 2009-07-14 05:45 - 00020880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 09:50 - 2011-11-17 16:17 - 01948408 _____ C:\Windows\WindowsUpdate.log
2013-11-22 09:49 - 2012-04-27 10:10 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\Skype
2013-11-22 09:48 - 2013-04-10 10:25 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-22 09:47 - 2013-01-31 13:38 - 00000000 ___RD C:\Users\Urmel\Dropbox
2013-11-22 09:47 - 2013-01-31 13:35 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\Dropbox
2013-11-22 09:44 - 2013-11-21 13:06 - 00002982 _____ C:\Windows\System32\Tasks\AutoKMS
2013-11-22 09:44 - 2012-09-05 11:55 - 00000292 _____ C:\Windows\Tasks\AutoKMS.job
2013-11-22 09:44 - 2012-03-05 11:49 - 00151552 _____ C:\Windows\KMSEmulator.exe
2013-11-22 09:43 - 2013-04-26 10:24 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-22 09:43 - 2012-04-26 09:50 - 00000000 ____D C:\Users\Urmel
2013-11-22 09:43 - 2011-11-21 11:12 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-22 09:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-22 09:43 - 2009-07-14 05:51 - 00063652 _____ C:\Windows\setupact.log
2013-11-22 09:42 - 2013-11-22 09:37 - 00002480 _____ C:\Windows\logboot_22.11.2013.tureg.log
2013-11-22 09:42 - 2009-07-14 03:34 - 95682560 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-11-22 09:42 - 2009-07-14 03:34 - 20709376 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-11-22 09:42 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-11-22 09:36 - 2013-11-20 10:19 - 00001105 _____ C:\Users\Urmel\daemonprocess.txt
2013-11-22 09:36 - 2009-07-14 03:34 - 48758784 _____ C:\Windows\system32\config\COMPONENTS_tureg_old
2013-11-22 09:36 - 2009-07-14 03:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-11-22 09:26 - 2013-11-21 16:53 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-11-22 09:26 - 2013-04-22 12:44 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-11-22 09:15 - 2013-11-22 09:12 - 00000000 ____D C:\AdwCleaner
2013-11-22 09:12 - 2013-11-22 09:12 - 01085542 _____ C:\Users\Urmel\Downloads\adwcleaner.exe
2013-11-22 09:07 - 2013-04-26 10:24 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-22 09:01 - 2012-03-15 12:46 - 00000258 _____ C:\Windows\Tasks\HP Photo Creations Messager.job
2013-11-22 08:54 - 2013-01-08 15:37 - 00000000 ____D C:\Users\Urmel\AppData\Local\1948A190-3712-4327-BFA4-EE70FD3366AF.aplzod
2013-11-22 08:52 - 2012-04-26 10:33 - 00000000 ____D C:\Users\Urmel\Documents\Outlook-Dateien
2013-11-22 08:50 - 2012-07-13 08:32 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\FileZilla
2013-11-22 08:43 - 2012-10-09 15:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-22 08:39 - 2012-04-26 09:51 - 00000000 ____D C:\Users\Urmel\AppData\Local\Adobe
2013-11-22 08:22 - 2011-11-18 14:20 - 00443862 _____ C:\Windows\PFRO.log
2013-11-22 08:16 - 2013-11-22 08:16 - 00000181 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (9).csv
2013-11-22 08:11 - 2012-09-12 13:12 - 00000000 ____D C:\Users\Urmel\Downloads\EasyLog Druck
2013-11-21 17:13 - 2013-11-21 17:12 - 04334752 _____ (Systweak Inc ) C:\Users\Urmel\Downloads\rcpsetup_2005.exe
2013-11-21 17:01 - 2013-11-21 17:01 - 00003826 _____ C:\Windows\System32\Tasks\Lexware-Online-Aktualisierungsprogramm
2013-11-21 17:01 - 2013-04-22 13:02 - 00003676 _____ C:\Windows\System32\Tasks\HP-Online-Aktualisierungsprogramm
2013-11-21 17:01 - 2013-04-22 12:44 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-11-21 17:01 - 2012-04-26 16:02 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\HpUpdate
2013-11-21 16:53 - 2013-11-21 16:53 - 00002209 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2013-11-21 16:53 - 2013-11-21 16:53 - 00002189 _____ C:\Users\Public\Desktop\TuneUp Utilities 2013.lnk
2013-11-21 16:44 - 2011-11-18 13:46 - 00000000 ____D C:\Users\Public\Documents\Winstep
2013-11-21 16:39 - 2013-10-24 13:20 - 00000425 _____ C:\Windows\setup.iss
2013-11-21 16:38 - 2013-10-24 13:20 - 00000000 ____D C:\CARKFZ
2013-11-21 12:44 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Urmel\Desktop\Scheinwerfer 2
2013-11-21 12:28 - 2012-09-14 12:22 - 00000000 ____D C:\Users\Urmel\Downloads\Easy Log Liefern
2013-11-21 11:21 - 2013-11-21 11:21 - 00000247 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (8).csv
2013-11-21 10:44 - 2013-11-20 10:18 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-11-20 11:14 - 2013-11-20 11:14 - 00000181 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (7).csv
2013-11-20 11:00 - 2013-11-20 11:00 - 00000262 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (6).csv
2013-11-20 10:44 - 2012-05-17 14:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-20 10:35 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\AppData\Local\cache
2013-11-20 10:34 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\AppData\Local\Mobogenie
2013-11-20 10:23 - 2013-11-20 10:23 - 00052372 _____ C:\Users\Urmel\Documents\GewSt2011_Skyheros_Oliver_Prinsloo.elfo
2013-11-20 10:22 - 2013-11-20 10:21 - 00124191 _____ C:\Users\Urmel\Documents\USt2011_Skyheros_Oliver_Prinsloo.elfo
2013-11-20 10:19 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\Documents\Mobogenie
2013-11-20 10:19 - 2013-11-20 10:19 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2013-11-20 10:18 - 2013-11-20 10:18 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (4).exe
2013-11-20 10:16 - 2013-11-20 10:16 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\HP laserjet 4100 user guide
2013-11-20 10:15 - 2013-11-20 10:15 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (3).exe
2013-11-20 10:11 - 2013-11-18 12:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-20 09:57 - 2013-11-20 09:57 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (2).exe
2013-11-20 09:57 - 2013-11-20 09:57 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com (1).exe
2013-11-20 09:56 - 2013-11-20 09:56 - 01096192 _____ (LiveSoftAction) C:\Users\Urmel\Downloads\HP laserjet 4100 user guide provided through bedienungsanleitung-pdf.com.exe
2013-11-19 15:08 - 2013-11-19 15:08 - 00001229 _____ C:\Users\Public\Desktop\ElsterFormular.lnk
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\elsterformular
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\ProgramData\elsterformular
2013-11-19 15:08 - 2013-11-19 15:08 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-11-19 15:05 - 2013-11-19 15:02 - 111421608 _____ (Landesfinanzdirektion Thüringen) C:\Users\Urmel\Downloads\ElsterFormular-14.4.20130909u.exe
2013-11-19 11:46 - 2013-11-19 11:46 - 00000417 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (5).csv
2013-11-18 12:51 - 2013-11-18 12:51 - 00000420 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (4).csv
2013-11-18 12:48 - 2013-06-17 15:01 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-18 12:48 - 2012-09-17 13:21 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-18 12:47 - 2013-06-17 15:01 - 00000000 ____D C:\Program Files\iTunes
2013-11-18 12:47 - 2013-06-17 15:01 - 00000000 ____D C:\Program Files\iPod
2013-11-18 12:47 - 2013-06-17 15:01 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-15 10:09 - 2013-04-26 10:25 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-15 09:44 - 2013-11-15 09:44 - 00000192 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (3).csv
2013-11-15 09:42 - 2012-10-09 15:30 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-15 09:42 - 2012-03-30 08:52 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-15 09:42 - 2011-11-17 16:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-14 10:37 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-14 10:09 - 2013-11-14 10:09 - 00000201 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (2).csv
2013-11-13 18:47 - 2011-11-18 14:55 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 18:44 - 2013-08-18 02:02 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 18:41 - 2010-06-24 11:11 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-11-13 16:33 - 2013-11-13 12:01 - 00000000 ____D C:\Users\Urmel\Documents\Auspuffanlagen
2013-11-13 12:15 - 2013-11-13 12:15 - 00008833 _____ C:\Users\Urmel\Documents\AUSPUFFTEILE.xlsx
2013-11-13 11:33 - 2011-11-21 13:30 - 00000641 _____ C:\Windows\ODBC.INI
2013-11-12 12:54 - 2013-11-12 12:54 - 00000501 _____ C:\Users\Urmel\Downloads\delivery_internetmarke (1).csv
2013-11-12 12:39 - 2012-03-21 11:48 - 00000000 ____D C:\ProgramData\Skype
2013-11-11 05:50 - 2011-11-17 16:40 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-08 11:01 - 2013-11-08 11:01 - 00000186 _____ C:\Users\Urmel\Downloads\delivery_internetmarke(1).csv
2013-11-07 09:37 - 2013-11-06 12:30 - 00000179 _____ C:\Users\Urmel\Downloads\delivery_internetmarke.csv
2013-11-04 14:01 - 2012-04-26 09:51 - 00000000 ___RD C:\Users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-04 14:00 - 2013-01-31 13:36 - 00000000 ____D C:\Users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-10-30 18:43 - 2013-10-29 18:25 - 00011262 _____ C:\Users\Urmel\Documents\Microsoft Excel-Arbeitsblatt (neu).xlsx
2013-10-30 16:37 - 2013-10-30 16:37 - 00000711 _____ C:\Users\Urmel\Documents\BEHR HELLA SERVICE Kupplung, Kühlerlüfter (Kühlun 8MV376732401.txt
2013-10-30 15:25 - 2013-10-30 15:24 - 35327024 _____ (Dropbox, Inc.) C:\Users\Urmel\Downloads\Dropbox 2.4.5.exe
2013-10-30 13:05 - 2013-10-30 13:05 - 00119296 _____ C:\Users\Urmel\Documents\Kopie von Speditionsauftrag Hopp.xls
2013-10-30 13:01 - 2013-10-30 13:01 - 00119296 _____ C:\Users\Urmel\Documents\Kopie von Speditionsauftrag Schlier.xls
2013-10-29 18:41 - 2013-10-29 15:21 - 00027572 _____ C:\Users\Urmel\Downloads\GESAMT LISTE.xlsx
2013-10-29 18:30 - 2013-10-29 18:30 - 00008833 _____ C:\Users\Urmel\Documents\Microsoft Excel-Arbeitsblatt (neu) (2).xlsx
2013-10-29 18:28 - 2013-10-29 18:28 - 00000099 _____ C:\Users\Urmel\Documents\GK Wasserpumpe (Kühlung) 980511.txt
2013-10-29 18:24 - 2013-10-29 18:24 - 00004099 _____ C:\Users\Urmel\Documents\AQUAPLUS Wasserpumpe (Kühlung) 855805.txt
2013-10-29 15:21 - 2013-10-29 15:21 - 00027850 _____ C:\Users\Urmel\Downloads\B9E29D0E.tmp
2013-10-28 12:11 - 2009-07-14 18:58 - 00700168 _____ C:\Windows\system32\perfh007.dat
2013-10-28 12:11 - 2009-07-14 18:58 - 00148964 _____ C:\Windows\system32\perfc007.dat
2013-10-28 12:11 - 2009-07-14 06:13 - 01621244 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-24 13:28 - 2013-10-24 13:28 - 00000200 _____ C:\Windows\ODBCINST.INI
2013-10-24 13:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Urmel\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-11 12:26
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013
Ran by Urmel at 2013-11-22 09:59:03
Running from C:\Users\Urmel\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AS: Kaspersky Internet Security (Enabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
==================== Installed Programs ======================
Adobe Acrobat XI Pro (x32 Version: 11.0.02)
Adobe AIR (x32 Version: 1.5.3.9120)
Adobe Community Help (x32 Version: 3.0.0)
Adobe Community Help (x32 Version: 3.0.0.400)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)
Adobe Media Player (x32 Version: 1.8)
Adobe Photoshop CS5 (x32 Version: 12.0)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
Bonjour (Version: 3.0.0.10)
CPUID CPU-Z 1.63.0
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.4.6)
DYMO Label v.8 (x32 Version: 8.2.2.996)
EASYLOG V6.4 (x32)
ElsterFormular (x32 Version: 14.3.11574)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)
FileZilla Client 3.7.3 (x32 Version: 3.7.3)
Google Chrome (x32 Version: 31.0.1650.57)
Google Update Helper (x32 Version: 1.3.21.165)
Haali Media Splitter (x32)
HD Tune 2.55 (x32)
Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000)
HP FWUpdateEDO2 (x32 Version: 1.2.0.0)
HP Photo Creations (x32 Version: 1.0.0.5192)
HP Photosmart 6510 series - Grundlegende Software für das Gerät (Version: 25.0.621.0)
HP Photosmart 6510 series Hilfe (x32 Version: 140.0.2.2)
HP Product Detection (x32 Version: 11.14.0001)
HP Update (x32 Version: 5.005.000.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
iCloud (Version: 3.0.2.163)
IMAPSize 0.3.7 (x32)
IPSetup (x32 Version: 1.0.8)
iTunes (Version: 11.1.3.8)
Java 7 Update 13 (64-bit) (Version: 7.0.130)
JDownloader 0.9 (x32 Version: 0.9)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
L&H TTS3000 Deutsch (x32)
Lexmark Universal v2 Deinstallationsprogamm
Lexware Elster (x32 Version: 13.00.00.0027)
Lexware financial office pro 2013 (x32 Version: 13.00.00.0099)
Lexware financial office pro 2013 (x32 Version: 13.09.00.0025)
Lexware Info Service (x32 Version: 2.90.00.0009)
Lexware Installations Dienst (x32 Version: 2.00.00.0036)
Lexware online banking (x32 Version: 20.00.00.0059)
Lexware professional Datenbank 2013 (x32 Version: 13.25.00.0073)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office FrontPage 2003 (x32 Version: 11.0.8173.0)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Mobogenie (x32)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
MPEG4 NVR (x32)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Need For Speed™ World (x32 Version: 1.0.0.1599)
Nexus 11.6 (x32)
NVIDIA 3D Vision Controller-Treiber 314.22 (Version: 314.22)
NVIDIA 3D Vision Treiber 314.22 (Version: 314.22)
NVIDIA Grafiktreiber 314.22 (Version: 314.22)
NVIDIA Install Application (Version: 2.1002.115.743)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1422)
NVIDIA Systemsteuerung 314.22 (Version: 314.22)
NVIDIA Update 1.12.12 (Version: 1.12.12)
NVIDIA Update Components (Version: 1.12.12)
Nvu 1.0 (x32 Version: 1.0)
OpenOffice.org 3.4 (x32 Version: 3.4.9590)
Opera 11.61 (x32 Version: 11.61.1250)
Origin (x32 Version: 8.2.2.2414)
PDF Settings CS5 (x32 Version: 10.0)
Realtek Ethernet Controller Driver (x32 Version: 7.46.531.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662)
Reflex XTR (x32 Version: 1.00.0000)
Safari (x32 Version: 5.34.57.2)
Setup Wizard (x32)
Skype™ 6.10 (x32 Version: 6.10.104)
Studie zur Verbesserung von HP Photosmart 6510 series Produkten (Version: 25.0.621.0)
System Requirements Lab (x32)
TeamViewer 8 (x32 Version: 8.0.22298)
TuneUp Utilities 2013 (x32 Version: 13.0.4000.122)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.122)
Ubisoft Game Launcher (x32 Version: 1.0.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
VirtualCloneDrive (x32)
VLC media player 1.1.11 (x32 Version: 1.1.11)
Windows 7 Manager (Version: 1.1.1)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Windows Small Business Server 2011 Connector (Version: 6.1.8800.16389)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
==================== Restore Points =========================
08-11-2013 09:39:18 Windows Update
12-11-2013 11:44:17 Windows Update
13-11-2013 17:39:38 Windows Update
19-11-2013 08:30:39 Windows Update
21-11-2013 15:50:33 TuneUp Utilities 2013 wird installiert
21-11-2013 15:51:58 TuneUp Utilities Language Pack (de-DE) wird entfernt
21-11-2013 15:52:57 TuneUp Utilities 2013 wird installiert
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-03-14 17:06 - 00002510 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 activate.adobe.com # Adobe Acrobat Pro X
127.0.0.1 practivate.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 192.150.18.108
127.0.0.1 activate.adobe.com:443
127.0.0.1 3dns.adobe.com
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 192.150.18.108
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-1.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 adobe-dns-5.adobe.com
There are 25 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {023FF22D-91D0-417F-86DD-78F0E30D4215} - System32\Tasks\{43C95FC2-06FB-41FE-B53A-5CEDD39804A7} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {03AC488C-8F2B-4180-8BB5-F99FF5638BC3} - System32\Tasks\Microsoft\Windows\Windows Server\UploadCEIPData => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {060346FD-2146-4389-8094-FA027A50E7E4} - System32\Tasks\{F37C5078-7AA3-4FF6-B0F9-224CA95193E7} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {10F9D142-102B-41A9-A653-D37DAD68BAEC} - System32\Tasks\{80CB84AC-1BE9-45B4-8CAB-7645E5AB8654} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {11227EB3-33D2-432F-93EE-04960985042B} - System32\Tasks\{A05492FD-4362-4CC1-A036-83269783E9B6} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {159B29E9-C09C-4705-A980-5F80D9D9BA73} - System32\Tasks\{5B30E769-59AD-4998-AC65-91808191DFD3} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {1722DB01-BACA-4F20-9177-1291C95A10FF} - System32\Tasks\Microsoft\Windows\Windows Server\ConfigureRDPGroup => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {1953DF52-6761-4B68-ACC2-D9EF8C4D631B} - System32\Tasks\{07C4BFE5-C921-4A05-8DB7-522CB16A7E5D} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {19B5237B-B06A-40BE-88D7-66A4BE85259C} - System32\Tasks\{28748741-8BAB-47FF-9208-AF1C35B3A2AE} => E:\virtuallyjenna-en.exe
Task: {1A7CE80A-C93A-471D-863A-1F17D7FF96BD} - System32\Tasks\{AE8EA16C-772E-4AE6-ABC4-BBE8F3DB1481} => E:\virtuallyjenna-en.exe
Task: {1B234888-4FFE-42D1-867F-5658B2DD7631} - System32\Tasks\{6E19368B-8F30-427D-A31D-74D97EB64D23} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {211E0CB1-D4B6-41CC-A42E-19B62DC22970} - System32\Tasks\AdobeAAMUpdater-1.0-FLYKINGSAG-Urmel => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {228CD89A-B246-43E6-BD54-0419283C87FE} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)
Task: {244E5CD0-9593-45B7-AE33-8C7B7BF8C638} - System32\Tasks\{D70E4D47-57BD-4E88-A3B4-989EF47BFD02} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {24AEB3C4-7453-4C81-95F9-61FF81FAC53A} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-06-24] (Microsoft Corporation)
Task: {25CF9779-EA89-42F3-BE67-C10BA57C4D41} - System32\Tasks\Microsoft\Windows\Windows Server\SaveCEIPData => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {271FEB4A-4198-45EF-BFF5-455DA0588E9E} - System32\Tasks\{FBE376B2-3E72-4DE8-B761-EE1563EFA470} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {27CCD712-96CC-4524-9EF0-493B6BF1C06C} - System32\Tasks\{C971C495-C09D-4C9D-8BC3-09A9651DA728} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {2B8C636F-164A-4D47-AC1C-7A03812012D5} - System32\Tasks\{BEBE1E95-9480-4E89-B095-C0FC082F1AB5} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {2D44633A-A6AA-43A3-9FDB-0713BBEEFE55} - System32\Tasks\{CA4FE0E8-71A3-4C5B-A70B-36BD327C61F2} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {2D796D06-D8B6-4521-A12B-CAE6645C6067} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2011-07-31] (Haufe-Lexware GmbH & Co. KG)
Task: {2F48E05A-1E33-41AB-9E9E-DB10C2EAC366} - System32\Tasks\{55C6A098-34FE-4404-A044-C88EE634B30F} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {3260DBA3-CD2C-42AF-B99C-E20149B44269} - System32\Tasks\{4E50844F-D4C8-4B02-9258-271009BC3241} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {33FE922A-2FD2-4CDD-B5D6-9629A0B5DE4A} - System32\Tasks\{6DA5B729-DCF9-4A2A-B12A-D366FA35A7D4} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {35F8C632-E6C7-4B86-A9DA-506F6AE9CA75} - System32\Tasks\{89DA7693-0FE0-4381-A610-523181363403} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {3D442808-BAFE-4794-982B-A9C1B37F12A0} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2012-09-05] ()
Task: {3ED8B135-C9A0-4F43-A2CC-0CF4F453DB0E} - System32\Tasks\HPCustParticipation HP Photosmart 6510 series => C:\Program Files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-09-16] (Hewlett-Packard Co.)
Task: {4247057D-5CD5-47B1-9C1F-D834E77AC9B9} - System32\Tasks\Microsoft\Windows\Windows Server\RenewClientCertificate => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {469E85E0-EF27-49F4-88D5-10AD188820DC} - System32\Tasks\{F7AE963A-E045-464D-8A65-477F07995EED} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {4700F072-4587-416F-9B13-ED9F7128B480} - System32\Tasks\{919FE437-CB15-4B01-8B24-6044A92CD554} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {470E53BA-97D5-4084-B828-6A086404999C} - System32\Tasks\{3FA0EEFA-1A7B-4E83-B345-1B5AE44A2D15} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {4D4E1548-7746-4C45-8292-5EBD269C7765} - System32\Tasks\{8FE521A2-B33F-4BB7-933E-1846C15BF3F3} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {50DE6A19-713F-46C6-8324-90F5E95BF610} - System32\Tasks\{EE7F7EF2-3FAB-4F8D-A1C3-9C0923E27F06} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {51721B1C-41ED-409F-8E07-30211C9B8087} - System32\Tasks\{EB7E7884-C724-4DFD-BC94-FEB2CDF6B9AC} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {5E159BDD-0A68-4A94-9E6E-268161C9F871} - System32\Tasks\{0CD40D1D-1A4F-4012-AB79-D54DEFA345DE} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {612C27BC-8BDA-490F-96CD-2E5547870895} - System32\Tasks\{0B080C23-889A-4E50-A585-9299ABFF5104} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {708684FF-12B7-4BB5-B03A-576DE3B99D7B} - System32\Tasks\{D76F6875-A348-48BB-B61F-28B0E4623419} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {78C62B72-95E5-48CA-845B-604CF4053ADD} - System32\Tasks\{F1B51491-6BEB-42E3-A477-33BA98566D91} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {7BBD8CDC-F15C-4043-84B7-3EE8FAD3C4A4} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [2011-10-28] (Hewlett-Packard)
Task: {7E348421-B2D7-45BF-B5D1-76F408E86535} - System32\Tasks\{38C2AE1F-E9A2-46EA-BD96-C3DF3BE57C8F} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {7F8B5006-1057-4717-82C3-4FDF6680B698} - System32\Tasks\{0E73D5F0-99C9-4413-B722-377E26C35417} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {7FEE589C-9A2F-4B8A-BD25-441D4CBE5697} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26] (Google Inc.)
Task: {82FC0D84-ED6A-4E2C-B02D-66C790697744} - System32\Tasks\{0AED5F6D-2776-4517-8C9F-1FBA244CA1DA} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {86587DFA-4EC9-4F2D-BCA9-34CDCC3A40A0} - System32\Tasks\{26D67DEF-9218-43CF-9778-DF7616754819} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {87A5E313-CEF6-41A8-B604-6E40BD0891FE} - System32\Tasks\Microsoft\Windows\Windows Server\Health Definition Updates => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {89C26DAD-E680-45E5-8F7F-6B92E5EF1306} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-15] (Adobe Systems Incorporated)
Task: {901C1109-CDCB-4DE3-81AE-6BCD939E3FAB} - System32\Tasks\Microsoft\Windows\Windows Server\Alert Evaluations => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {91F2F7DB-F4A5-4155-93E6-7928C0B340A6} - System32\Tasks\{E0502614-6197-4A61-BBCC-A3C19E7F6111} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {93DFA139-230F-45C2-A969-67095071FA26} - System32\Tasks\{01858666-78D6-4A63-9C08-80CE0FC2B7D3} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {95D6398B-CDF9-4432-A7CC-FA2FB0B6E0DD} - System32\Tasks\{86E715F8-A4F2-43B9-A403-DCA832E49DF1} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {9CC8739F-8686-43E4-A1C1-5ADF49270CA2} - System32\Tasks\{0FBDEA73-522F-4B57-B59A-26AF576510B2} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {9FC4A1F5-BC0E-411C-AE66-2232D11C3349} - System32\Tasks\{582EC78F-4781-41A2-A17C-E53A29A46B9A} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A44CB633-992A-4B84-8A3E-A7BD418E9C0F} - System32\Tasks\{6DB1AB77-3526-420C-A8D9-E9F0BEADFBC9} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A47F4076-A51D-4EA7-B30A-DA32C3E02F17} - System32\Tasks\{1C024CBD-19D8-4C6A-855C-3A5CFA2379A7} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A5E636BE-9673-45DB-A33A-70D3F052A37E} - System32\Tasks\{A257E174-5378-4389-B2BF-02FF04840845} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A8337AF7-D52A-418C-8646-E6B907D9C990} - System32\Tasks\{AB04478C-A4C9-4A4E-BF2A-64398BD516D7} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A8833961-8B5E-49C0-BACB-B6AF36E7A76A} - System32\Tasks\{99A9EA40-F4F2-4BE5-8E8C-8459B4E37DDD} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {A9D95695-0AAE-4006-940E-17614FFBE880} - System32\Tasks\{DB288474-565E-483D-9F23-0A1140EE6790} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {B005E488-060B-44C1-829B-2AE8FB2DD753} - System32\Tasks\{7882031B-5566-4C5E-9C2C-61AC82CD24AE} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {B0FB03AD-5076-40FE-86C9-4F38BAD147FF} - System32\Tasks\{43634E0B-7E0B-4FE8-B80A-C2C1DCC62D3B} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {B54AB1A6-3C71-4E99-BFE1-82951063AEF8} - System32\Tasks\{66150635-A765-4E5F-83B2-35E4BD370A2F} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {B9D928E3-54B2-4BDC-8019-B2F148F4BD01} - System32\Tasks\{5BA4343B-DAF5-4B80-AF73-08CD2768DCEE} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {BDACBC3A-D737-4169-A75C-D65E14A00636} - System32\Tasks\{F0F3CDFE-1F78-4E83-B739-4B128AC4F491} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {C01D5E48-EF22-470F-ADAE-612B11FAC798} - System32\Tasks\Microsoft\Windows\Windows Server\Backup => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {C3668E67-0FB1-41AD-A7BF-6008AD0F1244} - System32\Tasks\{271FAEAD-6802-4F7F-8F68-290A4BF153D1} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {C5C2915A-7878-4727-96C2-FAD3282274C2} - System32\Tasks\{FCD62370-8AD3-4DA8-BEB7-3B6E0CB9A0A3} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {CF3CA4D2-F6EC-4961-8F29-5A8550D28519} - System32\Tasks\{E0937A0E-1559-43C4-99B5-39B3881F1744} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {D76D5EBC-89E1-4F20-90B0-D866B1625B21} - System32\Tasks\Microsoft\Windows\Windows Server\InstallAddIns => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {DA79015C-28A5-47C7-BC47-21D191CE47C0} - System32\Tasks\{F80FA222-6819-4487-A287-5F047BD6775C} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {DB36FB5C-6137-4DDE-9789-3E1079B109BA} - System32\Tasks\{0CFD89E9-6F3E-46D9-8C3B-36ACE34ED9DA} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {DD29EE52-BC89-40CF-AB2F-687D4417E620} - System32\Tasks\{75AF8DD1-A0FC-439E-A328-0C55592F45B5} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {E04563B5-3652-4434-98DB-94FBDD9DD1C1} - System32\Tasks\{D3802255-193D-4C45-8DD4-9D5BE06707B5} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {E0E0E38E-FBBF-4935-88EB-7207A64538EC} - System32\Tasks\{6A4F6BE9-F904-486A-ADB7-AF624BC74A59} => Firefox.exe hxxp://ui.skype.com/ui/0/5.9.0.123/de/go/help.faq.installer?LastError=1603
Task: {E2A65C59-A756-4715-8C9C-67941758D385} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: {E8013F9B-DE25-4E75-A152-FE4A84162689} - System32\Tasks\Microsoft\Windows\Windows Server\Backup_On_Idle => C:\Program Files\Windows Server\Bin\runtask.exe [2011-03-02] (Microsoft Corporation)
Task: {E87A2A8D-255F-4845-B2A6-71D9BCC4CEA6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {EAB94353-BA82-4972-8599-67D62FCECDE4} - System32\Tasks\{92A1117D-2E57-4597-8AD7-BE4215BB3B10} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {F126B882-E376-4F89-B234-201293BCB30B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F3B5E9FD-4CB9-4BAD-8963-44954E9F1661} - System32\Tasks\{02900134-5229-4092-A5ED-EB05FAADEAB2} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {F8772DCB-FFB3-40B7-A4E6-16B59985F982} - System32\Tasks\{FC227740-2869-40AD-B2BD-FE6C22BDE957} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {F8D52F72-ED85-4881-969C-9DAD46258BF8} - System32\Tasks\{EB9E0995-28BA-49AA-AF69-8CF10801434A} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {F9D7E877-111F-4E4C-BA7C-CA2DE1C2606F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26] (Google Inc.)
Task: {FD1825CF-9920-4E9E-9E15-4926B65A5BFB} - System32\Tasks\{46D53C78-5ECA-4B00-92AE-8C0C453ED661} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: {FE4EB63D-D69C-4EA5-ABEE-FE3D39A6594D} - System32\Tasks\{6872B4E5-2B67-47FE-B968-6F940039580E} => C:\Program Files (x86)\Safari\Safari.exe [2012-04-25] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-08-17 20:39 - 2013-04-10 10:30 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2012-03-23 12:23 - 2012-02-22 08:41 - 01085376 _____ () C:\Program Files (x86)\Winstep\wodTelnetDLX.dll
2010-05-11 04:52 - 2010-05-11 04:52 - 00094208 _____ () C:\Program Files (x86)\DYMO\DYMO Label Software\DYMO.Common.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Urmel\AppData\Roaming\Dropbox\bin\libcef.dll
2013-09-14 00:51 - 2013-09-14 00:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 00:50 - 2013-09-14 00:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2012-09-23 20:43 - 2012-09-23 20:43 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2012-08-17 20:38 - 2012-08-17 20:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2013-11-18 12:58 - 2013-11-18 12:58 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/22/2013 09:45:54 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ApplePhotoStreams.exe, Version: 7.12.44.1, Zeitstempel: 0x516e136b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0xf50
Startzeit der fehlerhaften Anwendung: 0xApplePhotoStreams.exe0
Pfad der fehlerhaften Anwendung: ApplePhotoStreams.exe1
Pfad des fehlerhaften Moduls: ApplePhotoStreams.exe2
Berichtskennung: ApplePhotoStreams.exe3
Error: (11/22/2013 09:22:34 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ApplePhotoStreams.exe, Version: 7.12.44.1, Zeitstempel: 0x516e136b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x34c
Startzeit der fehlerhaften Anwendung: 0xApplePhotoStreams.exe0
Pfad der fehlerhaften Anwendung: ApplePhotoStreams.exe1
Pfad des fehlerhaften Moduls: ApplePhotoStreams.exe2
Berichtskennung: ApplePhotoStreams.exe3
Error: (11/22/2013 08:39:57 AM) (Source: Application Hang) (User: )
Description: Programm OUTLOOK.EXE, Version 14.0.7109.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 3d48
Startzeit: 01cee75468e9c021
Endzeit: 20014
Anwendungspfad: C:\PROGRA~2\MICROS~2\Office14\OUTLOOK.EXE
Berichts-ID: 0c4e54ee-5349-11e3-bfd2-001d7d08b2d6
Error: (11/22/2013 08:25:45 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ApplePhotoStreams.exe, Version: 7.12.44.1, Zeitstempel: 0x516e136b
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x1310
Startzeit der fehlerhaften Anwendung: 0xApplePhotoStreams.exe0
Pfad der fehlerhaften Anwendung: ApplePhotoStreams.exe1
Pfad des fehlerhaften Moduls: ApplePhotoStreams.exe2
Berichtskennung: ApplePhotoStreams.exe3
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10904
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10904
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9875
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9875
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (11/22/2013 09:49:27 AM) (Source: TermService) (User: )
Description: Der Terminalserver kann den Dienstprinzipalnamen "TERMSRV", der für die Serverauthentifizierung verwendet werden soll, nicht registrieren. Der folgende Fehler ist aufgetreten: Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung hergestellt werden.
.
Error: (11/22/2013 09:47:45 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (11/22/2013 09:47:45 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (11/22/2013 09:46:55 AM) (Source: TermService) (User: )
Description: Der Terminalserver kann den Dienstprinzipalnamen "TERMSRV", der für die Serverauthentifizierung verwendet werden soll, nicht registrieren. Der folgende Fehler ist aufgetreten: Die angegebene Domäne ist nicht vorhanden, oder es konnte keine Verbindung hergestellt werden.
.
Error: (11/22/2013 09:44:56 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (11/22/2013 09:43:56 AM) (Source: Microsoft-Windows-GroupPolicy) (User: FLYKINGSAG)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.
Error: (11/22/2013 09:43:29 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Der Computername konnte nicht aufgelöst werden. Dies kann mindestens eine der folgenden Ursachen haben:
a) Fehler bei der Namensauflösung mit dem aktuellen Domänencontroller.
b) Active Directory-Replikationswartezeit (ein auf einem anderen Domänencontroller erstelltes Konto hat nicht auf dem aktuellen Domänencontroller repliziert).
Error: (11/22/2013 09:43:29 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne FLYKINGSAG aufgrund der folgenden
Ursache nicht einrichten:
%%1311
Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.
ZUSÄTZLICHE INFORMATIONEN
Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.
Error: (11/22/2013 09:43:07 AM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (11/22/2013 09:26:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TuneUp Designerweiterung" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1083
Microsoft Office Sessions:
=========================
Error: (11/22/2013 09:45:54 AM) (Source: Application Error)(User: )
Description: ApplePhotoStreams.exe7.12.44.1516e136bKERNELBASE.dll6.1.7601.1822951fb1116e06d73630000c41ff5001cee75efd2933d4C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exeC:\Windows\syswow64\KERNELBASE.dll7f4e7e5c-5352-11e3-bf73-001d7d08b2d6
Error: (11/22/2013 09:22:34 AM) (Source: Application Error)(User: )
Description: ApplePhotoStreams.exe7.12.44.1516e136bKERNELBASE.dll6.1.7601.1822951fb1116e06d73630000c41f34c01cee75bb11b2c21C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exeC:\Windows\syswow64\KERNELBASE.dll3c741a23-534f-11e3-9532-001d7d08b2d6
Error: (11/22/2013 08:39:57 AM) (Source: Application Hang)(User: )
Description: OUTLOOK.EXE14.0.7109.50003d4801cee75468e9c02120014C:\PROGRA~2\MICROS~2\Office14\OUTLOOK.EXE0c4e54ee-5349-11e3-bfd2-001d7d08b2d6
Error: (11/22/2013 08:25:45 AM) (Source: Application Error)(User: )
Description: ApplePhotoStreams.exe7.12.44.1516e136bKERNELBASE.dll6.1.7601.1822951fb1116e06d73630000c41f131001cee753db1e0c26C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exeC:\Windows\syswow64\KERNELBASE.dll4caf07c7-5347-11e3-bfd2-001d7d08b2d6
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10904
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10904
Error: (11/21/2013 06:15:09 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9875
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9875
Error: (11/21/2013 06:15:08 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
CodeIntegrity Errors:
===================================
Date: 2013-09-27 12:08:47.950
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-27 12:08:47.949
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-27 12:08:47.947
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-27 12:08:47.933
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-27 12:08:47.932
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-27 12:08:47.930
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-23 15:09:46.077
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-23 15:09:46.075
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-23 15:09:46.073
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-09-23 15:09:46.042
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 50%
Total physical RAM: 5118.49 MB
Available physical RAM: 2558.08 MB
Total Pagefile: 10235.16 MB
Available Pagefile: 7059.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:298.09 GB) (Free:179.91 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 7F947F94)
Partition 1: (Active) - (Size=298 GB) - (Type=42)
Partition 2: (Not Active) - (Size=1304 KB) - (Type=42)
==================== End Of Log ============================
|
|
22.11.2013, 16:47
| #4 | |
| /// the machine /// TB-Ausbilder | conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! hi, Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.11.2013, 17:38
| #5 |
| | conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!!Code:
ATTFilter ComboFix 13-11-23.02 - Urmel 25.11.2013 17:00:59.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.5118.1853 [GMT 1:00]
ausgeführt von:: c:\users\Urmel\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\logboot_22.11.2013.tureg.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-25 bis 2013-11-25 ))))))))))))))))))))))))))))))
.
.
2013-11-25 16:10 . 2013-11-25 16:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-25 16:10 . 2013-11-25 16:10 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-11-25 13:54 . 2013-11-25 13:54 -------- d-----w- c:\windows\LastGood
2013-11-22 09:43 . 2013-11-25 14:32 -------- d-----w- c:\users\Urmel\AppData\Local\F85549A8-D5D1-4DB3-A51B-3AD7D3A26B61.aplzod
2013-11-22 08:57 . 2013-11-22 08:57 -------- d-----w- C:\FRST
2013-11-22 08:26 . 2013-10-11 12:59 38200 ----a-w- c:\windows\system32\uxtuneup.dll
2013-11-22 08:26 . 2013-10-11 12:59 30520 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2013-11-22 08:12 . 2013-11-22 08:15 -------- d-----w- C:\AdwCleaner
2013-11-22 07:16 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F23B54B-9AC5-4F83-9C3C-59FB5DFDE760}\mpengine.dll
2013-11-21 15:53 . 2013-10-11 12:59 35640 ----a-w- c:\windows\system32\TURegOpt.exe
2013-11-21 15:53 . 2013-10-11 12:59 26936 ----a-w- c:\windows\system32\authuitu.dll
2013-11-21 15:53 . 2013-10-11 12:59 22328 ----a-w- c:\windows\SysWow64\authuitu.dll
2013-11-21 15:53 . 2013-11-22 08:26 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2013
2013-11-20 09:19 . 2013-11-20 09:35 -------- d-----w- c:\users\Urmel\AppData\Local\cache
2013-11-20 09:19 . 2013-11-20 09:34 -------- d-----w- c:\users\Urmel\AppData\Local\Mobogenie
2013-11-20 09:18 . 2013-11-21 09:44 -------- d-----w- c:\program files (x86)\Mobogenie
2013-11-20 09:16 . 2013-11-20 09:16 -------- d-----w- c:\users\Urmel\AppData\Roaming\HP laserjet 4100 user guide
2013-11-19 14:08 . 2013-11-19 14:08 -------- d-----w- c:\users\Urmel\AppData\Roaming\elsterformular
2013-11-19 14:08 . 2013-11-19 14:08 -------- d-----w- c:\programdata\elsterformular
2013-11-19 14:08 . 2013-11-19 14:08 -------- d-----w- c:\program files (x86)\ElsterFormular
2013-11-13 08:54 . 2013-10-05 20:25 1474048 ----a-w- c:\windows\system32\crypt32.dll
2013-11-13 08:54 . 2013-10-05 19:57 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-11-13 08:54 . 2013-10-03 02:23 404480 ----a-w- c:\windows\system32\gdi32.dll
2013-11-13 08:54 . 2013-10-03 02:00 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2013-11-13 08:54 . 2013-09-28 01:09 497152 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-25 09:03 . 2012-03-05 10:49 151552 ----a-w- c:\windows\KMSEmulator.exe
2013-11-15 08:42 . 2012-03-30 07:52 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-15 08:42 . 2011-11-17 15:51 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-13 17:41 . 2010-06-24 10:11 82896128 ----a-w- c:\windows\system32\mrt.exe
2013-11-11 04:50 . 2011-11-17 15:40 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-10-10 10:24 . 2012-07-25 12:53 29280 ----a-w- c:\windows\system32\drivers\klmouflt.sys
2013-10-10 10:24 . 2012-05-25 17:38 29280 ----a-w- c:\windows\system32\drivers\klkbdflt.sys
2013-10-10 10:24 . 2013-04-10 09:25 626272 ----a-w- c:\windows\system32\drivers\klif.sys
2013-10-10 10:24 . 2012-06-19 15:28 7717984 ----a-w- c:\windows\system32\drivers\kl1.sys
2013-09-08 02:30 . 2013-10-10 10:23 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-10 10:23 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-10 10:23 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-08-29 02:17 . 2013-10-10 10:22 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 02:16 . 2013-10-10 10:22 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 02:16 . 2013-10-10 10:22 243712 ----a-w- c:\windows\system32\wow64.dll
2013-08-29 02:16 . 2013-10-10 10:22 859648 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 02:13 . 2013-10-10 10:22 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-08-29 01:51 . 2013-10-10 10:22 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-10 10:22 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-10 10:22 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-08-29 01:50 . 2013-10-10 10:22 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-08-29 01:50 . 2013-10-10 10:22 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-08-29 01:48 . 2013-10-10 10:22 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-08-29 01:48 . 2013-10-10 10:22 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-29 00:49 . 2013-10-10 10:22 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-08-29 00:49 . 2013-10-10 10:22 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-08-29 00:49 . 2013-10-10 10:22 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-08-29 00:49 . 2013-10-10 10:22 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-08-28 01:21 . 2013-10-10 10:22 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 01:12 . 2013-10-10 10:22 461312 ----a-w- c:\windows\system32\scavengeui.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeXuS"="c:\program files (x86)\Winstep\Nexus.exe" [2012-03-28 16957056]
"DymoQuickPrint"="c:\program files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe" [2010-05-11 1885512]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-09-15 59720]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-10-21 20549280]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-09-14 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]
"HP Lamp"="c:\program files (x86)\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe" [2001-04-27 53248]
"DLSService"="c:\program files (x86)\DYMO\DYMO Label Software\DLSService.exe" [2010-05-11 55808]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2012-12-18 3478752]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-10-10 356128]
"mobilegeni daemon"="c:\program files (x86)\Mobogenie\DaemonProcess.exe" [2013-11-20 746176]
.
c:\users\Urmel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Urmel\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-11-1 29769432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"LexwareInfoService"=c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 initMonitor;Windows Server-Initialisierungsdienst;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys;c:\windows\SYSNATIVE\drivers\Lycosa.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 HealthAlertsSvc;Integritätsdienst von Windows Server;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 LANConfig;Windows Server-LAN-Konfiguration;c:\program files\Windows Server\Bin\LANConfigSvc.exe;c:\program files\Windows Server\Bin\LANConfigSvc.exe [x]
S2 Lexware Installations Dienst;Lexware Installations Dienst;c:\program files (x86)\lexware\installer service\LxInstallerService.exe;c:\program files (x86)\lexware\installer service\LxInstallerService.exe [x]
S2 Lexware_Professional_Datenbank;Lexware Professional Datenbank;c:\program files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe;c:\program files (x86)\SQL Anywhere 12\Bin32\dbsrv12.exe [x]
S2 NotificationsProviderSvc;Windows Server-Anbieterdienst für Benachrichtigungen;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 providers_system;Windows Server-Downloaddienst;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 ServiceProviderRegistry;Dienstanbieterregistrierung von Windows Server;c:\program files\Windows Server\Bin\ProviderRegistryService.exe;c:\program files\Windows Server\Bin\ProviderRegistryService.exe [x]
S2 SqmProviderSvc;SQM-Dienst von Windows Server;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [x]
S2 Winstep Xtreme Service;Winstep Xtreme Service;c:\program files (x86)\Winstep\WsxService;c:\program files (x86)\Winstep\WsxService [x]
S2 WSConnectorUpdate;Windows Server-Connector-Update;c:\program files\Windows Server\Bin\WSConnectorUpdate.exe;c:\program files\Windows Server\Bin\WSConnectorUpdate.exe [x]
S2 WSS_ComputerBackupProviderSvc;Windows Server-Anbieterdienst für die Clientcomputersicherung;c:\program files\Windows Server\Bin\SharedServiceHost.exe;c:\program files\Windows Server\Bin\SharedServiceHost.exe [x]
S3 BackupReader;BackupReader;c:\windows\system32\DRIVERS\BackupReader.sys;c:\windows\SYSNATIVE\DRIVERS\BackupReader.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [x]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-11-15 09:07 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 08:42]
.
2013-11-25 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2012-09-05 10:55]
.
2013-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26 09:24]
.
2013-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26 09:24]
.
2013-11-25 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Urmel\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Append Link Target to Existing PDF
IE: Append to Existing PDF
IE: Convert Link Target to Adobe PDF
IE: Convert to Adobe PDF
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: {707ABFC2-1D27-4A10-A6E4-6BE6BDF9FB11} - hxxp://192.168.177.188/UltraMJCamX.cab
FF - ProfilePath - c:\users\Urmel\AppData\Roaming\Mozilla\Firefox\Profiles\tdh0ekva.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Launchpad - c:\program files (x86)\Windows Server\Bin\Launchpad.exe
AddRemove-HP PrecisionScan Pro - c:\windows\IsUn0407.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winstep Xtreme Service]
"ImagePath"="c:\program files (x86)\Winstep\WsxService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.SVG"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (S-1-5-21-804452622-1444586035-2189579611-1126)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-804452622-1444586035-2189579611-1126\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-25 17:13:58
ComboFix-quarantined-files.txt 2013-11-25 16:13
.
Vor Suchlauf: 17 Verzeichnis(se), 193.727.025.152 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 193.538.543.616 Bytes frei
.
- - End Of File - - 1DB4EE400E87C50860DD9FD735C986DF
A36C5E4F47E84449FF07ED3517B43A31
|
|
25.11.2013, 17:39
| #6 |
| | conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! Leider immernoch das problem |
|
26.11.2013, 10:41
| #7 |
| /// the machine /// TB-Ausbilder | conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu conhost.exe taucht auf und verschwindet blockiert meine Rechenleistung Hilfe!!!! |
| .exe, arbeiten, beansprucht, bearbeiten, blockiert, conhost.exe, conhost.exe infiziert, emails, ftp, gestern, hilfe, hilfe!, hilfe!!, hilfe!!!, host.exe, leistung, prozess, rechenleistung, sache, sachen, schnelle, server, sofort, stark, taucht, verschwindet |
Linear-Darstellung
