|
Plagegeister aller Art und deren Bekämpfung: Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstallerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.02.2014, 12:34 | #1 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Hallo veehrtes TB-Team, habe auf meinem Rechner (Windows7 64bit) einen Scan mit Malwarebytes durchgeführt und 9 Funde von LinkuryInstaller C:\Users\Jan\AppData\Roaming\OpenCandy gehabt. Sie befinden sich nun in der Quarantäne. Ist das was ernstes? Zudem zeigt mir das Wartungscenter an Avira Free Antivirus müsse aktiviert werden, obwohl es das schon ist, wenn ich es öffne. Desweiteren solle ich die Sicherheitseinstellungen überprüfen. Kann da ein Zusammenhang bestehen? Der Rechner läuft sonst normal, soweit ich das erkennen kann. Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.02.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Jan :: THINKTAB [Administrator] Schutz: Aktiviert 02.02.2014 20:50:25 MBAM-log-2014-02-02 (22-34-42).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 519149 Laufzeit: 37 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 3 C:\Users\Jan\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\AEE3B116C08940BC8B62092EEA7F99AE (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. Infizierte Dateien: 6 C:\Users\Jan\AppData\Roaming\OpenCandy\AEE3B116C08940BC8B62092EEA7F99AE\TuneUp_PC_2.4.6.4_CPMID_347.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA\2533.ico (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA\LinkuryInstaller.msi (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA\LinkuryInstaller_p1v6.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Jan\AppData\Roaming\OpenCandy\OpenCandy_808BA737495642B88AD15EBABAAA36CA\OCBrowserHelper_1.0.2.73.dll (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. (Ende) scissor |
03.02.2014, 12:34 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Hallo und
__________________Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
03.02.2014, 13:13 | #3 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Hi Cosinus, danke für die schnelle Antwort.
__________________habe in den Avira Ereignissen noch diese 2 Funde wiederentdeckt, hatte ich vergessen, sorry. Die Files habe ich allerdings schon aus der Avira-Quarantäne gelöscht (Habe mir das Prog inzwischen gekauft). Hier die Avira Ereignisse: Code:
ATTFilter Exportierte Ereignisse: 31.01.2014 11:15 [System-Scanner] Malware gefunden Die Datei 'F:\Programme\Rhinoceros3D V4_SR8.zip' enthielt einen Virus oder unerwünschtes Programm 'TR/Rogue.8828868' [trojan]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '45b4fabd.qua' verschoben! Exportierte Ereignisse: 31.01.2014 11:15 [System-Scanner] Malware gefunden Die Datei 'F:\Programme\Adobe CS3 Master Collection\CYGiSO\Keygen.EXE' enthielt einen Virus oder unerwünschtes Programm 'TR/Gendal.55457.A' [trojan]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5d13d510.qua' verschoben! FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04 Ran by Jan_2 (ATTENTION: The logged in user is not administrator) on THINKTAB on 03-02-2014 13:00:37 Running from C:\Users\Jan_2\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Lenovo.) C:\Windows\System32\TpShocks.exe () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe (Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe (X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe () C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe (Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe () C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe (Microsoft Corporation) C:\Windows\System32\prevhost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [380776 2010-12-09] (Lenovo.) HKLM\...\Run: [ForteConfig] - C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] () HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [41320 2011-04-04] (Lenovo Group Limited) HKLM\...\Run: [ALCKRESI.EXE] - C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281448 2011-02-28] (Lenovo Group Limited) HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [130576 2009-06-17] (Logitech, Inc.) HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM\...\Run: [nwiz] - C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2747680 2013-11-15] () HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated) HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation) HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor HKLM-x32\...\Run: [X-Rite Legacy Device] - C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4309184 2011-02-09] (Lenovo, Inc.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-12-18] (Adobe Systems Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.) HKU\.DEFAULT\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-11-15] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-11-15] (NVIDIA Corporation) Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ==================== Internet (Whitelisted) ==================== SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{6EF977DF-533C-486F-9BED-5F2007576149}: [NameServer]193.189.244.225 193.189.244.206 FireFox: ======== FF ProfilePath: C:\Users\Jan_2\AppData\Roaming\Mozilla\Firefox\Profiles\p9y44c1v.default FF Homepage: hxxp://www.ecosia.org/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems) FF SearchPlugin: C:\Users\Jan_2\AppData\Roaming\Mozilla\Firefox\Profiles\p9y44c1v.default\searchplugins\ecosia.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: NoScript - C:\Users\Jan_2\AppData\Roaming\Mozilla\Firefox\Profiles\p9y44c1v.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-31] FF Extension: Adblock Plus - C:\Users\Jan_2\AppData\Roaming\Mozilla\Firefox\Profiles\p9y44c1v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-31] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-12-21] FF HKLM-x32\...\Firefox\Extensions: [VIP1X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\ FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\ [] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-10-23] FF HKLM-x32\...\Firefox\Extensions: [VIP2X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\ FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\ [] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG) R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-03-15] (Lenovo.) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2011-12-23] () S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] () R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 OpenVPNService; C:\Program Files (x86)\FH-Aachen OpenVPN\bin\openvpnserv.exe [38926 2011-05-20] () R2 Radio.fx; F:\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] () R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-12-11] (Lenovo Group Limited) S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-12-11] (Lenovo Group Limited) R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-18] (Symantec Corporation) R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG) S3 grmobileavs; C:\Windows\System32\Drivers\grmobileavs.sys [358480 2011-04-11] (Native Instruments GmbH) S3 grmobileavs_x64; C:\Windows\System32\Drivers\grmobileavs_x64.sys [45072 2008-12-09] (Native Instruments GmbH) S3 grmobileusb_x64; C:\Windows\System32\Drivers\grmobileusb_x64.sys [234000 2008-12-09] (Native Instruments GmbH) R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Lenovo) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-11-15] (NVIDIA Corporation) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-07-26] () R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13840 2009-03-13] (UPEK Inc.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381440 2014-01-09] (Duplex Secure Ltd.) R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.) U3 a83v839n; C:\Windows\System32\Drivers\a83v839n.sys [0 ] (Advanced Micro Devices) U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2011-12-23] (Huawei Technologies Co., Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-03 13:00 - 2014-02-03 13:00 - 00020014 _____ () C:\Users\Jan_2\Desktop\FRST.txt 2014-02-03 13:00 - 2014-02-03 13:00 - 00000000 ____D () C:\FRST 2014-02-03 12:59 - 2014-02-03 12:59 - 02080256 _____ (Farbar) C:\Users\Jan_2\Desktop\FRST64.exe 2014-02-03 11:47 - 2014-02-03 11:47 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Malwarebytes 2014-02-02 20:48 - 2014-02-02 20:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 20:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-02 18:15 - 2014-02-03 09:21 - 00119408 _____ () C:\Windows\PFRO.log 2014-02-02 18:03 - 2014-02-02 18:49 - 01598708 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 18:01 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2014-02-02 18:01 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2014-02-02 18:01 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys 2014-02-02 18:01 - 2012-08-23 15:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-02-02 18:01 - 2012-08-23 14:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2014-02-02 18:01 - 2012-08-23 14:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2014-02-02 18:01 - 2012-08-23 14:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2014-02-02 18:01 - 2012-08-23 14:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-02-02 18:01 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2014-02-02 18:01 - 2012-08-23 14:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2014-02-02 18:01 - 2012-08-23 14:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-02-02 18:01 - 2012-08-23 14:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2014-02-02 18:01 - 2012-08-23 14:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-02-02 18:01 - 2012-08-23 13:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-02-02 18:01 - 2012-08-23 12:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2014-02-02 18:01 - 2012-08-23 12:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-02-02 18:01 - 2012-08-23 12:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-02-02 18:01 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2014-02-02 18:01 - 2012-08-23 11:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2014-02-02 18:01 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2014-02-02 18:01 - 2012-08-23 11:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-02-02 18:01 - 2012-08-23 11:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-02-02 18:01 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-02-02 18:01 - 2012-08-23 09:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-02-02 18:01 - 2012-08-23 09:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-02-02 17:59 - 2014-02-02 17:59 - 00000000 ____D () C:\Program Files\AuthenTec 2014-02-02 17:51 - 2012-05-04 12:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-02-02 17:51 - 2012-05-04 10:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2014-02-01 22:32 - 2014-02-01 22:32 - 00000921 _____ () C:\Users\Jan_2\Desktop\gsg_tuts - Verknüpfung.lnk 2014-02-01 22:30 - 2014-02-01 22:29 - 00001004 _____ () C:\Users\Jan_2\Desktop\hochstuhl - Verknüpfung.lnk 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\Documents\Ulead Burn.Now 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Ulead Systems 2014-02-01 22:20 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Corel 2014-02-01 22:20 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\Corel 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Thunderbird 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Thunderbird 2014-02-01 16:23 - 2014-02-01 16:23 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\HpUpdate 2014-02-01 10:05 - 2014-02-01 10:08 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\SolidWorks 2014-02-01 10:03 - 2014-02-01 10:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\NVIDIA 2014-02-01 08:46 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Tobit 2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-31 22:50 - 2014-01-31 22:50 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\PwrMgr 2014-01-31 22:40 - 2014-01-31 22:42 - 00000000 ____D () C:\ProgramData\Oracle 2014-01-31 22:39 - 2014-01-31 22:39 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-31 20:52 - 2014-01-31 20:52 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Macromedia 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Mozilla 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Mozilla 2014-01-31 15:36 - 2014-01-31 15:36 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Avira 2014-01-31 15:31 - 2014-02-03 09:56 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\X-Rite 2014-01-31 15:31 - 2014-01-31 15:31 - 00140216 _____ () C:\Users\Jan_2\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-31 15:31 - 2014-01-31 15:31 - 00001432 _____ () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\Virtual Machines 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Logitech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Leadertech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Adobe 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Lenovo 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Adobe 2014-01-31 15:30 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2 2014-01-31 15:30 - 2014-02-01 22:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Apple Computer 2014-01-31 15:30 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\VirtualStore 2014-01-31 15:30 - 2014-02-01 08:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Apple Computer 2014-01-31 15:30 - 2014-01-31 15:30 - 00000020 ___SH () C:\Users\Jan_2\ntuser.ini 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Vorlagen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Startmenü 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Netzwerkumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Lokale Einstellungen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Eigene Dateien 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Druckumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Musik 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Bilder 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Verlauf 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Intel 2014-01-31 15:30 - 2012-03-17 15:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Macromedia 2014-01-31 15:30 - 2011-11-01 00:32 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Microsoft Help 2014-01-31 15:30 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-01-31 15:30 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-01-31 11:37 - 2014-02-03 09:54 - 00003512 _____ () C:\Windows\setupact.log 2014-01-31 11:37 - 2014-01-31 11:37 - 00000000 _____ () C:\Windows\setuperr.log 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iTunes 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iPod 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-01-30 23:28 - 2014-01-30 23:28 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Program Files (x86)\Secunia 2014-01-29 23:02 - 2014-01-29 23:02 - 13031424 _____ (Intel Corporation) C:\Windows\system32\ig4icd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 12617216 _____ (Intel Corporation) C:\Windows\system32\igdumd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11176448 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11049472 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 10812928 _____ (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 05904856 _____ (Intel Corporation) C:\Windows\system32\GfxUI.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 05363200 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2014-01-29 23:02 - 2014-01-29 23:02 - 03511296 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 03121152 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 01040384 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00931840 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00575488 _____ (Intel Corporation) C:\Windows\system32\igfx11cmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00542720 _____ (Intel Corporation) C:\Windows\SysWOW64\igfx11cmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00515544 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00442880 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00442328 _____ (Intel Corporation) C:\Windows\system32\igfxpers.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00440320 _____ (Intel Corporation) C:\Windows\system32\igfxrell.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxrfra.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxresn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrus.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrom.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrsky.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrptg.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrplk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrnld.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrita.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrhrv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrdeu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrhun.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrfin.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrcsy.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrtrk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrsve.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrslv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrptb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrnor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrtha.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrdan.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrheb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrara.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00432128 _____ (Intel Corporation) C:\Windows\system32\igfxrjpn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00431104 _____ (Intel Corporation) C:\Windows\system32\igfxrkor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00429056 _____ (Intel Corporation) C:\Windows\system32\igfxrcht.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00428544 _____ (Intel Corporation) C:\Windows\system32\igfxrchs.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00410624 _____ (Intel Corporation) C:\Windows\system32\igfxTMM.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00399832 _____ (Intel Corporation) C:\Windows\system32\hkcmd.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00384512 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00330752 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00286208 _____ (Intel Corporation) C:\Windows\system32\igfxrenu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00279000 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00254936 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00223664 _____ () C:\Windows\system32\Gfxres.th-TH.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00210106 _____ () C:\Windows\system32\Gfxres.el-GR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00194245 _____ () C:\Windows\system32\Gfxres.ru-RU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00185816 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00175104 _____ (Intel Corporation) C:\Windows\system32\gfxSrvc.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00171992 _____ (Intel Corporation) C:\Windows\system32\igfxtray.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00166170 _____ () C:\Windows\system32\Gfxres.ar-SA.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00163421 _____ () C:\Windows\system32\Gfxres.ja-JP.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00159008 _____ () C:\Windows\system32\Gfxres.he-IL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00149682 _____ () C:\Windows\system32\Gfxres.it-IT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00148042 _____ () C:\Windows\system32\Gfxres.ko-KR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147393 _____ () C:\Windows\system32\Gfxres.de-DE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147288 _____ () C:\Windows\system32\Gfxres.es-ES.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00146004 _____ () C:\Windows\system32\Gfxres.ro-RO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00145491 _____ () C:\Windows\system32\Gfxres.fr-FR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144645 _____ () C:\Windows\system32\Gfxres.tr-TR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144260 _____ () C:\Windows\system32\Gfxres.pt-BR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144020 _____ () C:\Windows\system32\Gfxres.nl-NL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00143932 _____ () C:\Windows\system32\Gfxres.hu-HU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142882 _____ () C:\Windows\system32\Gfxres.sv-SE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142877 _____ () C:\Windows\system32\Gfxres.pt-PT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142717 _____ () C:\Windows\system32\Gfxres.pl-PL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142336 _____ (Intel Corporation) C:\Windows\system32\igfxdo.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00142289 _____ () C:\Windows\system32\Gfxres.cs-CZ.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142008 _____ () C:\Windows\system32\Gfxres.fi-FI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141838 _____ () C:\Windows\system32\Gfxres.sk-SK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141049 _____ () C:\Windows\system32\Gfxres.hr-HR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137889 _____ () C:\Windows\system32\Gfxres.sl-SI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137784 _____ () C:\Windows\system32\Gfxres.nb-NO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137141 _____ () C:\Windows\system32\Gfxres.da-DK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00132623 _____ () C:\Windows\system32\Gfxres.en-US.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00126976 _____ (Intel Corporation) C:\Windows\system32\igfxcpl.cpl 2014-01-29 23:02 - 2014-01-29 23:02 - 00126300 _____ () C:\Windows\system32\Gfxres.zh-TW.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00124650 _____ () C:\Windows\system32\Gfxres.zh-CN.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00116224 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v3347.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00098304 _____ () C:\Windows\system32\igdde64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00077312 _____ () C:\Windows\SysWOW64\igdde32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00025088 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00017058 _____ () C:\Windows\system32\iglhxs64.vp 2014-01-29 23:02 - 2014-01-29 23:02 - 00009728 _____ ( ) C:\Windows\system32\IGFXDEVLib.dll 2014-01-15 09:21 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 09:20 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 09:20 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-09 13:47 - 2014-01-09 13:47 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-01-04 20:57 - 2014-01-04 20:57 - 00000000 ____D () C:\Program Files (x86)\QuickTime ==================== One Month Modified Files and Folders ======= 2014-02-03 13:00 - 2014-02-03 13:00 - 00020014 _____ () C:\Users\Jan_2\Desktop\FRST.txt 2014-02-03 13:00 - 2014-02-03 13:00 - 00000000 ____D () C:\FRST 2014-02-03 12:59 - 2014-02-03 12:59 - 02080256 _____ (Farbar) C:\Users\Jan_2\Desktop\FRST64.exe 2014-02-03 12:17 - 2012-04-05 08:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-03 11:47 - 2014-02-03 11:47 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Malwarebytes 2014-02-03 10:01 - 2009-07-14 05:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-03 10:01 - 2009-07-14 05:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-03 09:59 - 2011-07-26 20:38 - 00701576 _____ () C:\Windows\system32\perfh007.dat 2014-02-03 09:59 - 2011-07-26 20:38 - 00150444 _____ () C:\Windows\system32\perfc007.dat 2014-02-03 09:59 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-03 09:56 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\X-Rite 2014-02-03 09:54 - 2014-01-31 11:37 - 00003512 _____ () C:\Windows\setupact.log 2014-02-03 09:54 - 2011-07-26 11:06 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-03 09:54 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-03 09:53 - 2012-07-07 22:34 - 01213020 _____ () C:\Windows\WindowsUpdate.log 2014-02-03 09:21 - 2014-02-02 18:15 - 00119408 _____ () C:\Windows\PFRO.log 2014-02-02 22:58 - 2011-10-28 10:19 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job 2014-02-02 20:48 - 2014-02-02 20:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 19:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-02 18:49 - 2014-02-02 18:03 - 01598708 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 18:16 - 2011-07-26 11:08 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-02 18:16 - 2011-07-26 11:08 - 00000000 ____D () C:\Windows\system32\NV 2014-02-02 18:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-02-02 18:02 - 2011-07-26 10:56 - 00000000 ____D () C:\Program Files\Common Files\Intel 2014-02-02 18:00 - 2011-07-26 11:06 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-02 17:59 - 2014-02-02 17:59 - 00000000 ____D () C:\Program Files\AuthenTec 2014-02-02 17:59 - 2011-07-26 11:05 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-02 17:59 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2014-02-02 17:16 - 2011-07-26 11:18 - 00000000 ____D () C:\ProgramData\PCDr 2014-02-01 22:32 - 2014-02-01 22:32 - 00000921 _____ () C:\Users\Jan_2\Desktop\gsg_tuts - Verknüpfung.lnk 2014-02-01 22:29 - 2014-02-01 22:30 - 00001004 _____ () C:\Users\Jan_2\Desktop\hochstuhl - Verknüpfung.lnk 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\Documents\Ulead Burn.Now 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Ulead Systems 2014-02-01 22:21 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Corel 2014-02-01 22:20 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\Corel 2014-02-01 22:20 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2 2014-02-01 22:20 - 2011-11-20 10:58 - 00000900 ___SH () C:\ProgramData\KGyGaAvL.sys 2014-02-01 22:11 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Apple Computer 2014-02-01 21:46 - 2012-07-03 09:29 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\com.adobe.dmp.contentviewer 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Thunderbird 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Thunderbird 2014-02-01 16:23 - 2014-02-01 16:23 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\HpUpdate 2014-02-01 10:08 - 2014-02-01 10:05 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\SolidWorks 2014-02-01 10:03 - 2014-02-01 10:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\NVIDIA 2014-02-01 08:46 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Tobit 2014-02-01 08:46 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\VirtualStore 2014-02-01 08:39 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Apple Computer 2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-31 22:52 - 2011-10-30 12:19 - 00005291 _____ () C:\ProgramData\hpzinstall.log 2014-01-31 22:50 - 2014-01-31 22:50 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\PwrMgr 2014-01-31 22:42 - 2014-01-31 22:40 - 00000000 ____D () C:\ProgramData\Oracle 2014-01-31 22:39 - 2014-01-31 22:39 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-31 22:39 - 2011-10-30 22:26 - 00000000 ____D () C:\Program Files (x86)\Java 2014-01-31 20:52 - 2014-01-31 20:52 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Macromedia 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Mozilla 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Mozilla 2014-01-31 15:36 - 2014-01-31 15:36 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Avira 2014-01-31 15:31 - 2014-01-31 15:31 - 00140216 _____ () C:\Users\Jan_2\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-31 15:31 - 2014-01-31 15:31 - 00001432 _____ () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\Virtual Machines 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Logitech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Leadertech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Adobe 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Lenovo 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Adobe 2014-01-31 15:30 - 2014-01-31 15:30 - 00000020 ___SH () C:\Users\Jan_2\ntuser.ini 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Vorlagen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Startmenü 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Netzwerkumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Lokale Einstellungen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Eigene Dateien 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Druckumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Musik 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Bilder 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Verlauf 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Intel 2014-01-31 11:37 - 2014-01-31 11:37 - 00000000 _____ () C:\Windows\setuperr.log 2014-01-31 11:35 - 2011-11-22 23:37 - 00000000 ____D () C:\Program Files\CCleaner 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iTunes 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iPod 2014-01-31 01:00 - 2012-01-21 22:03 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-01-30 23:28 - 2014-01-30 23:28 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-01-30 23:28 - 2011-10-30 11:58 - 00000000 ____D () C:\ProgramData\Skype 2014-01-30 23:26 - 2012-04-05 08:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-30 23:26 - 2011-10-28 13:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-30 23:25 - 2011-11-02 16:33 - 00000000 ____D () C:\ProgramData\Apple 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Program Files (x86)\Secunia 2014-01-30 20:52 - 2011-07-26 11:11 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-01-29 23:02 - 2014-01-29 23:02 - 13031424 _____ (Intel Corporation) C:\Windows\system32\ig4icd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 12617216 _____ (Intel Corporation) C:\Windows\system32\igdumd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11176448 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11049472 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 10812928 _____ (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 05904856 _____ (Intel Corporation) C:\Windows\system32\GfxUI.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 05363200 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2014-01-29 23:02 - 2014-01-29 23:02 - 03511296 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 03121152 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 01040384 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00931840 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00575488 _____ (Intel Corporation) C:\Windows\system32\igfx11cmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00542720 _____ (Intel Corporation) C:\Windows\SysWOW64\igfx11cmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00515544 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00442880 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00442328 _____ (Intel Corporation) C:\Windows\system32\igfxpers.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00440320 _____ (Intel Corporation) C:\Windows\system32\igfxrell.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxrfra.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxresn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrus.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrom.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrsky.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrptg.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrplk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrnld.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrita.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrhrv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrdeu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrhun.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrfin.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrcsy.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrtrk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrsve.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrslv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrptb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrnor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrtha.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrdan.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrheb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrara.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00432128 _____ (Intel Corporation) C:\Windows\system32\igfxrjpn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00431104 _____ (Intel Corporation) C:\Windows\system32\igfxrkor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00429056 _____ (Intel Corporation) C:\Windows\system32\igfxrcht.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00428544 _____ (Intel Corporation) C:\Windows\system32\igfxrchs.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00410624 _____ (Intel Corporation) C:\Windows\system32\igfxTMM.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00399832 _____ (Intel Corporation) C:\Windows\system32\hkcmd.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00384512 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00330752 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00286208 _____ (Intel Corporation) C:\Windows\system32\igfxrenu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00279000 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00254936 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00223664 _____ () C:\Windows\system32\Gfxres.th-TH.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00210106 _____ () C:\Windows\system32\Gfxres.el-GR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00194245 _____ () C:\Windows\system32\Gfxres.ru-RU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00185816 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00175104 _____ (Intel Corporation) C:\Windows\system32\gfxSrvc.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00171992 _____ (Intel Corporation) C:\Windows\system32\igfxtray.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00166170 _____ () C:\Windows\system32\Gfxres.ar-SA.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00163421 _____ () C:\Windows\system32\Gfxres.ja-JP.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00159008 _____ () C:\Windows\system32\Gfxres.he-IL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00149682 _____ () C:\Windows\system32\Gfxres.it-IT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00148042 _____ () C:\Windows\system32\Gfxres.ko-KR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147393 _____ () C:\Windows\system32\Gfxres.de-DE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147288 _____ () C:\Windows\system32\Gfxres.es-ES.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00146004 _____ () C:\Windows\system32\Gfxres.ro-RO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00145491 _____ () C:\Windows\system32\Gfxres.fr-FR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144645 _____ () C:\Windows\system32\Gfxres.tr-TR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144260 _____ () C:\Windows\system32\Gfxres.pt-BR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144020 _____ () C:\Windows\system32\Gfxres.nl-NL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00143932 _____ () C:\Windows\system32\Gfxres.hu-HU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142882 _____ () C:\Windows\system32\Gfxres.sv-SE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142877 _____ () C:\Windows\system32\Gfxres.pt-PT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142717 _____ () C:\Windows\system32\Gfxres.pl-PL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142336 _____ (Intel Corporation) C:\Windows\system32\igfxdo.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00142289 _____ () C:\Windows\system32\Gfxres.cs-CZ.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142008 _____ () C:\Windows\system32\Gfxres.fi-FI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141838 _____ () C:\Windows\system32\Gfxres.sk-SK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141049 _____ () C:\Windows\system32\Gfxres.hr-HR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137889 _____ () C:\Windows\system32\Gfxres.sl-SI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137784 _____ () C:\Windows\system32\Gfxres.nb-NO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137141 _____ () C:\Windows\system32\Gfxres.da-DK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00132623 _____ () C:\Windows\system32\Gfxres.en-US.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00126976 _____ (Intel Corporation) C:\Windows\system32\igfxcpl.cpl 2014-01-29 23:02 - 2014-01-29 23:02 - 00126300 _____ () C:\Windows\system32\Gfxres.zh-TW.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00124650 _____ () C:\Windows\system32\Gfxres.zh-CN.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00116224 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v3347.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00098304 _____ () C:\Windows\system32\igdde64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00077312 _____ () C:\Windows\SysWOW64\igdde32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00025088 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00017058 _____ () C:\Windows\system32\iglhxs64.vp 2014-01-29 23:02 - 2014-01-29 23:02 - 00009728 _____ ( ) C:\Windows\system32\IGFXDEVLib.dll 2014-01-29 23:02 - 2012-09-28 10:51 - 09007616 _____ (Intel Corporation) C:\Windows\system32\igfxress.dll 2014-01-29 23:02 - 2011-12-03 15:03 - 00028672 _____ (Intel Corporation) C:\Windows\system32\igfxexps.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 12859392 _____ (Intel Corporation) C:\Windows\system32\igd10umd64.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 00110592 _____ (Intel Corporation) C:\Windows\system32\hccutils.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 00064000 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll 2014-01-26 19:58 - 2012-10-23 22:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-01-16 19:47 - 2011-11-24 17:36 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\SolidWorks 2014-01-16 10:50 - 2009-07-14 05:45 - 05660280 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-01-16 10:35 - 2013-08-24 08:38 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-16 10:33 - 2011-10-28 13:26 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-14 09:43 - 2011-10-28 10:19 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 2014-01-09 13:54 - 2011-10-29 00:20 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\DAEMON Tools Lite 2014-01-09 13:47 - 2014-01-09 13:47 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-01-09 13:47 - 2011-10-29 00:23 - 00381440 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys 2014-01-09 11:30 - 2011-10-30 11:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Skype 2014-01-04 20:57 - 2014-01-04 20:57 - 00000000 ____D () C:\Program Files (x86)\QuickTime Some content of TEMP: ==================== C:\Users\Jan_2\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ und die FRST.Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2014 04 Ran by Jan_2 at 2014-02-03 13:01:00 Running from C:\Users\Jan_2\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) Hidden 64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden 7-Zip 9.20 (x32 Version: - ) Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.9 - Adobe Systems) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden Adobe Creative Suite 6 Design Standard (x32 Version: 6 - Adobe Systems Incorporated) Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.38 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated) Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden Adobe® Content Viewer (x32 Version: 3.4.0 - Adobe Systems Incorporated) Adobe® Content Viewer (x32 Version: 3.4.0 - Adobe Systems Incorporated) Hidden Anzeige am Bildschirm (Version: 6.22.00 - ) Apple Application Support (x32 Version: 3.0 - Apple Inc.) Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.) Audacity 2.0.5 (x32 Version: 2.0.5 - Audacity Team) Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira) Bonjour (Version: 3.0.0.10 - Apple Inc.) Broadcom InConcert Maestro (Version: 1.0.1.1500 - Broadcom Corporation) BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden CCleaner (Version: 4.10 - Piriform) CDDRV_Installer (Version: 4.60 - Logitech) Hidden CINEMA 4D 12.016 (Version: 12.016 - MAXON Computer GmbH) Conexant 20672 SmartAudio HD (Version: 8.32.23.2 - Conexant) Copy (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0 - Corel Corporation) Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0 - Corel Corporation) Corel WinDVD (x32 Version: 10.0.5.828 - Corel Inc.) Coupon Printer for Windows (x32 Version: 5.0.0.0 - Coupons.com Incorporated) <==== ATTENTION Create Recovery Media (x32 Version: 1.20.0.00 - Lenovo Group Limited) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft) Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Dienstprogramm "ThinkPad UltraNav" (x32 Version: 2.13.0 - Lenovo) Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (Version: 1.00 - ) DJ_AIO_06_F2400_SW_Min (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden DWGeditor (x32 Version: 18.00.5035 - SolidWorks) Hidden Energie-Manager (x32 Version: 6.07 - ) erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden F2400 (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden FH-Aachen OpenVPN 2.2.0 (x32 Version: 2.2.0 - ) GPBaseService2 (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden HP Customer Participation Program 14.0 (Version: 14.0 - HP) HP Deskjet F2400 All-in-One Driver Software 14.0 Rel. 6 (Version: 14.0 - HP) HP Imaging Device Functions 14.0 (Version: 14.0 - HP) HP LaserJet P2050 Series 6.0 (Version: 6.0 - HP) HP Product Detection (x32 Version: 11.14.0001 - HP) HP Solution Center 14.0 (Version: 14.0 - HP) HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard) HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden hppFonts (x32 Version: 001.001.00061 - Hewlett-Packard) Hidden HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden hppQFolderP2050 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Integrated Camera Driver Installer Package Ver.1.1.0.1147 (x32 Version: 1.1.0.1147 - RICOH) Integrated Camera TWAIN (x32 Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.) Intel PROSet Wireless (Version: - ) Hidden Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation) Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0 - Intel Corporation) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation) Intel(R) Processor Graphics (x32 Version: 9.17.10.3347 - Intel Corporation) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.2.0.0284 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation) Intel® PROSet/Wireless WiFi-Software (Version: 15.02.0000.1258 - Intel Corporation) iTunes (Version: 11.1.4.62 - Apple Inc.) Java 7 Update 51 (x32 Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden LAME v3.99.3 (for Windows) (x32 Version: - ) Lenovo Auto Scroll Utility (Version: 1.00 - ) Lenovo Patch Utility (x32 Version: 1.3.0.007 - Lenovo Group Limited) Lenovo Patch Utility 64 bit (Version: 1.3.0.007 - Lenovo Group Limited) Lenovo Power Management Driver (Version: 1.67.04.04 - ) Lenovo Registration (x32 Version: 1.0.2 - Lenovo Inc.) Lenovo System Interface Driver (Version: 1.05 - ) Lenovo ThinkVantage Toolbox (Version: 6.0.5849.23 - PC-Doctor, Inc.) Lenovo User Guide (x32 Version: 1.0.0008.00 - Ihr Firmenname) Lenovo Warranty Information (x32 Version: 1.0.0005.00 - Lenovo) Lenovo Welcome (x32 Version: 2.02.003.0 - Lenovo) Logitech SetPoint (x32 Version: 4.80 - Logitech) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation) MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Message Center Plus (x32 Version: 2.0.0012.00 - Lenovo Group Limited) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office 2003 Web Components (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 8.0 Support DLLs (x32 Version: 1.0.0 - McNeel & Associates) Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: - Microsoft Corporation) Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: 8.0.52572 - Microsoft Corporation) Hidden Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: - Microsoft Corporation) Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: 8.0.50727.146 - Microsoft Corporation) Hidden Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Mobile Partner (x32 Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd) Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla) Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla) Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation) NVIDIA 3D Vision Treiber 312.69 (Version: 312.69 - NVIDIA Corporation) NVIDIA Grafiktreiber 312.69 (Version: 312.69 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.2.23.3 (Version: 1.2.23.3 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden NVIDIA nView 140.75 (Version: 140.75 - NVIDIA Corporation) NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden PANTONE Color Calibrator 1.0 (x32 Version: - X-Rite) PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden PhotoView 360 (x32 Version: 18.00.5035 - SolidWorks Corporation) Hidden QuickTime (x32 Version: 7.74.80.86 - Apple Inc.) RapidBoot (x32 Version: 1.00 - Lenovo) RapidBoot (x32 Version: 1.00 - Lenovo) Hidden Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (Version: 1.00 - ) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden Rescue and Recovery (x32 Version: 4.31.0010.00 - Lenovo Group Limited) Rhinoceros 4.0 SR9 (x32 Version: 4.0.60309 - Robert McNeel & Associates) Rhinoceros 4.0 Trainingsmaterial - Stufe 1 (x32 Version: 4.0.0.0 - Robert McNeel & Associates) RICOH_Media_Driver_v2.13.18.02 (x32 Version: 2.13.18.02 - RICOH) SAMSUNG USB Driver for Mobile Phones (Version: 1.4.8.0 - SAMSUNG Electronics Co., Ltd.) Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden Secunia PSI (3.0.0.9016) (x32 Version: 3.0.0.9016 - Secunia) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.3 (x32 Version: 6.3.105 - Skype Technologies S.A.) SolidWorks 2010 x64 Edition SP0 (Version: 18.100.5035 - SolidWorks) Hidden SolidWorks 2010 x64 Edition SP0 (x32 Version: 18.0.0.5035 - SolidWorks Corporation) SolidWorks eDrawings 2010 (x32 Version: 10.0.727 - Dassault Systèmes SolidWorks Corp.) Hidden SolidWorks Explorer 2010 SP0 x64 Edition (Version: 18.00.5035 - SolidWorks Corporation) Hidden SolutionCenter (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden Status (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden System Requirements Lab for Intel (x32 Version: 4.5.11.0 - Husdawg, LLC) System Update (x32 Version: 4.00.0042 - Lenovo) TBBackup 2 (Freiversion) (x32 Version: 2 - Priotecs IT GmbH) ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.4.0.1500 - Broadcom Corporation) ThinkPad FullScreen Magnifier (Version: 2.22 - ) ThinkPad Modem Adapter (Version: 7.80.5.0 - Conexant Systems) ThinkPad UltraNav Driver (Version: 16.2.19.7 - ) ThinkVantage AutoLock (Version: 1.01 - Lenovo) ThinkVantage Communications Utility (Version: 2.06 - Lenovo) ThinkVantage Fingerprint Software (Version: 5.9.4.6882 - UPEK Inc.) ThinkVantage System für aktiven Festplattenschutz (Version: 1.73 - Lenovo) Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft) VIP Access (x32 Version: 2.0.5.13 - VeriSign) WDR RadioRecorder (x32 Version: - Tobit.Software) WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows-Treiberpaket - Intel (e1cexpress) Net (12/21/2010 11.8.84.0) (Version: 12/21/2010 11.8.84.0 - Intel) Windows-Treiberpaket - Intel (MEIx64) System (10/19/2010 7.0.0.1144) (Version: 10/19/2010 7.0.0.1144 - Intel) Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (Version: 09/10/2010 9.2.0.1011 - Intel) Windows-Treiberpaket - Intel System (10/04/2010 9.2.0.1015) (Version: 10/04/2010 9.2.0.1015 - Intel) Windows-Treiberpaket - Intel USB (09/16/2010 9.2.0.1013) (Version: 09/16/2010 9.2.0.1013 - Intel) Windows-Treiberpaket - Lenovo (LenovoRd) SmartCardReader (05/11/2009 4.1.0.1) (Version: 05/11/2009 4.1.0.1 - Lenovo) Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (Version: 11/11/2010 1.61.00.11 - Lenovo) Windows-Treiberpaket - Synaptics (SynTP) Mouse (03/24/2011 15.2.19.0) (Version: 03/24/2011 15.2.19.0 - Synaptics) WinRAR 4.20 (64-Bit) (Version: 4.20.0 - win.rar GmbH) X-Rite Device i1Display Service (x32 Version: 1.0 - X-Rite Inc.) X-Rite Device Manager (x32 Version: 1.0 - X-Rite Inc.) ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ? Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => ? Task: C:\Windows\Tasks\SystemToolsDailyTest.job => ? ==================== Loaded Modules (whitelisted) ============= 2010-12-18 14:50 - 2010-12-18 14:50 - 00173856 ____N () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll 2011-07-26 11:08 - 2012-03-15 05:07 - 00103936 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL 2011-07-26 11:05 - 2011-03-06 12:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-01-03 12:13 - 2009-07-20 12:35 - 00018960 ____N () C:\Program Files\Logitech\SetPoint\khalwrapper.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (02/03/2014 09:54:54 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/03/2014 09:22:25 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 10:58:58 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 07:00:00 PM) (Source: Windows Backup) (User: ) Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)" Error: (02/02/2014 06:41:16 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: pcdrrealtime.p5x, Version: 6.0.5849.23, Zeitstempel: 0x4e08946f Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace4e7 Ausnahmecode: 0x40000015 Fehleroffset: 0x0000000000042686 ID des fehlerhaften Prozesses: 0x798 Startzeit der fehlerhaften Anwendung: 0xpcdrrealtime.p5x0 Pfad der fehlerhaften Anwendung: pcdrrealtime.p5x1 Pfad des fehlerhaften Moduls: pcdrrealtime.p5x2 Berichtskennung: pcdrrealtime.p5x3 Error: (02/02/2014 06:18:18 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: PSIA.exe, Version: 3.0.0.9016, Zeitstempel: 0x52a1d50f Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000 ID des fehlerhaften Prozesses: 0x444 Startzeit der fehlerhaften Anwendung: 0xPSIA.exe0 Pfad der fehlerhaften Anwendung: PSIA.exe1 Pfad des fehlerhaften Moduls: PSIA.exe2 Berichtskennung: PSIA.exe3 Error: (02/02/2014 06:16:13 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 05:17:12 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: pcdrrealtime.p5x, Version: 6.0.5849.23, Zeitstempel: 0x4e08946f Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace4e7 Ausnahmecode: 0x40000015 Fehleroffset: 0x0000000000042686 ID des fehlerhaften Prozesses: 0x1b2c Startzeit der fehlerhaften Anwendung: 0xpcdrrealtime.p5x0 Pfad der fehlerhaften Anwendung: pcdrrealtime.p5x1 Pfad des fehlerhaften Moduls: pcdrrealtime.p5x2 Berichtskennung: pcdrrealtime.p5x3 Error: (02/02/2014 05:02:12 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: PSIA.exe, Version: 3.0.0.9016, Zeitstempel: 0x52a1d50f Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000 ID des fehlerhaften Prozesses: 0x970 Startzeit der fehlerhaften Anwendung: 0xPSIA.exe0 Pfad der fehlerhaften Anwendung: PSIA.exe1 Pfad des fehlerhaften Moduls: PSIA.exe2 Berichtskennung: PSIA.exe3 Error: (02/02/2014 05:00:04 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (02/03/2014 10:58:58 AM) (Source: iaStor) (User: ) Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error: (02/03/2014 09:54:23 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (02/03/2014 09:54:23 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (02/03/2014 09:21:55 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (02/03/2014 09:21:55 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (02/02/2014 11:00:17 PM) (Source: DCOM) (User: ) Description: CSR|KRTHINKPAD Error: (02/02/2014 10:58:28 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (02/02/2014 10:58:28 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Mobile Partner. OUC erreicht. Error: (02/02/2014 06:18:18 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Secunia PSI Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (02/02/2014 06:15:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Mobile Partner. OUC" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Microsoft Office Sessions: ========================= Error: (02/03/2014 09:54:54 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/03/2014 09:22:25 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 10:58:58 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 07:00:00 PM) (Source: Windows Backup)(User: ) Description: I:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006) Error: (02/02/2014 06:41:16 PM) (Source: Application Error)(User: ) Description: pcdrrealtime.p5x6.0.5849.234e08946fMSVCR90.dll9.0.30729.61614dace4e740000015000000000004268679801cf203df9041ffdC:\Program Files\PC-Doctor\pcdrrealtime.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\MSVCR90.dll3727afab-8c31-11e3-a70b-f0def1987e57 Error: (02/02/2014 06:18:18 PM) (Source: Application Error)(User: ) Description: PSIA.exe3.0.0.901652a1d50funknown0.0.0.000000000c00000050000000044401cf203a6843df78C:\Program Files (x86)\Secunia\PSI\PSIA.exeunknown01cab9e2-8c2e-11e3-a70b-f0def1987e57 Error: (02/02/2014 06:16:13 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/02/2014 05:17:12 PM) (Source: Application Error)(User: ) Description: pcdrrealtime.p5x6.0.5849.234e08946fMSVCR90.dll9.0.30729.61614dace4e74000001500000000000426861b2c01cf2032397d7039C:\Program Files\PC-Doctor\pcdrrealtime.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\MSVCR90.dll7855d980-8c25-11e3-8ed1-f0def1987e57 Error: (02/02/2014 05:02:12 PM) (Source: Application Error)(User: ) Description: PSIA.exe3.0.0.901652a1d50funknown0.0.0.000000000c00000050000000097001cf202fc4be6012C:\Program Files (x86)\Secunia\PSI\PSIA.exeunknown5fe9f51b-8c23-11e3-8ed1-f0def1987e57 Error: (02/02/2014 05:00:04 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2014-02-01 22:21:19.505 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.455 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.415 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.325 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.265 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.175 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.125 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.075 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.025 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:18.885 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 42% Total physical RAM: 8075.23 MB Available physical RAM: 4667.79 MB Total Pagefile: 16148.65 MB Available Pagefile: 12264.63 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Windows7_OS) (Fixed) (Total:73.36 GB) (Free:8.38 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive f: () (Fixed) (Total:149.59 GB) (Free:70.71 GB) NTFS Drive g: (Volume) (Fixed) (Total:148.5 GB) (Free:144.05 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ |
03.02.2014, 13:44 | #4 | ||
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstallerZitat:
Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
03.02.2014, 14:02 | #5 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Die Programme habe ich in meinem Studium gebraucht, und mir vorsorglich die günstigen Education-Versionen zugelegt. Ich habe sie bisher aber nicht gewerblich genutzt, da ich seitdem in Elternzeit bin. Also nur privater Gebrauch. Hätte ich sonst mitgeteilt, ich weiß um die Einschränkung bei gewerblich genutzten Programmen und Rechnern. |
03.02.2014, 14:07 | #6 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstallerZitat:
Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html Es geht weiter wenn du alles Illegale entfernt hast. Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.
__________________ --> Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller |
04.02.2014, 11:50 | #7 | ||
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Hallo Cosinus, vielleicht habe ich das gestern nicht klar genug formuliert. Die geposteten Funde von Avira hatte ich bereits aus der Quarantäne gelöscht. Zitat:
Zitat:
Ist eine saubere Neuinstallation von Windows da doch eher angebracht? VG scissor |
04.02.2014, 12:00 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten |
04.02.2014, 12:49 | #9 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller nach der Deaktivierung des Avira Free Antivirus Echtzeitscanners kam noch ein Ereignis kurz nachdem ich die Combofix.exe gestartet hatte. Code:
ATTFilter Exportierte Ereignisse: 04.02.2014 12:07 [Echtzeit-Scanner] Registry blockiert Der Administrator hat per Sicherheitsrichtlinie den Zugriff auf die Registry blockiert. Combofix Logfile: Code:
ATTFilter ComboFix 14-02-03.01 - Jan 04.02.2014 12:08:14.1.8 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8075.4965 [GMT 1:00] ausgeführt von:: c:\users\Jan\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Roaming C:\root c:\root\wpfdot.exe c:\windows\SysWow64\embedded c:\windows\SysWow64\embedded\WizardImage.bmp c:\windows\SysWow64\embedded\WizardSmallImageWeiss.bmp . . ((((((((((((((((((((((( Dateien erstellt von 2014-01-04 bis 2014-02-04 )))))))))))))))))))))))))))))) . . 2014-02-04 11:16 . 2014-02-04 11:16 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{618EC94E-D011-4165-85C8-70A4D23C4DB0}\offreg.dll 2014-02-04 11:16 . 2014-02-04 11:16 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2014-02-04 11:16 . 2014-02-04 11:16 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-02-04 09:06 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{618EC94E-D011-4165-85C8-70A4D23C4DB0}\mpengine.dll 2014-02-03 12:00 . 2014-02-03 12:01 -------- d-----w- C:\FRST 2014-02-02 19:48 . 2014-02-02 19:48 -------- d-----w- c:\users\Jan\AppData\Roaming\Malwarebytes 2014-02-02 19:47 . 2014-02-02 19:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2014-02-02 19:47 . 2014-02-02 19:47 -------- d-----w- c:\programdata\Malwarebytes 2014-02-02 19:47 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-02-02 17:36 . 2014-02-02 17:36 -------- d-----w- c:\users\Jan\AppData\Local\Apps 2014-02-02 17:03 . 2014-02-02 17:03 -------- d-----w- c:\windows\Migration 2014-02-02 16:59 . 2014-02-02 16:59 -------- d-----w- c:\program files\AuthenTec 2014-02-02 16:51 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll 2014-02-02 16:51 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2014-02-01 07:32 . 2014-02-01 07:32 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-31 21:43 . 2014-01-31 21:43 -------- d-----w- c:\program files (x86)\Common Files\Java 2014-01-31 21:40 . 2014-01-31 21:42 -------- d-----w- c:\programdata\Oracle 2014-01-31 21:39 . 2014-01-31 21:39 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-01-31 14:30 . 2014-02-01 21:20 -------- d-----w- c:\users\Jan_2 2014-01-31 00:00 . 2014-01-31 00:00 -------- d-----w- c:\program files\iTunes 2014-01-31 00:00 . 2014-01-31 00:00 -------- d-----w- c:\program files\iPod 2014-01-30 23:59 . 2014-01-30 23:59 -------- d-----w- c:\users\Default\AppData\Roaming\Apple Computer 2014-01-30 23:59 . 2014-01-30 23:59 -------- d-----w- c:\users\Default\AppData\Local\Apple Computer 2014-01-30 22:28 . 2014-01-30 22:28 -------- d-----w- c:\program files (x86)\Common Files\Skype 2014-01-30 22:28 . 2014-01-30 22:28 -------- d-----r- c:\program files (x86)\Skype 2014-01-30 22:21 . 2014-01-30 22:21 -------- d-----w- c:\users\Jan\AppData\Local\Secunia PSI 2014-01-30 22:21 . 2014-01-30 22:21 -------- d-----w- c:\program files (x86)\Secunia 2014-01-15 08:21 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys 2014-01-15 08:21 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2014-01-15 08:21 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys 2014-01-15 08:21 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys 2014-01-15 08:21 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys 2014-01-15 08:21 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys 2014-01-15 08:21 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys 2014-01-15 08:20 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys 2014-01-15 08:20 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys 2014-01-09 12:47 . 2014-01-09 12:47 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite 2014-01-06 13:04 . 2009-07-14 01:41 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-02-01 21:20 . 2011-11-20 09:58 900 --sha-w- c:\programdata\KGyGaAvL.sys 2014-01-30 22:26 . 2012-04-05 07:18 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-01-30 22:26 . 2011-10-28 12:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-01-29 22:02 . 2011-07-26 10:05 64000 ----a-w- c:\windows\system32\igfxsrvc.dll 2014-01-29 22:02 . 2012-09-28 09:51 9007616 ----a-w- c:\windows\system32\igfxress.dll 2014-01-29 22:02 . 2011-12-03 14:03 28672 ----a-w- c:\windows\system32\igfxexps.dll 2014-01-29 22:02 . 2011-07-26 10:05 12859392 ----a-w- c:\windows\system32\igd10umd64.dll 2014-01-29 22:02 . 2011-07-26 10:05 110592 ----a-w- c:\windows\system32\hccutils.dll 2014-01-16 09:33 . 2011-10-28 12:26 86054176 ----a-w- c:\windows\system32\MRT.exe 2014-01-09 12:47 . 2011-10-28 23:23 381440 ----a-w- c:\windows\system32\drivers\sptd.sys 2013-12-18 08:30 . 2013-05-07 12:21 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2013-12-18 08:30 . 2013-03-27 20:42 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys 2013-12-18 08:30 . 2013-03-27 20:42 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe 2013-12-06 14:47 . 2013-12-06 14:47 18456 ----a-w- c:\windows\system32\drivers\psi_mf_amd64.sys 2013-11-27 08:45 . 2013-11-27 08:45 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-11-27 08:45 . 2013-11-27 08:45 194048 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-11-27 08:45 . 2013-11-27 08:45 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2013-11-27 08:45 . 2013-11-27 08:45 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll 2013-11-27 08:45 . 2013-11-27 08:45 62464 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-11-27 08:45 . 2013-11-27 08:45 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll 2013-11-27 08:45 . 2013-11-27 08:45 235008 ----a-w- c:\windows\system32\elshyph.dll 2013-11-27 08:45 . 2013-11-27 08:45 182272 ----a-w- c:\windows\SysWow64\msls31.dll 2013-11-27 08:45 . 2013-11-27 08:45 942592 ----a-w- c:\windows\system32\jsIntl.dll 2013-11-27 08:45 . 2013-11-27 08:45 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll 2013-11-27 08:45 . 2013-11-27 08:45 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2013-11-27 08:45 . 2013-11-27 08:45 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-11-27 08:45 . 2013-11-27 08:45 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll 2013-11-27 08:45 . 2013-11-27 08:45 61952 ----a-w- c:\windows\SysWow64\iesetup.dll 2013-11-27 08:45 . 2013-11-27 08:45 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll 2013-11-27 08:45 . 2013-11-27 08:45 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-11-27 08:45 . 2013-11-27 08:45 454656 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-11-27 08:45 . 2013-11-27 08:45 36352 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-11-27 08:45 . 2013-11-27 08:45 337408 ----a-w- c:\windows\SysWow64\html.iec 2013-11-27 08:45 . 2013-11-27 08:45 247808 ----a-w- c:\windows\system32\msls31.dll 2013-11-27 08:45 . 2013-11-27 08:45 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-11-27 08:45 . 2013-11-27 08:45 151552 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-11-27 08:45 . 2013-11-27 08:45 139264 ----a-w- c:\windows\SysWow64\wextract.exe 2013-11-27 08:45 . 2013-11-27 08:45 13312 ----a-w- c:\windows\SysWow64\mshta.exe 2013-11-27 08:45 . 2013-11-27 08:45 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-11-27 08:45 . 2013-11-27 08:45 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-11-27 08:45 . 2013-11-27 08:45 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-11-27 08:45 . 2013-11-27 08:45 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-11-27 08:45 . 2013-11-27 08:45 84992 ----a-w- c:\windows\system32\mshtmled.dll 2013-11-27 08:45 . 2013-11-27 08:45 83968 ----a-w- c:\windows\system32\MshtmlDac.dll 2013-11-27 08:45 . 2013-11-27 08:45 81408 ----a-w- c:\windows\system32\icardie.dll 2013-11-27 08:45 . 2013-11-27 08:45 774144 ----a-w- c:\windows\system32\jscript.dll 2013-11-27 08:45 . 2013-11-27 08:45 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-11-27 08:45 . 2013-11-27 08:45 626176 ----a-w- c:\windows\system32\msfeeds.dll 2013-11-27 08:45 . 2013-11-27 08:45 62464 ----a-w- c:\windows\system32\pngfilt.dll 2013-11-27 08:45 . 2013-11-27 08:45 616104 ----a-w- c:\windows\system32\ieapfltr.dat 2013-11-27 08:45 . 2013-11-27 08:45 548352 ----a-w- c:\windows\system32\vbscript.dll 2013-11-27 08:45 . 2013-11-27 08:45 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-11-27 08:45 . 2013-11-27 08:45 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-11-27 08:45 . 2013-11-27 08:45 48128 ----a-w- c:\windows\system32\imgutil.dll 2013-11-27 08:45 . 2013-11-27 08:45 453120 ----a-w- c:\windows\system32\dxtmsft.dll 2013-11-27 08:45 . 2013-11-27 08:45 413696 ----a-w- c:\windows\system32\html.iec 2013-11-27 08:45 . 2013-11-27 08:45 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll 2013-11-27 08:45 . 2013-11-27 08:45 30208 ----a-w- c:\windows\system32\licmgr10.dll 2013-11-27 08:45 . 2013-11-27 08:45 296960 ----a-w- c:\windows\system32\dxtrans.dll 2013-11-27 08:45 . 2013-11-27 08:45 263376 ----a-w- c:\windows\system32\iedkcs32.dll 2013-11-27 08:45 . 2013-11-27 08:45 243200 ----a-w- c:\windows\system32\webcheck.dll 2013-11-27 08:45 . 2013-11-27 08:45 235520 ----a-w- c:\windows\system32\url.dll 2013-11-27 08:45 . 2013-11-27 08:45 195584 ----a-w- c:\windows\system32\msrating.dll 2013-11-27 08:45 . 2013-11-27 08:45 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-11-27 08:45 . 2013-11-27 08:45 147968 ----a-w- c:\windows\system32\occache.dll 2013-11-27 08:45 . 2013-11-27 08:45 143872 ----a-w- c:\windows\system32\wextract.exe 2013-11-27 08:45 . 2013-11-27 08:45 13824 ----a-w- c:\windows\system32\mshta.exe 2013-11-27 08:45 . 2013-11-27 08:45 135680 ----a-w- c:\windows\system32\iepeers.dll 2013-11-27 08:45 . 2013-11-27 08:45 13312 ----a-w- c:\windows\system32\msfeedssync.exe 2013-11-27 08:45 . 2013-11-27 08:45 131072 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-11-27 08:45 . 2013-11-27 08:45 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-11-27 08:45 . 2013-11-27 08:45 105984 ----a-w- c:\windows\system32\iesysprep.dll 2013-11-27 08:45 . 2013-11-27 08:45 101376 ----a-w- c:\windows\system32\inseng.dll 2013-11-26 11:54 . 2013-12-12 08:24 23183360 ----a-w- c:\windows\system32\mshtml.dll 2013-11-26 10:19 . 2013-12-12 08:24 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2013-11-26 10:18 . 2013-12-12 08:24 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll 2013-11-26 09:48 . 2013-12-12 08:24 66048 ----a-w- c:\windows\system32\iesetup.dll 2013-11-26 09:46 . 2013-12-12 08:24 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll 2013-11-26 09:41 . 2013-12-12 08:24 2764288 ----a-w- c:\windows\system32\iertutil.dll 2013-11-26 09:29 . 2013-12-12 08:24 53760 ----a-w- c:\windows\system32\jsproxy.dll 2013-11-26 09:27 . 2013-12-12 08:24 33792 ----a-w- c:\windows\system32\iernonce.dll 2013-11-26 09:23 . 2013-12-12 08:24 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb 2013-11-26 09:21 . 2013-12-12 08:24 574976 ----a-w- c:\windows\system32\ieui.dll 2013-11-26 09:18 . 2013-12-12 08:24 139264 ----a-w- c:\windows\system32\ieUnatt.exe 2013-11-26 09:18 . 2013-12-12 08:24 111616 ----a-w- c:\windows\system32\ieetwcollector.exe 2013-11-26 09:16 . 2013-12-12 08:24 708608 ----a-w- c:\windows\system32\jscript9diag.dll 2013-11-26 08:57 . 2013-12-12 08:24 218624 ----a-w- c:\windows\system32\ie4uinit.exe 2013-11-26 08:35 . 2013-12-12 08:24 5769216 ----a-w- c:\windows\system32\jscript9.dll 2013-11-26 08:28 . 2013-12-12 08:24 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll 2013-11-26 08:16 . 2013-12-12 08:24 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll 2013-11-26 08:02 . 2013-12-12 08:24 1995264 ----a-w- c:\windows\system32\inetcpl.cpl 2013-11-26 07:48 . 2013-12-12 08:24 12996608 ----a-w- c:\windows\system32\ieframe.dll 2013-11-26 07:32 . 2013-12-12 08:24 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-11-26 07:07 . 2013-12-12 08:24 2334208 ----a-w- c:\windows\system32\wininet.dll 2013-11-26 06:40 . 2013-12-12 08:24 1395200 ----a-w- c:\windows\system32\urlmon.dll 2013-11-26 06:34 . 2013-12-12 08:24 817664 ----a-w- c:\windows\system32\ieapfltr.dll 2013-11-26 06:33 . 2013-12-12 08:24 1820160 ----a-w- c:\windows\SysWow64\wininet.dll 2013-11-23 18:26 . 2013-12-11 08:49 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll 2013-11-23 17:47 . 2013-12-11 08:49 465920 ----a-w- c:\windows\system32\WMPhoto.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Akamai NetSession Interface"="c:\users\Jan\AppData\Local\Akamai\netsession_win.exe" [2013-06-04 4489472] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-17 112152] "PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2012-03-15 5935680] "X-Rite Legacy Device"="c:\program files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe" [2010-09-27 105984] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904] "Lenovo Registration"="c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-02-09 4309184] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2013-04-25 1075296] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-12-18 41336] "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-12-18 840568] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-01-20 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2010-12-18 1202976] Color Calibrator Gamma.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe [2011-7-26 802816] Color Calibrator Tray.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe [2011-7-26 10383872] Digital Line Detect.lnk - c:\program files (x86)\Digital Line Detect\DLG.exe [2011-7-26 50688] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2012-1-3 1207312] Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-12-6 565464] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="userinit.exe" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 HyperW7Svc;HyperW7 Service;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe [x] R2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\program files (x86)\Mobile Partner\UpdateDog\ouc.exe;c:\program files (x86)\Mobile Partner\UpdateDog\ouc.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protokoll;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x] R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x] R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbwwan.sys [x] R3 grmobileavs;Guitar Rig Mobile I/O WDM Audio;c:\windows\system32\Drivers\grmobileavs.sys;c:\windows\SYSNATIVE\Drivers\grmobileavs.sys [x] R3 grmobileavs_x64;grmobileavs_x64;c:\windows\system32\Drivers\grmobileavs_x64.sys;c:\windows\SYSNATIVE\Drivers\grmobileavs_x64.sys [x] R3 grmobileusb_x64;grmobileusb_x64;c:\windows\system32\Drivers\grmobileusb_x64.sys;c:\windows\SYSNATIVE\Drivers\grmobileusb_x64.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x] R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x] R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys;c:\windows\SYSNATIVE\drivers\pmxdrv.sys [x] R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x] R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys;c:\windows\SYSNATIVE\DRIVERS\sscebus.sys [x] R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys;c:\windows\SYSNATIVE\DRIVERS\sscemdfl.sys [x] R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys;c:\windows\SYSNATIVE\DRIVERS\sscemdm.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x] S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys;c:\windows\SYSNATIVE\DRIVERS\smiifx64.sys [x] S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x] S1 PHCORE;PHCORE;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS [x] S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x] S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x] S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x] S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x] S2 i1 Display Service;X-Rite Device i1 Display;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [x] S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x] S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x] S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x] S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x] S2 Radio.fx;Radio.fx Server;f:\tobit radio.fx\Server\rfx-server.exe;f:\tobit radio.fx\Server\rfx-server.exe [x] S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x] S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe;c:\windows\SYSNATIVE\SAsrv.exe [x] S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x] S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x] S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 VIPAppService;VIPAppService;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe [x] S2 xritedeviced;X-Rite Device Manager;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe [x] S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x] S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x] S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x] S3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x] S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x] S3 LenovoRd;LenovoRd;c:\windows\system32\Drivers\LenovoRd.sys;c:\windows\SYSNATIVE\Drivers\LenovoRd.sys [x] S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x] S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x] S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x] S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x] S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys;c:\windows\SYSNATIVE\DRIVERS\Tvti2c.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Inhalt des "geplante Tasks" Ordners . 2014-02-04 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 22:26] . 2014-01-14 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:06] . 2014-02-03 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\PC-Doctor\uaclauncher.exe [2011-03-31 15:06] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 ----a-w- c:\users\Jan\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TpShocks"="TpShocks.exe" [2010-12-09 380776] "ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056] "LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-04-04 41320] "ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-02-28 281448] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904] "nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2013-11-15 2747680] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2014-01-29 171992] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2014-01-29 399832] "Persistence"="c:\windows\system32\igfxpers.exe" [2014-01-29 442328] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\nvinitx.dll . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.linkury.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local> uSearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{6EF977DF-533C-486F-9BED-5F2007576149}: NameServer = 193.189.244.225 193.189.244.206 FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ecosia.org/ FF - prefs.js: network.proxy.type - 0 FF - ExtSQL: !HIDDEN! 2011-10-30 12:22; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-{0886900B-B2F3-452C-B580-60F1253F7F80} - c:\programdata\{B9F6456A-E0C8-4BD3-A6E8-AFA8859EC4C4}\Controller Editor Setup PC.exe AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\programdata\{95B4F0ED-951F-4D36-B068-5EC1C4C19C14}\Service Center Setup PC.exe AddRemove-{2930FB47-6452-4476-BF16-D77F748646DB} - c:\programdata\{4F32CAF7-963B-404D-BF13-C48BA3F5F6A7}\GuitarRig Mobile IO Driver Setup.exe AddRemove-{7930FB47-6452-4476-BF16-D77F748646DB} - c:\programdata\{AC46DC4F-66BD-4733-A8B4-0B69418C12D0}\Session IO Driver Setup.exe AddRemove-{B962AD08-335F-46f7-A182-257D37672E5C} - c:\programdata\{EC98E512-708C-4C3B-9F07-B58768C1DD8A}\Rig Kontrol 3 Driver Setup.exe AddRemove-{C7FAFC98-5ECC-40FC-B440-A5D5FE3A6A6E} - c:\programdata\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_38_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_38_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_38_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_38_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_38.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_38.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_38.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_38.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2014-02-04 12:31:53 ComboFix-quarantined-files.txt 2014-02-04 11:31 . Vor Suchlauf: 15 Verzeichnis(se), 17.337.237.504 Bytes frei Nach Suchlauf: 19 Verzeichnis(se), 18.011.099.136 Bytes frei . - - End Of File - - F2CC020E45BFD522D52F904224DF696E mir fällt gerade auf das in der Windows-Taskleiste, rechts keine Uhrzeit und andere Symbole, Windows-Benachrichtigung /- Warnhinweis-Symbole nicht mehr angezeigt werden, müssen diese neu eingerichtet werden? |
04.02.2014, 15:38 | #10 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten |
04.02.2014, 20:05 | #11 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller hier das mbar-log: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1009 www.malwarebytes.org Database version: v2014.02.04.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Jan :: THINKTAB [administrator] 04.02.2014 19:46:05 mbar-log-2014-02-04 (19-46-05).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged. Objects scanned: 306412 Time elapsed: 6 minute(s), 31 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end) |
04.02.2014, 20:09 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
04.02.2014, 21:57 | #13 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller adwcleaner-log: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 04/02/2014 um 20:56:20 # Updated 28/01/2014 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzername : Jan - THINKTAB # Gestartet von : C:\Users\Jan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Users\Jan\AppData\Local\OpenCandy Datei Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\11-suche.xml ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Softonic ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16428 Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL] Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant] Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\prefs.js ] Zeile gelöscht : user_pref("extensions.linkuryfirefoxremoteplugin@linkury.com.install-event-fired", true); [ Datei : C:\Users\Jan_2\AppData\Roaming\Mozilla\Firefox\Profiles\p9y44c1v.default\prefs.js ] ************************* AdwCleaner[R0].txt - [3280 octets] - [04/02/2014 20:53:18] AdwCleaner[S0].txt - [2565 octets] - [04/02/2014 20:56:20] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2625 octets] ########## [/CODE] das jrt-log: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.1 (02.04.2014:1) OS: Windows 7 Professional x64 Ran by Jan on 04.02.2014 at 21:05:51,21 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Program Files (x86)\coupons" Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{0AFF528D-6F64-499D-BC02-97882EEA9FEE} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{129B0AD1-CCF6-49F7-9B96-A47E98C68EAB} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{2C56D474-EEDA-4155-B952-8B39D7137560} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{3CBA954B-59B3-42B2-90DA-D4BA583D46C4} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{3FA67A9F-0613-45AF-849C-882A6D412884} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{47D95ED0-620D-4A15-B47E-DCF557440F28} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{4DE08413-DBF5-49C1-B4C3-AED6FACAE60D} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{53AA6ACF-C0F4-4576-A870-88B0FBF73316} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{5B0CEC3F-3580-4317-95B5-6D947DF84274} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{6377857B-779E-4209-BEBA-D421C8AB36FB} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{66249DD1-B95C-4F3E-B695-765C59D6E4D8} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{699EA126-EE78-4FA4-98D7-52BCD28667A0} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{6AB395A1-47EB-4B5B-BB2E-2268D0838012} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{73668700-8C5F-4FBB-B3BB-455F8F6E8EF3} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{78309ED6-E081-4FBA-A176-2AC05AA6310C} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{8C1D412A-387F-4A08-B1CD-BC113645F00A} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{9909FB9E-7A28-454D-93FA-6B5E8E4194F5} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{9BB6EDEB-7CEF-4BE6-A86A-731992AF5E05} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{A17ABC19-E909-4911-8B38-95DA7A736294} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{B366A948-9101-4DC3-8823-BFCC2F84D7C1} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{B472EE74-1748-4D0D-8176-CE74E8380B26} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{B89C2EFC-1431-4E05-8CF5-351A77EE46ED} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{C2AE5E5B-A0B3-4D6A-95E5-739CE0994EB5} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{D05F6DA1-A5D9-45A4-9A07-E699AAE70445} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{D38A2289-93D6-42B0-ABA2-0AC0355EBD0D} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{DC4B5EBF-F9A4-4567-8979-19818E211BD0} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{EA3B0B1F-CEC0-4262-A859-4CEB8779FDC6} Successfully deleted: [Empty Folder] C:\Users\Jan\appdata\local\{EBBCE301-4044-42A4-935A-ECB5743916E7} ~~~ FireFox Emptied folder: C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\zkbbcznn.default\minidumps [47 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 04.02.2014 at 21:10:44,15 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ich muss den FRST-Scan nochmal durchführen, konnte keinen addition.txt finden. post folgt |
04.02.2014, 21:58 | #14 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller Es muss auch ein Haken bei additions gesetzt sein. Fehlt der wird logischerweise auch keine neue additions.txt erstellt. So stehts ja auch unterschwellig in der Anleitung: Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
04.02.2014, 22:09 | #15 |
| Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller ok, sorry meine aufmerksamkeit scheint nachzulassen. hier der FRST-Scan FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014 Ran by Jan (administrator) on THINKTAB on 04-02-2014 21:34:01 Running from C:\Users\Jan\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe () F:\Tobit Radio.fx\Server\rfx-server.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe (Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (UPEK Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Lenovo.) C:\Windows\System32\TpShocks.exe () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe (Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Akamai Technologies, Inc.) C:\Users\Jan\AppData\Local\Akamai\netsession_win.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Akamai Technologies, Inc.) C:\Users\Jan\AppData\Local\Akamai\netsession_win.exe (Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe () C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Lenovo Group Limited) C:\Program Files (x86)\Lenovo\System Update\SUService.exe (Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe () C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Microsoft Corporation) C:\Windows\System32\UI0Detect.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [380776 2010-12-09] (Lenovo.) HKLM\...\Run: [ForteConfig] - C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] () HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [41320 2011-04-04] (Lenovo Group Limited) HKLM\...\Run: [ALCKRESI.EXE] - C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281448 2011-02-28] (Lenovo Group Limited) HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [130576 2009-06-17] (Logitech, Inc.) HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated) HKLM\...\Run: [nwiz] - C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2747680 2013-11-15] () HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated) HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation) HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor HKLM-x32\...\Run: [X-Rite Legacy Device] - C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4309184 2011-02-09] (Lenovo, Inc.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-12-18] (Adobe Systems Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.) HKU\.DEFAULT\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKU\S-1-5-21-2530740734-657176599-3957329625-1001\...\Run: [Akamai NetSession Interface] - C:\Users\Jan\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKU\S-1-5-21-2530740734-657176599-3957329625-1001\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{6EF977DF-533C-486F-9BED-5F2007576149}: [NameServer]193.189.244.225 193.189.244.206 FireFox: ======== FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default FF Homepage: hxxp://www.ecosia.org/ FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin-x32: adobe.com/AdobeExManDetect - C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems) FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\myspace-music.xml FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\searchplugins\youtube.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: WOT - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-31] FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\elemhidehelper@adblockplus.org.xpi [2011-10-28] FF Extension: WEB.DE MailCheck - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\toolbar@web.de.xpi [2011-12-20] FF Extension: NoScript - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-30] FF Extension: Ecosia - The search engine that plants trees - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2013-08-27] FF Extension: Adblock Plus - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-10-28] FF Extension: BetterPrivacy - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\zkbbcznn.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-07-08] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-12-21] FF HKLM-x32\...\Firefox\Extensions: [VIP1X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\ FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\ [] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-10-23] FF HKLM-x32\...\Firefox\Extensions: [VIP2X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\ FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\ [] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG) S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-03-15] (Lenovo.) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [239968 2011-12-23] () S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] () S3 OpenVPNService; C:\Program Files (x86)\FH-Aachen OpenVPN\bin\openvpnserv.exe [38926 2011-05-20] () R2 Radio.fx; F:\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] () S2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-12-11] (Lenovo Group Limited) S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-12-11] (Lenovo Group Limited) R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-18] (Symantec Corporation) R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG) S3 grmobileavs; C:\Windows\System32\Drivers\grmobileavs.sys [358480 2011-04-11] (Native Instruments GmbH) S3 grmobileavs_x64; C:\Windows\System32\Drivers\grmobileavs_x64.sys [45072 2008-12-09] (Native Instruments GmbH) S3 grmobileusb_x64; C:\Windows\System32\Drivers\grmobileusb_x64.sys [234000 2008-12-09] (Native Instruments GmbH) R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Lenovo) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-11-15] (NVIDIA Corporation) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-07-26] () R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13840 2009-03-13] (UPEK Inc.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381440 2014-01-09] (Duplex Secure Ltd.) R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.) U3 autzqxi1; C:\Windows\System32\Drivers\autzqxi1.sys [0 ] (Advanced Micro Devices) S3 catchme; \??\C:\ComboFix\catchme.sys [X] U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2011-12-23] (Huawei Technologies Co., Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-04 21:34 - 2014-02-04 21:34 - 00025019 _____ () C:\Users\Jan\Desktop\FRST.txt 2014-02-04 21:31 - 2014-02-04 21:32 - 02080256 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe 2014-02-04 21:10 - 2014-02-04 21:10 - 00003732 _____ () C:\Users\Jan\Desktop\JRT.txt 2014-02-04 21:05 - 2014-02-04 21:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 20:53 - 2014-02-04 20:56 - 00000000 ____D () C:\AdwCleaner 2014-02-04 20:47 - 2014-02-04 20:47 - 01037530 _____ (Thisisu) C:\Users\Jan\Desktop\JRT.exe 2014-02-04 20:46 - 2014-02-04 20:46 - 01166132 _____ () C:\Users\Jan\Desktop\adwcleaner.exe 2014-02-04 19:46 - 2014-02-04 19:58 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-04 19:46 - 2014-02-04 19:46 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-04 19:42 - 2014-02-04 19:45 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-04 19:38 - 2014-02-04 19:58 - 00000000 ____D () C:\Users\Jan\Desktop\mbar 2014-02-04 19:06 - 2014-02-04 19:06 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Jan\Desktop\mbar-1.07.0.1009.exe 2014-02-04 12:41 - 2014-02-04 12:41 - 00000378 _____ () C:\Users\Jan\Desktop\Ereignisse.txt 2014-02-04 12:32 - 2014-02-04 12:32 - 00041398 _____ () C:\ComboFix.txt 2014-02-04 12:07 - 2014-02-04 12:32 - 00000000 ____D () C:\Qoobox 2014-02-04 12:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-04 12:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-04 12:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-04 12:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-04 12:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-04 12:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-04 12:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-04 12:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-04 12:06 - 2014-02-04 12:27 - 00000000 ____D () C:\Windows\erdnt 2014-02-04 12:01 - 2014-02-04 12:02 - 05179684 ____R (Swearware) C:\Users\Jan\Desktop\ComboFix.exe 2014-02-04 00:04 - 2014-02-04 00:04 - 00002630 _____ () C:\Users\Jan_2\Documents\zertifikatexportdatei.pfx 2014-02-03 17:16 - 2014-02-03 17:16 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\WinRAR 2014-02-03 15:34 - 2014-02-03 15:35 - 130658432 _____ () C:\Users\Jan_2\Desktop\avira_free_antivirus_de.exe 2014-02-03 13:01 - 2014-02-03 13:01 - 00034015 _____ () C:\Users\Jan_2\Desktop\Addition.txt 2014-02-03 13:00 - 2014-02-04 21:34 - 00000000 ____D () C:\FRST 2014-02-03 13:00 - 2014-02-03 13:01 - 00063366 _____ () C:\Users\Jan_2\Desktop\FRST.txt 2014-02-03 12:59 - 2014-02-03 12:59 - 02080256 _____ (Farbar) C:\Users\Jan_2\Desktop\FRST64.exe 2014-02-03 11:47 - 2014-02-03 11:47 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Malwarebytes 2014-02-02 20:48 - 2014-02-02 20:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 20:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-02 18:36 - 2014-02-02 18:36 - 00000000 ____D () C:\Users\Jan\AppData\Local\Apps\2.0 2014-02-02 18:15 - 2014-02-04 14:17 - 00119954 _____ () C:\Windows\PFRO.log 2014-02-02 18:03 - 2014-02-02 18:49 - 01598708 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 18:01 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2014-02-02 18:01 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2014-02-02 18:01 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys 2014-02-02 18:01 - 2012-08-23 15:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-02-02 18:01 - 2012-08-23 14:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2014-02-02 18:01 - 2012-08-23 14:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2014-02-02 18:01 - 2012-08-23 14:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2014-02-02 18:01 - 2012-08-23 14:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-02-02 18:01 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2014-02-02 18:01 - 2012-08-23 14:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2014-02-02 18:01 - 2012-08-23 14:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-02-02 18:01 - 2012-08-23 14:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2014-02-02 18:01 - 2012-08-23 14:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-02-02 18:01 - 2012-08-23 13:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-02-02 18:01 - 2012-08-23 12:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2014-02-02 18:01 - 2012-08-23 12:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-02-02 18:01 - 2012-08-23 12:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-02-02 18:01 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2014-02-02 18:01 - 2012-08-23 11:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2014-02-02 18:01 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2014-02-02 18:01 - 2012-08-23 11:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-02-02 18:01 - 2012-08-23 11:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-02-02 18:01 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-02-02 18:01 - 2012-08-23 09:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-02-02 18:01 - 2012-08-23 09:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-02-02 17:59 - 2014-02-02 17:59 - 00000000 ____D () C:\Program Files\AuthenTec 2014-02-02 17:51 - 2012-05-04 12:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-02-02 17:51 - 2012-05-04 10:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2014-02-01 22:32 - 2014-02-01 22:32 - 00000921 _____ () C:\Users\Jan_2\Desktop\gsg_tuts - Verknüpfung.lnk 2014-02-01 22:30 - 2014-02-01 22:29 - 00001004 _____ () C:\Users\Jan_2\Desktop\hochstuhl - Verknüpfung.lnk 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\Documents\Ulead Burn.Now 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Ulead Systems 2014-02-01 22:20 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Corel 2014-02-01 22:20 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\Corel 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Thunderbird 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Thunderbird 2014-02-01 16:23 - 2014-02-01 16:23 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\HpUpdate 2014-02-01 10:05 - 2014-02-01 10:08 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\SolidWorks 2014-02-01 10:03 - 2014-02-01 10:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\NVIDIA 2014-02-01 08:46 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Tobit 2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-31 22:50 - 2014-01-31 22:50 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\PwrMgr 2014-01-31 22:40 - 2014-01-31 22:42 - 00000000 ____D () C:\ProgramData\Oracle 2014-01-31 22:39 - 2014-01-31 22:39 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-31 20:52 - 2014-01-31 20:52 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Macromedia 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Mozilla 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Mozilla 2014-01-31 15:36 - 2014-01-31 15:36 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Avira 2014-01-31 15:31 - 2014-02-03 09:56 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\X-Rite 2014-01-31 15:31 - 2014-01-31 15:31 - 00140216 _____ () C:\Users\Jan_2\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-31 15:31 - 2014-01-31 15:31 - 00001432 _____ () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\Virtual Machines 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Logitech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Leadertech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Adobe 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Lenovo 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Adobe 2014-01-31 15:30 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2 2014-01-31 15:30 - 2014-02-01 22:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Apple Computer 2014-01-31 15:30 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\VirtualStore 2014-01-31 15:30 - 2014-02-01 08:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Apple Computer 2014-01-31 15:30 - 2014-01-31 15:30 - 00000020 ___SH () C:\Users\Jan_2\ntuser.ini 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Vorlagen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Startmenü 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Netzwerkumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Lokale Einstellungen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Eigene Dateien 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Druckumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Musik 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Bilder 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Verlauf 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Intel 2014-01-31 15:30 - 2012-03-17 15:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Macromedia 2014-01-31 15:30 - 2011-11-01 00:32 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Microsoft Help 2014-01-31 15:30 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-01-31 15:30 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-01-31 11:37 - 2014-02-04 20:58 - 00003624 _____ () C:\Windows\setupact.log 2014-01-31 11:37 - 2014-01-31 11:37 - 00000000 _____ () C:\Windows\setuperr.log 2014-01-31 08:20 - 2014-01-31 08:20 - 02434048 _____ () C:\Users\Jan\Desktop\msxml.msi 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iTunes 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iPod 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-01-30 23:28 - 2014-01-30 23:28 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Users\Jan\AppData\Local\Secunia PSI 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Program Files (x86)\Secunia 2014-01-30 22:56 - 2014-01-30 22:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jan\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-30 22:43 - 2014-01-30 22:45 - 90578216 _____ (AVAST Software) C:\Users\Jan\Desktop\avast_free_antivirus_setup.exe 2014-01-30 21:53 - 2014-01-30 21:53 - 05329480 _____ (Secunia) C:\Users\Jan\Desktop\PSISetup_3.0.0.9016.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 13031424 _____ (Intel Corporation) C:\Windows\system32\ig4icd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 12617216 _____ (Intel Corporation) C:\Windows\system32\igdumd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11176448 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11049472 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 10812928 _____ (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 05904856 _____ (Intel Corporation) C:\Windows\system32\GfxUI.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 05363200 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2014-01-29 23:02 - 2014-01-29 23:02 - 03511296 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 03121152 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 01040384 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00931840 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00575488 _____ (Intel Corporation) C:\Windows\system32\igfx11cmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00542720 _____ (Intel Corporation) C:\Windows\SysWOW64\igfx11cmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00515544 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00442880 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00442328 _____ (Intel Corporation) C:\Windows\system32\igfxpers.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00440320 _____ (Intel Corporation) C:\Windows\system32\igfxrell.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxrfra.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxresn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrus.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrom.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrsky.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrptg.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrplk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrnld.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrita.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrhrv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrdeu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrhun.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrfin.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrcsy.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrtrk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrsve.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrslv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrptb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrnor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrtha.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrdan.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrheb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrara.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00432128 _____ (Intel Corporation) C:\Windows\system32\igfxrjpn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00431104 _____ (Intel Corporation) C:\Windows\system32\igfxrkor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00429056 _____ (Intel Corporation) C:\Windows\system32\igfxrcht.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00428544 _____ (Intel Corporation) C:\Windows\system32\igfxrchs.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00410624 _____ (Intel Corporation) C:\Windows\system32\igfxTMM.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00399832 _____ (Intel Corporation) C:\Windows\system32\hkcmd.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00384512 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00330752 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00286208 _____ (Intel Corporation) C:\Windows\system32\igfxrenu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00279000 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00254936 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00223664 _____ () C:\Windows\system32\Gfxres.th-TH.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00210106 _____ () C:\Windows\system32\Gfxres.el-GR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00194245 _____ () C:\Windows\system32\Gfxres.ru-RU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00185816 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00175104 _____ (Intel Corporation) C:\Windows\system32\gfxSrvc.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00171992 _____ (Intel Corporation) C:\Windows\system32\igfxtray.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00166170 _____ () C:\Windows\system32\Gfxres.ar-SA.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00163421 _____ () C:\Windows\system32\Gfxres.ja-JP.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00159008 _____ () C:\Windows\system32\Gfxres.he-IL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00149682 _____ () C:\Windows\system32\Gfxres.it-IT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00148042 _____ () C:\Windows\system32\Gfxres.ko-KR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147393 _____ () C:\Windows\system32\Gfxres.de-DE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147288 _____ () C:\Windows\system32\Gfxres.es-ES.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00146004 _____ () C:\Windows\system32\Gfxres.ro-RO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00145491 _____ () C:\Windows\system32\Gfxres.fr-FR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144645 _____ () C:\Windows\system32\Gfxres.tr-TR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144260 _____ () C:\Windows\system32\Gfxres.pt-BR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144020 _____ () C:\Windows\system32\Gfxres.nl-NL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00143932 _____ () C:\Windows\system32\Gfxres.hu-HU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142882 _____ () C:\Windows\system32\Gfxres.sv-SE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142877 _____ () C:\Windows\system32\Gfxres.pt-PT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142717 _____ () C:\Windows\system32\Gfxres.pl-PL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142336 _____ (Intel Corporation) C:\Windows\system32\igfxdo.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00142289 _____ () C:\Windows\system32\Gfxres.cs-CZ.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142008 _____ () C:\Windows\system32\Gfxres.fi-FI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141838 _____ () C:\Windows\system32\Gfxres.sk-SK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141049 _____ () C:\Windows\system32\Gfxres.hr-HR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137889 _____ () C:\Windows\system32\Gfxres.sl-SI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137784 _____ () C:\Windows\system32\Gfxres.nb-NO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137141 _____ () C:\Windows\system32\Gfxres.da-DK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00132623 _____ () C:\Windows\system32\Gfxres.en-US.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00126976 _____ (Intel Corporation) C:\Windows\system32\igfxcpl.cpl 2014-01-29 23:02 - 2014-01-29 23:02 - 00126300 _____ () C:\Windows\system32\Gfxres.zh-TW.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00124650 _____ () C:\Windows\system32\Gfxres.zh-CN.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00116224 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v3347.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00098304 _____ () C:\Windows\system32\igdde64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00077312 _____ () C:\Windows\SysWOW64\igdde32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00025088 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00017058 _____ () C:\Windows\system32\iglhxs64.vp 2014-01-29 23:02 - 2014-01-29 23:02 - 00009728 _____ ( ) C:\Windows\system32\IGFXDEVLib.dll 2014-01-23 14:59 - 2012-12-07 15:53 - 00000085 _____ () C:\Users\Jan\Desktop\Drehbank.txt 2014-01-20 15:22 - 2014-01-20 15:22 - 00000016 _____ () C:\Users\Jan\Desktop\pay.txt 2014-01-15 09:21 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 09:21 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 09:20 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 09:20 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-09 13:47 - 2014-01-09 13:47 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite ==================== One Month Modified Files and Folders ======= 2014-02-04 21:34 - 2014-02-04 21:34 - 00025019 _____ () C:\Users\Jan\Desktop\FRST.txt 2014-02-04 21:34 - 2014-02-03 13:00 - 00000000 ____D () C:\FRST 2014-02-04 21:32 - 2014-02-04 21:31 - 02080256 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe 2014-02-04 21:17 - 2012-04-05 08:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-04 21:10 - 2014-02-04 21:10 - 00003732 _____ () C:\Users\Jan\Desktop\JRT.txt 2014-02-04 21:06 - 2009-07-14 05:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-04 21:06 - 2009-07-14 05:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-04 21:05 - 2014-02-04 21:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 21:03 - 2011-07-26 20:38 - 00701576 _____ () C:\Windows\system32\perfh007.dat 2014-02-04 21:03 - 2011-07-26 20:38 - 00150444 _____ () C:\Windows\system32\perfc007.dat 2014-02-04 21:03 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-04 20:59 - 2012-07-07 22:34 - 01267610 _____ () C:\Windows\WindowsUpdate.log 2014-02-04 20:58 - 2014-01-31 11:37 - 00003624 _____ () C:\Windows\setupact.log 2014-02-04 20:58 - 2011-10-28 10:19 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job 2014-02-04 20:58 - 2011-07-26 11:06 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-04 20:58 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-04 20:56 - 2014-02-04 20:53 - 00000000 ____D () C:\AdwCleaner 2014-02-04 20:47 - 2014-02-04 20:47 - 01037530 _____ (Thisisu) C:\Users\Jan\Desktop\JRT.exe 2014-02-04 20:46 - 2014-02-04 20:46 - 01166132 _____ () C:\Users\Jan\Desktop\adwcleaner.exe 2014-02-04 19:58 - 2014-02-04 19:46 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-04 19:58 - 2014-02-04 19:38 - 00000000 ____D () C:\Users\Jan\Desktop\mbar 2014-02-04 19:46 - 2014-02-04 19:46 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-04 19:45 - 2014-02-04 19:42 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-04 19:06 - 2014-02-04 19:06 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Jan\Desktop\mbar-1.07.0.1009.exe 2014-02-04 19:02 - 2011-10-28 10:19 - 00003488 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest 2014-02-04 19:02 - 2011-10-28 10:19 - 00003448 _____ () C:\Windows\System32\Tasks\PCDEventLauncher 2014-02-04 14:17 - 2014-02-02 18:15 - 00119954 _____ () C:\Windows\PFRO.log 2014-02-04 14:17 - 2009-07-14 05:45 - 05638464 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-04 12:41 - 2014-02-04 12:41 - 00000378 _____ () C:\Users\Jan\Desktop\Ereignisse.txt 2014-02-04 12:32 - 2014-02-04 12:32 - 00041398 _____ () C:\ComboFix.txt 2014-02-04 12:32 - 2014-02-04 12:07 - 00000000 ____D () C:\Qoobox 2014-02-04 12:32 - 2011-10-28 10:21 - 00128144 _____ () C:\Users\Jan\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-04 12:32 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-02-04 12:27 - 2014-02-04 12:06 - 00000000 ____D () C:\Windows\erdnt 2014-02-04 12:16 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-02-04 12:02 - 2014-02-04 12:01 - 05179684 ____R (Swearware) C:\Users\Jan\Desktop\ComboFix.exe 2014-02-04 09:56 - 2011-11-24 17:36 - 00000000 ____D () C:\Windows\SolidWorks 2014-02-04 09:55 - 2011-11-24 17:41 - 00000000 ____D () C:\ProgramData\SolidWorks 2014-02-04 09:55 - 2011-10-29 19:30 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-04 09:53 - 2011-11-24 17:41 - 00000000 ____D () C:\Program Files\SolidWorks Corp 2014-02-04 09:49 - 2011-10-29 00:35 - 00000000 ____D () C:\Program Files\MAXON 2014-02-04 09:49 - 2011-10-29 00:28 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\MAXON 2014-02-04 09:45 - 2011-10-28 20:43 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe 2014-02-04 00:04 - 2014-02-04 00:04 - 00002630 _____ () C:\Users\Jan_2\Documents\zertifikatexportdatei.pfx 2014-02-03 17:16 - 2014-02-03 17:16 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\WinRAR 2014-02-03 15:35 - 2014-02-03 15:34 - 130658432 _____ () C:\Users\Jan_2\Desktop\avira_free_antivirus_de.exe 2014-02-03 13:01 - 2014-02-03 13:01 - 00034015 _____ () C:\Users\Jan_2\Desktop\Addition.txt 2014-02-03 13:01 - 2014-02-03 13:00 - 00063366 _____ () C:\Users\Jan_2\Desktop\FRST.txt 2014-02-03 12:59 - 2014-02-03 12:59 - 02080256 _____ (Farbar) C:\Users\Jan_2\Desktop\FRST64.exe 2014-02-03 11:47 - 2014-02-03 11:47 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Malwarebytes 2014-02-03 09:56 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\X-Rite 2014-02-02 20:48 - 2014-02-02 20:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 20:47 - 2014-02-02 20:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 19:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-02 18:49 - 2014-02-02 18:03 - 01598708 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 18:36 - 2014-02-02 18:36 - 00000000 ____D () C:\Users\Jan\AppData\Local\Apps\2.0 2014-02-02 18:16 - 2011-07-26 11:08 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-02 18:16 - 2011-07-26 11:08 - 00000000 ____D () C:\Windows\system32\NV 2014-02-02 18:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-02-02 18:02 - 2011-07-26 10:56 - 00000000 ____D () C:\Program Files\Common Files\Intel 2014-02-02 18:00 - 2011-07-26 11:06 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-02 17:59 - 2014-02-02 17:59 - 00000000 ____D () C:\Program Files\AuthenTec 2014-02-02 17:59 - 2011-07-26 11:05 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-02 17:59 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2014-02-02 17:16 - 2011-07-26 11:18 - 00000000 ____D () C:\ProgramData\PCDr 2014-02-01 22:32 - 2014-02-01 22:32 - 00000921 _____ () C:\Users\Jan_2\Desktop\gsg_tuts - Verknüpfung.lnk 2014-02-01 22:29 - 2014-02-01 22:30 - 00001004 _____ () C:\Users\Jan_2\Desktop\hochstuhl - Verknüpfung.lnk 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\Documents\Ulead Burn.Now 2014-02-01 22:21 - 2014-02-01 22:21 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Ulead Systems 2014-02-01 22:21 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Corel 2014-02-01 22:20 - 2014-02-01 22:20 - 00000000 ____D () C:\Users\Jan_2\Corel 2014-02-01 22:20 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2 2014-02-01 22:20 - 2011-11-20 10:58 - 00000900 ___SH () C:\ProgramData\KGyGaAvL.sys 2014-02-01 22:11 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Apple Computer 2014-02-01 21:46 - 2012-07-03 09:29 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\com.adobe.dmp.contentviewer 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Thunderbird 2014-02-01 17:11 - 2014-02-01 17:11 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Thunderbird 2014-02-01 16:23 - 2014-02-01 16:23 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\HpUpdate 2014-02-01 10:08 - 2014-02-01 10:05 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\SolidWorks 2014-02-01 10:03 - 2014-02-01 10:03 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\NVIDIA 2014-02-01 08:46 - 2014-02-01 08:46 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Tobit 2014-02-01 08:46 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\VirtualStore 2014-02-01 08:39 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Apple Computer 2014-02-01 08:32 - 2014-02-01 08:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-31 22:52 - 2011-10-30 12:19 - 00005291 _____ () C:\ProgramData\hpzinstall.log 2014-01-31 22:50 - 2014-01-31 22:50 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\PwrMgr 2014-01-31 22:42 - 2014-01-31 22:40 - 00000000 ____D () C:\ProgramData\Oracle 2014-01-31 22:39 - 2014-01-31 22:39 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-31 22:39 - 2014-01-31 22:39 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-31 22:39 - 2011-10-30 22:26 - 00000000 ____D () C:\Program Files (x86)\Java 2014-01-31 20:52 - 2014-01-31 20:52 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Macromedia 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Mozilla 2014-01-31 15:39 - 2014-01-31 15:39 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Mozilla 2014-01-31 15:36 - 2014-01-31 15:36 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Avira 2014-01-31 15:31 - 2014-01-31 15:31 - 00140216 _____ () C:\Users\Jan_2\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-31 15:31 - 2014-01-31 15:31 - 00001432 _____ () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\Virtual Machines 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ___RD () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Logitech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Leadertech 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Adobe 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Lenovo 2014-01-31 15:31 - 2014-01-31 15:31 - 00000000 ____D () C:\Users\Jan_2\AppData\Local\Adobe 2014-01-31 15:30 - 2014-01-31 15:30 - 00000020 ___SH () C:\Users\Jan_2\ntuser.ini 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Vorlagen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Startmenü 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Netzwerkumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Lokale Einstellungen 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Eigene Dateien 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Druckumgebung 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Musik 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Documents\Eigene Bilder 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Verlauf 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\AppData\Local\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 _SHDL () C:\Users\Jan_2\Anwendungsdaten 2014-01-31 15:30 - 2014-01-31 15:30 - 00000000 ____D () C:\Users\Jan_2\AppData\Roaming\Intel 2014-01-31 11:37 - 2014-01-31 11:37 - 00000000 _____ () C:\Windows\setuperr.log 2014-01-31 11:35 - 2011-11-22 23:37 - 00000000 ____D () C:\Program Files\CCleaner 2014-01-31 08:20 - 2014-01-31 08:20 - 02434048 _____ () C:\Users\Jan\Desktop\msxml.msi 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iTunes 2014-01-31 01:00 - 2014-01-31 01:00 - 00000000 ____D () C:\Program Files\iPod 2014-01-31 01:00 - 2012-01-21 22:03 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer 2014-01-31 00:59 - 2014-01-31 00:59 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer 2014-01-30 23:28 - 2014-01-30 23:28 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-01-30 23:28 - 2011-10-30 11:58 - 00000000 ____D () C:\ProgramData\Skype 2014-01-30 23:26 - 2012-04-05 08:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-30 23:26 - 2012-04-05 08:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-01-30 23:26 - 2011-10-28 13:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-30 23:25 - 2011-11-02 16:33 - 00000000 ____D () C:\ProgramData\Apple 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Users\Jan\AppData\Local\Secunia PSI 2014-01-30 23:21 - 2014-01-30 23:21 - 00000000 ____D () C:\Program Files (x86)\Secunia 2014-01-30 22:56 - 2014-01-30 22:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jan\Desktop\mbam-setup-1.75.0.1300.exe 2014-01-30 22:45 - 2014-01-30 22:43 - 90578216 _____ (AVAST Software) C:\Users\Jan\Desktop\avast_free_antivirus_setup.exe 2014-01-30 21:53 - 2014-01-30 21:53 - 05329480 _____ (Secunia) C:\Users\Jan\Desktop\PSISetup_3.0.0.9016.exe 2014-01-30 20:52 - 2011-07-26 11:11 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-01-29 23:02 - 2014-01-29 23:02 - 13031424 _____ (Intel Corporation) C:\Windows\system32\ig4icd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 12617216 _____ (Intel Corporation) C:\Windows\system32\igdumd64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11176448 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10umd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 11049472 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 10812928 _____ (Intel Corporation) C:\Windows\SysWOW64\ig4icd32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 05904856 _____ (Intel Corporation) C:\Windows\system32\GfxUI.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 05363200 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2014-01-29 23:02 - 2014-01-29 23:02 - 03511296 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 03121152 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 01040384 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00931840 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00575488 _____ (Intel Corporation) C:\Windows\system32\igfx11cmrt64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00542720 _____ (Intel Corporation) C:\Windows\SysWOW64\igfx11cmrt32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00515544 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00442880 _____ (Intel Corporation) C:\Windows\system32\igfxdev.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00442328 _____ (Intel Corporation) C:\Windows\system32\igfxpers.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00440320 _____ (Intel Corporation) C:\Windows\system32\igfxrell.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxrfra.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439808 _____ (Intel Corporation) C:\Windows\system32\igfxresn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrus.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrrom.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrsky.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrptg.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrplk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrnld.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrita.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrhrv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438784 _____ (Intel Corporation) C:\Windows\system32\igfxrdeu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrhun.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrfin.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00438272 _____ (Intel Corporation) C:\Windows\system32\igfxrcsy.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrtrk.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrsve.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrslv.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrptb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437760 _____ (Intel Corporation) C:\Windows\system32\igfxrnor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrtha.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00437248 _____ (Intel Corporation) C:\Windows\system32\igfxrdan.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrheb.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00435712 _____ (Intel Corporation) C:\Windows\system32\igfxrara.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00432128 _____ (Intel Corporation) C:\Windows\system32\igfxrjpn.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00431104 _____ (Intel Corporation) C:\Windows\system32\igfxrkor.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00429056 _____ (Intel Corporation) C:\Windows\system32\igfxrcht.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00428544 _____ (Intel Corporation) C:\Windows\system32\igfxrchs.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00410624 _____ (Intel Corporation) C:\Windows\system32\igfxTMM.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00399832 _____ (Intel Corporation) C:\Windows\system32\hkcmd.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00384512 _____ (Intel Corporation) C:\Windows\system32\igfxpph.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00330752 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxdv32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00286208 _____ (Intel Corporation) C:\Windows\system32\igfxrenu.lrc 2014-01-29 23:02 - 2014-01-29 23:02 - 00279000 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00254936 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00223664 _____ () C:\Windows\system32\Gfxres.th-TH.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00210106 _____ () C:\Windows\system32\Gfxres.el-GR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00194245 _____ () C:\Windows\system32\Gfxres.ru-RU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00185816 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00175104 _____ (Intel Corporation) C:\Windows\system32\gfxSrvc.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00171992 _____ (Intel Corporation) C:\Windows\system32\igfxtray.exe 2014-01-29 23:02 - 2014-01-29 23:02 - 00166170 _____ () C:\Windows\system32\Gfxres.ar-SA.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00163421 _____ () C:\Windows\system32\Gfxres.ja-JP.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00159008 _____ () C:\Windows\system32\Gfxres.he-IL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00149682 _____ () C:\Windows\system32\Gfxres.it-IT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00148042 _____ () C:\Windows\system32\Gfxres.ko-KR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147393 _____ () C:\Windows\system32\Gfxres.de-DE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00147288 _____ () C:\Windows\system32\Gfxres.es-ES.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00146004 _____ () C:\Windows\system32\Gfxres.ro-RO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00145491 _____ () C:\Windows\system32\Gfxres.fr-FR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144645 _____ () C:\Windows\system32\Gfxres.tr-TR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144260 _____ () C:\Windows\system32\Gfxres.pt-BR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00144020 _____ () C:\Windows\system32\Gfxres.nl-NL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00143932 _____ () C:\Windows\system32\Gfxres.hu-HU.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142882 _____ () C:\Windows\system32\Gfxres.sv-SE.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142877 _____ () C:\Windows\system32\Gfxres.pt-PT.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142717 _____ () C:\Windows\system32\Gfxres.pl-PL.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142336 _____ (Intel Corporation) C:\Windows\system32\igfxdo.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00142289 _____ () C:\Windows\system32\Gfxres.cs-CZ.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00142008 _____ () C:\Windows\system32\Gfxres.fi-FI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141838 _____ () C:\Windows\system32\Gfxres.sk-SK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00141049 _____ () C:\Windows\system32\Gfxres.hr-HR.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137889 _____ () C:\Windows\system32\Gfxres.sl-SI.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137784 _____ () C:\Windows\system32\Gfxres.nb-NO.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00137141 _____ () C:\Windows\system32\Gfxres.da-DK.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00132623 _____ () C:\Windows\system32\Gfxres.en-US.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00126976 _____ (Intel Corporation) C:\Windows\system32\igfxcpl.cpl 2014-01-29 23:02 - 2014-01-29 23:02 - 00126300 _____ () C:\Windows\system32\Gfxres.zh-TW.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00124650 _____ () C:\Windows\system32\Gfxres.zh-CN.resources 2014-01-29 23:02 - 2014-01-29 23:02 - 00116224 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v3347.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00098304 _____ () C:\Windows\system32\igdde64.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00077312 _____ () C:\Windows\SysWOW64\igdde32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00025088 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2014-01-29 23:02 - 2014-01-29 23:02 - 00017058 _____ () C:\Windows\system32\iglhxs64.vp 2014-01-29 23:02 - 2014-01-29 23:02 - 00009728 _____ ( ) C:\Windows\system32\IGFXDEVLib.dll 2014-01-29 23:02 - 2012-09-28 10:51 - 09007616 _____ (Intel Corporation) C:\Windows\system32\igfxress.dll 2014-01-29 23:02 - 2011-12-03 15:03 - 00028672 _____ (Intel Corporation) C:\Windows\system32\igfxexps.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 12859392 _____ (Intel Corporation) C:\Windows\system32\igd10umd64.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 00110592 _____ (Intel Corporation) C:\Windows\system32\hccutils.dll 2014-01-29 23:02 - 2011-07-26 11:05 - 00064000 _____ (Intel Corporation) C:\Windows\system32\igfxsrvc.dll 2014-01-26 19:58 - 2012-10-23 22:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-01-20 15:22 - 2014-01-20 15:22 - 00000016 _____ () C:\Users\Jan\Desktop\pay.txt 2014-01-17 09:55 - 2011-11-25 15:48 - 00000000 ____D () C:\Users\Jan\AppData\Local\TempSWSicherungsverzeichnis 2014-01-16 19:47 - 2011-11-24 17:36 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\SolidWorks 2014-01-16 10:35 - 2013-08-24 08:38 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-16 10:33 - 2011-10-28 13:26 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-14 09:43 - 2011-10-28 10:19 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 2014-01-13 10:51 - 2011-10-28 10:19 - 00004228 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask 2014-01-09 13:54 - 2011-10-29 00:20 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\DAEMON Tools Lite 2014-01-09 13:47 - 2014-01-09 13:47 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-01-09 13:47 - 2011-10-29 00:23 - 00381440 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys 2014-01-09 11:30 - 2011-10-30 11:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Skype Some content of TEMP: ==================== C:\Users\Jan\AppData\Local\Temp\avgnt.exe C:\Users\Jan\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-29 18:20 ==================== End Of Log ============================ --- --- --- die addition.txt FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014 Ran by Jan at 2014-02-04 22:07:18 Running from C:\Users\Jan\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) Hidden 64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden 7-Zip 9.20 (x32 Version: - ) Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.9 - Adobe Systems) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden Adobe Creative Suite 6 Design Standard (x32 Version: 6 - Adobe Systems Incorporated) Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.38 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated) Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden Adobe® Content Viewer (x32 Version: 3.4.0 - Adobe Systems Incorporated) Adobe® Content Viewer (x32 Version: 3.4.0 - Adobe Systems Incorporated) Hidden Akamai NetSession Interface (HKCU Version: - Akamai Technologies, Inc) Anzeige am Bildschirm (Version: 6.22.00 - ) Apple Application Support (x32 Version: 3.0 - Apple Inc.) Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.) Audacity 2.0.5 (x32 Version: 2.0.5 - Audacity Team) Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira) Bonjour (Version: 3.0.0.10 - Apple Inc.) Broadcom InConcert Maestro (Version: 1.0.1.1500 - Broadcom Corporation) BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden CCleaner (Version: 4.10 - Piriform) CDDRV_Installer (Version: 4.60 - Logitech) Hidden Conexant 20672 SmartAudio HD (Version: 8.32.23.2 - Conexant) Copy (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0 - Corel Corporation) Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0 - Corel Corporation) Corel WinDVD (x32 Version: 10.0.5.828 - Corel Inc.) Coupon Printer for Windows (x32 Version: 5.0.0.0 - Coupons.com Incorporated) <==== ATTENTION Create Recovery Media (x32 Version: 1.20.0.00 - Lenovo Group Limited) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft) Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Dienstprogramm "ThinkPad UltraNav" (x32 Version: 2.13.0 - Lenovo) Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (Version: 1.00 - ) DJ_AIO_06_F2400_SW_Min (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden Dropbox (HKCU Version: 2.0.22 - Dropbox, Inc.) Energie-Manager (x32 Version: 6.07 - ) erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden F2400 (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden FH-Aachen OpenVPN 2.2.0 (x32 Version: 2.2.0 - ) GPBaseService2 (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden HP Customer Participation Program 14.0 (Version: 14.0 - HP) HP Deskjet F2400 All-in-One Driver Software 14.0 Rel. 6 (Version: 14.0 - HP) HP Imaging Device Functions 14.0 (Version: 14.0 - HP) HP LaserJet P2050 Series 6.0 (Version: 6.0 - HP) HP Product Detection (x32 Version: 11.14.0001 - HP) HP Solution Center 14.0 (Version: 14.0 - HP) HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard) HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden hppFonts (x32 Version: 001.001.00061 - Hewlett-Packard) Hidden HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden hppQFolderP2050 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Integrated Camera Driver Installer Package Ver.1.1.0.1147 (x32 Version: 1.1.0.1147 - RICOH) Integrated Camera TWAIN (x32 Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.) Intel PROSet Wireless (Version: - ) Hidden Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation) Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0 - Intel Corporation) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation) Intel(R) Processor Graphics (x32 Version: 9.17.10.3347 - Intel Corporation) Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.2.0.0284 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation) Intel® PROSet/Wireless WiFi-Software (Version: 15.02.0000.1258 - Intel Corporation) iTunes (Version: 11.1.4.62 - Apple Inc.) Java 7 Update 51 (x32 Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KhalInstallWrapper (Version: 2.00.0000 - Logitech) Hidden LAME v3.99.3 (for Windows) (x32 Version: - ) Lenovo Auto Scroll Utility (Version: 1.00 - ) Lenovo Patch Utility (x32 Version: 1.3.0.007 - Lenovo Group Limited) Lenovo Patch Utility 64 bit (Version: 1.3.0.007 - Lenovo Group Limited) Lenovo Power Management Driver (Version: 1.67.04.04 - ) Lenovo Registration (x32 Version: 1.0.2 - Lenovo Inc.) Lenovo System Interface Driver (Version: 1.05 - ) Lenovo ThinkVantage Toolbox (Version: 6.0.5849.23 - PC-Doctor, Inc.) Lenovo User Guide (x32 Version: 1.0.0008.00 - Ihr Firmenname) Lenovo Warranty Information (x32 Version: 1.0.0005.00 - Lenovo) Lenovo Welcome (x32 Version: 2.02.003.0 - Lenovo) Logitech SetPoint (x32 Version: 4.80 - Logitech) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation) MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Message Center Plus (x32 Version: 2.0.0012.00 - Lenovo Group Limited) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office 2003 Web Components (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 8.0 Support DLLs (x32 Version: 1.0.0 - McNeel & Associates) Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: - Microsoft Corporation) Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: 8.0.52572 - Microsoft Corporation) Hidden Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: - Microsoft Corporation) Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: 8.0.50727.146 - Microsoft Corporation) Hidden Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden Mobile Partner (x32 Version: 21.005.15.02.382 - Huawei Technologies Co.,Ltd) Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla) Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla) Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation) NVIDIA 3D Vision Treiber 312.69 (Version: 312.69 - NVIDIA Corporation) NVIDIA Grafiktreiber 312.69 (Version: 312.69 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.2.23.3 (Version: 1.2.23.3 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden NVIDIA nView 140.75 (Version: 140.75 - NVIDIA Corporation) NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden PANTONE Color Calibrator 1.0 (x32 Version: - X-Rite) PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden QuickTime (x32 Version: 7.74.80.86 - Apple Inc.) RapidBoot (x32 Version: 1.00 - Lenovo) RapidBoot (x32 Version: 1.00 - Lenovo) Hidden Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (Version: 1.00 - ) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden Rescue and Recovery (x32 Version: 4.31.0010.00 - Lenovo Group Limited) Rhinoceros 4.0 SR9 (x32 Version: 4.0.60309 - Robert McNeel & Associates) Rhinoceros 4.0 Trainingsmaterial - Stufe 1 (x32 Version: 4.0.0.0 - Robert McNeel & Associates) RICOH_Media_Driver_v2.13.18.02 (x32 Version: 2.13.18.02 - RICOH) SAMSUNG USB Driver for Mobile Phones (Version: 1.4.8.0 - SAMSUNG Electronics Co., Ltd.) Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden Secunia PSI (3.0.0.9016) (x32 Version: 3.0.0.9016 - Secunia) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.3 (x32 Version: 6.3.105 - Skype Technologies S.A.) SolutionCenter (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden Status (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden System Requirements Lab for Intel (x32 Version: 4.5.11.0 - Husdawg, LLC) System Update (x32 Version: 4.00.0042 - Lenovo) TBBackup 2 (Freiversion) (x32 Version: 2 - Priotecs IT GmbH) ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.4.0.1500 - Broadcom Corporation) ThinkPad FullScreen Magnifier (Version: 2.22 - ) ThinkPad Modem Adapter (Version: 7.80.5.0 - Conexant Systems) ThinkPad UltraNav Driver (Version: 16.2.19.7 - ) ThinkVantage AutoLock (Version: 1.01 - Lenovo) ThinkVantage Communications Utility (Version: 2.06 - Lenovo) ThinkVantage Fingerprint Software (Version: 5.9.4.6882 - UPEK Inc.) ThinkVantage System für aktiven Festplattenschutz (Version: 1.73 - Lenovo) Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft) VIP Access (x32 Version: 2.0.5.13 - VeriSign) WDR RadioRecorder (x32 Version: - Tobit.Software) WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows-Treiberpaket - Intel (e1cexpress) Net (12/21/2010 11.8.84.0) (Version: 12/21/2010 11.8.84.0 - Intel) Windows-Treiberpaket - Intel (MEIx64) System (10/19/2010 7.0.0.1144) (Version: 10/19/2010 7.0.0.1144 - Intel) Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (Version: 09/10/2010 9.2.0.1011 - Intel) Windows-Treiberpaket - Intel System (10/04/2010 9.2.0.1015) (Version: 10/04/2010 9.2.0.1015 - Intel) Windows-Treiberpaket - Intel USB (09/16/2010 9.2.0.1013) (Version: 09/16/2010 9.2.0.1013 - Intel) Windows-Treiberpaket - Lenovo (LenovoRd) SmartCardReader (05/11/2009 4.1.0.1) (Version: 05/11/2009 4.1.0.1 - Lenovo) Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (Version: 11/11/2010 1.61.00.11 - Lenovo) Windows-Treiberpaket - Synaptics (SynTP) Mouse (03/24/2011 15.2.19.0) (Version: 03/24/2011 15.2.19.0 - Synaptics) WinRAR 4.20 (64-Bit) (Version: 4.20.0 - win.rar GmbH) X-Rite Device i1Display Service (x32 Version: 1.0 - X-Rite Inc.) X-Rite Device Manager (x32 Version: 1.0 - X-Rite Inc.) ==================== Restore Points ========================= 04-02-2014 18:32:30 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2009-07-14 03:34 - 2014-02-04 12:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {060C3AD0-BE04-4C4A-B4B6-0232E0E35709} - System32\Tasks\AdobeAAMUpdater-1.0-THINKTAB-Jan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated) Task: {283F6E79-AC37-42DB-AD8A-DEF4BD5166E8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd) Task: {473D21BD-AB26-45A5-8F8A-A84DDB3A65D6} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {495DFA0E-749C-4AC7-8335-17D9E1FB1B24} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.) Task: {6A68F955-486F-40CF-8D13-CF66BFB5662B} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.) Task: {6E40E2EA-585A-4FBA-9284-D1BECFF20063} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.) Task: {86431351-3E4D-401E-B08C-07C6E0A8D8AB} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe [2009-05-27] () Task: {B37428C7-08EF-4B73-95F1-26901D8D407A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-30] (Adobe Systems Incorporated) Task: {BE96179C-B259-4741-955E-DE6A99E20F2D} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe Task: {C3B8229F-FB15-46E7-B2E9-C40C184CE06F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {CA891CE8-218D-4BD0-A431-4A0C472219A0} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe Task: {DF5D9378-F94D-423D-B027-C24360F19250} - System32\Tasks\{29939777-D779-4E8F-AA51-7EA6F8408E65} => C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\Photoshop.exe [2013-10-27] (Adobe Systems, Incorporated) Task: {E6D95D09-7C0B-4E80-94D7-3AC9379125CA} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe ==================== Loaded Modules (whitelisted) ============= 2012-10-26 19:42 - 2013-10-29 01:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2010-12-18 14:50 - 2010-12-18 14:50 - 00173856 ____N () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll 2011-07-26 11:05 - 2011-03-06 12:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-01-03 12:13 - 2009-07-20 12:35 - 00018960 ____N () C:\Program Files\Logitech\SetPoint\khalwrapper.dll 2011-07-26 11:08 - 2012-03-15 05:07 - 00103936 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL 2012-10-16 12:44 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 02415104 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 00383488 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll 2011-12-23 22:13 - 2011-12-23 22:12 - 00398336 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll 2011-07-26 11:09 - 2010-04-06 08:05 - 02085888 ____N () C:\Program Files\Lenovo\AutoLock\cv210.dll 2011-07-26 11:09 - 2010-04-06 08:04 - 02201088 ____N () C:\Program Files\Lenovo\AutoLock\cxcore210.dll 2011-07-26 11:10 - 2010-12-15 21:53 - 00898560 ____N () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\libxml2.dll 2011-07-26 11:10 - 2010-12-15 21:53 - 00073728 ____N () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\zlib1.dll 2011-07-26 11:10 - 2010-12-15 21:53 - 03449344 ____N () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\CxF2_VC90MD_2.1.dll 2011-07-26 11:10 - 2010-12-15 21:54 - 07390720 ____N () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtGui4.dll 2011-07-26 11:10 - 2010-12-15 21:54 - 02012160 ____N () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtCore4.dll 2013-12-18 19:43 - 2013-12-18 19:43 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu 2013-12-21 14:24 - 2013-12-21 14:24 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2014-02-04 12:12:25.920 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2014-02-04 12:12:25.873 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2014-02-01 22:21:19.505 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.455 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.415 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.325 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.265 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.175 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.125 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-01 22:21:19.075 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 32% Total physical RAM: 8075.23 MB Available physical RAM: 5439.33 MB Total Pagefile: 16148.65 MB Available Pagefile: 13270.87 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Windows7_OS) (Fixed) (Total:73.36 GB) (Free:16.22 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive f: () (Fixed) (Total:149.59 GB) (Free:82.66 GB) NTFS Drive g: (Volume) (Fixed) (Total:148.5 GB) (Free:144.05 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: B7FFDD9F) Partition 1: (Active) - (Size=150 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=148 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 75 GB) (Disk ID: 91692295) Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=73 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
Themen zu Win7 64bit Malwarebytes 9 Funde von PUP.Optional.OpenCandy / LinkuryInstaller |
.dll, administrator, anti-malware, antivirus, appdata, autostart, dateien, erkennen, explorer, malwarebytes, pup.optional.opencandy, rechner, roaming, service, sicherheitseinstellungen, speicher, tr/gendal.55457.a, tr/rogue.8828868, version, windows |