![]() |
|
Log-Analyse und Auswertung: not-a-virus:AdWare.Win32.Agent.aknuWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() not-a-virus:AdWare.Win32.Agent.aknu Hallo, Ich habe Kaspersky 2013 auf dem PC. Als ich gestern im Internet gesurft habe, öffnete sich ein Fenster mit der Meldung, ich hätte eine alte Flash Player Version auf dem Pc und müsste dieses unbedingt aktualisieren. Dieses Fenster öffnet sich ständig bei mir, wenn ich im Internet bin! Ich wollte das Fenster nur schließen, weil ich mir gedacht habe, es könnte ja ein Virus sein. Da setzte plötzlich automatisch ein Download ein. Habe dann mit Kaspersky sofort eine Säuberung durchgeführt. Der hat auch 2 Bedrohungen gefunden, aber er kann die nicht entfernen. Bei der einen Bedrohung steht: dtx Dynamic Link Library und bei der anderen steht: DTX Toolbar. Wenn ich auf die Beschreibung der Bedrohungen klicke, erscheint dies: not-a-virus:AdWare.Win32.Agent.aknu. Komisch ist, dass ich sonst keine Anzeichen für einen Virus merke aber das heisst ja nichts! Habe dann alle Schritte/Scans durchgeführt, wie in der Anleitung beschrieben. Hier die Ergebnisse: Ich hoffe sehr, ihr könnt mir weiterhelfen. DAnke im voraus!!!!! Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 22:57 on 22/05/2014 (Reyhan) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014 Ran by Reyhan (administrator) on REYHAN-HP on 22-05-2014 23:05:19 Running from C:\Users\Reyhan\Desktop Platform: Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (TorchMedia Inc.) C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Dropbox, Inc.) C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\plugin-nm-server.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe (PriceMeter) C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-06] (Easybits) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] () HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [Google Update] => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-09-20] (Google Inc.) HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableChangePassword] 0 Startup: C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll [489992 2014-05-12] () <===== ATTENTION HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll [664584 2014-05-12] () <===== ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.search.ask.com/?o=APN10649A&gct=hp&d=414-135&v=a12627-127&t=4 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms} SearchScopes: HKLM - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms} SearchScopes: HKLM-x32 - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - DefaultScope Software\Microsoft\Internet Explorer\SearchScopes URL = SearchScopes: HKCU - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms} SearchScopes: HKCU - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} BHO: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho64.dll (Plus HD) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO-x32: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho.dll (Plus HD) BHO-x32: Speed Analysis 2 - {18DBB6CE-3148-4FEC-B481-103CB3290427} - C:\Program Files (x86)\Speed Analysis 2\ScriptHost.dll (SpeedAnalysis.com) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\PROGRA~2\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\PROGRA~2\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default FF user.js: detected! => C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\user.js FF DefaultSearchEngine: Search the web FF SearchEngineOrder.1: Search the web FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=3 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter) FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=9 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter) FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\Ask.xml FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\babylon.xml FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\delta.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Ask.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Plus-HD-2.2 - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com [2014-05-19] FF Extension: toolplugin - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\welcome@toolmin.com [2012-02-14] FF Extension: Ask New Tabs - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38} [2014-05-19] FF Extension: DivX Web Player - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-07] FF Extension: Speed Analysis 2 - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\speedanalysis02@SpeedAnalysis.com.xpi [2013-11-16] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [] Chrome: ======= CHR DefaultSearchKeyword: ask.com CHR DefaultSearchProvider: Ask.com CHR DefaultSearchURL: hxxp://dts.search.ask.com/sr?src=crb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll () CHR Plugin: (Java Deployment Toolkit 6.0.200.2) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File CHR Extension: (Google Docs) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-20] CHR Extension: (Google Drive) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-20] CHR Extension: (YouTube) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-14] CHR Extension: (Google-Suche) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-14] CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2013-09-20] CHR Extension: (Plus-HD-2.2) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo [2013-11-05] CHR Extension: (Kaspersky Protection) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh [2014-05-21] CHR Extension: (DVDVideoSoft) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-09-20] CHR Extension: (Google Wallet) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20] CHR Extension: (Google Mail) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-14] CHR Extension: (Anti-Banner) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2013-09-20] CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-06-24] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25] CHR HKLM-x32\...\Chrome\Extension: [dgjkhjdcljddbedokogakmmdjgnbeanf] - C:\Users\Reyhan\AppData\Roaming\SpeedAnalysis2\SpeedAnalysis.crx [2013-06-11] CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2013-06-11] CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25] ==================== Services (Whitelisted) ================= R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) R2 DatamngrCoordinator; C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [3544072 2014-05-12] (Koyote-Lab Inc) S2 pricemeterliveUpdate; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-05-21] (PriceMeter) S3 pricemeterliveUpdatem; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-05-21] (PriceMeter) R2 TorchCrashHandler; C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe [1210720 2013-09-24] (TorchMedia Inc.) S2 Update ConstaSurf; "C:\Program Files (x86)\ConstaSurf\updateConstaSurf.exe" [X] ==================== Drivers (Whitelisted) ==================== R1 F06DEFF2-5B9C-490D-910F-35D3A9119622; C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\setmgrc1.cfg [36232 2014-05-12] (Koyote-Lab Inc) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-21] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-21] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO) S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-22 23:05 - 2014-05-22 23:06 - 00029132 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-22 23:04 - 2014-05-22 23:05 - 00000000 ____D () C:\FRST 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 22:32 - 2014-05-22 22:37 - 00000966 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job 2014-05-21 22:32 - 2014-05-22 22:37 - 00000962 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job 2014-05-21 22:32 - 2014-05-22 00:32 - 00000296 _____ () C:\Windows\Tasks\PriceMeterUpdater.job 2014-05-21 22:32 - 2014-05-21 22:32 - 00003962 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA 2014-05-21 22:32 - 2014-05-21 22:32 - 00003710 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore 2014-05-21 22:32 - 2014-05-21 22:32 - 00003300 _____ () C:\Windows\System32\Tasks\pricemeterdownloader 2014-05-21 22:32 - 2014-05-21 22:32 - 00003240 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\PriceMeterUpdater 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\ProgramData\PriceMeterLiveUpdate 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Program Files (x86)\PriceMeterLiveUpdate 2014-05-21 22:30 - 2014-05-21 22:31 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Advanced System Protector 2014-05-21 22:29 - 2014-05-22 00:24 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Systweak 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-21 22:23 - 2014-05-21 22:23 - 00942552 _____ () C:\Users\Reyhan\Downloads\setup (3).exe 2014-05-19 16:59 - 2014-05-22 23:06 - 00000000 ____D () C:\ProgramData\Datamngr 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-15 20:43 - 2014-05-15 20:44 - 00994176 _____ () C:\Users\Reyhan\Downloads\setup (2).exe 2014-05-14 18:08 - 2014-05-14 18:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup (1).exe 2014-05-14 17:07 - 2014-05-14 17:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup.exe 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster ==================== One Month Modified Files and Folders ======= 2014-05-22 23:06 - 2014-05-22 23:05 - 00029132 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-22 23:06 - 2014-05-19 16:59 - 00000000 ____D () C:\ProgramData\Datamngr 2014-05-22 23:05 - 2014-05-22 23:04 - 00000000 ____D () C:\FRST 2014-05-22 23:05 - 2012-04-05 16:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-22 23:05 - 2010-12-01 04:32 - 01093773 _____ () C:\Windows\WindowsUpdate.log 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:52 - 2011-02-09 17:02 - 00000000 ____D () C:\Users\Reyhan 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-22 22:37 - 2014-05-21 22:32 - 00000966 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job 2014-05-22 22:37 - 2014-05-21 22:32 - 00000962 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job 2014-05-22 22:16 - 2013-09-20 23:36 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA.job 2014-05-22 22:06 - 2012-12-18 21:33 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-05-22 22:02 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-22 22:02 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-22 21:56 - 2013-02-16 17:48 - 00000000 ___RD () C:\Users\Reyhan\Dropbox 2014-05-22 21:56 - 2013-02-16 17:44 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Dropbox 2014-05-22 21:55 - 2013-11-05 16:01 - 00001298 _____ () C:\Windows\Tasks\Plus-HD-2.2-updater.job 2014-05-22 21:55 - 2013-11-05 16:01 - 00001200 _____ () C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job 2014-05-22 21:55 - 2013-11-05 16:01 - 00001100 _____ () C:\Windows\Tasks\Plus-HD-2.2-enabler.job 2014-05-22 21:55 - 2013-11-05 16:00 - 00001908 _____ () C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job 2014-05-22 21:55 - 2013-11-05 16:00 - 00001832 _____ () C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job 2014-05-22 21:55 - 2013-10-06 19:52 - 00000000 ____D () C:\ProgramData\TorchCrashHandler 2014-05-22 21:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-22 21:54 - 2011-02-09 15:53 - 00692738 _____ () C:\Windows\PFRO.log 2014-05-22 21:54 - 2009-07-14 06:51 - 00156030 _____ () C:\Windows\setupact.log 2014-05-22 00:59 - 2013-10-06 19:48 - 00000000 ____D () C:\ProgramData\Wincert 2014-05-22 00:32 - 2014-05-21 22:32 - 00000296 _____ () C:\Windows\Tasks\PriceMeterUpdater.job 2014-05-22 00:24 - 2014-05-21 22:29 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Systweak 2014-05-22 00:23 - 2011-02-09 17:18 - 00000000 ___RD () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-21 23:59 - 2013-12-19 16:48 - 00262144 _____ () C:\Windows\system32\config\elam 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 23:27 - 2013-09-20 23:36 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core.job 2014-05-21 22:49 - 2013-10-11 14:51 - 00002304 _____ () C:\Users\Reyhan\Desktop\Sicherer Zahlungsverkehr.lnk 2014-05-21 22:32 - 2014-05-21 22:32 - 00003962 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA 2014-05-21 22:32 - 2014-05-21 22:32 - 00003710 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore 2014-05-21 22:32 - 2014-05-21 22:32 - 00003300 _____ () C:\Windows\System32\Tasks\pricemeterdownloader 2014-05-21 22:32 - 2014-05-21 22:32 - 00003240 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\PriceMeterUpdater 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\ProgramData\PriceMeterLiveUpdate 2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Program Files (x86)\PriceMeterLiveUpdate 2014-05-21 22:31 - 2014-05-21 22:30 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Advanced System Protector 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-21 22:23 - 2014-05-21 22:23 - 00942552 _____ () C:\Users\Reyhan\Downloads\setup (3).exe 2014-05-21 21:48 - 2013-01-03 16:14 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForReyhan 2014-05-21 21:48 - 2013-01-03 16:14 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForReyhan.job 2014-05-21 18:58 - 2012-10-25 13:42 - 00628320 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys 2014-05-21 18:58 - 2012-08-13 19:24 - 00091008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys 2014-05-19 22:40 - 2012-04-28 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-19 21:14 - 2013-08-31 21:28 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\HpUpdate 2014-05-18 19:32 - 2014-03-23 18:59 - 00000000 ____D () C:\Users\Reyhan\Desktop\bewerbungen 2014-05-18 11:10 - 2012-12-12 23:49 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek I 2014-05-15 23:29 - 2011-02-09 19:06 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-15 23:26 - 2013-08-25 22:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 23:23 - 2011-09-30 10:47 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-15 21:48 - 2012-12-20 17:05 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-15 21:47 - 2013-02-16 15:18 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-15 20:44 - 2014-05-15 20:43 - 00994176 _____ () C:\Users\Reyhan\Downloads\setup (2).exe 2014-05-14 18:08 - 2014-05-14 18:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup (1).exe 2014-05-14 17:08 - 2014-05-14 17:07 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup.exe 2014-05-14 14:07 - 2012-04-05 16:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 14:07 - 2012-04-05 16:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 14:07 - 2012-02-20 13:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 13:54 - 2013-10-01 16:20 - 00000000 ____D () C:\Users\Reyhan\Desktop\Gutachten Ref_Sonnentiger 2014-05-14 13:41 - 2013-02-16 17:48 - 00001021 _____ () C:\Users\Reyhan\Desktop\Dropbox.lnk 2014-05-14 13:41 - 2013-02-16 17:45 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-12 22:00 - 2013-02-16 21:58 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek II 2014-05-12 20:12 - 2013-02-12 17:05 - 00000000 ____D () C:\Users\Reyhan\Documents\sonstiges 2014-05-12 19:47 - 2013-02-17 13:53 - 00000000 ____D () C:\Users\Reyhan\Documents\herkenrath 2014-05-10 23:11 - 2013-09-20 23:36 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA 2014-05-10 23:11 - 2013-09-20 23:36 - 00003700 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core 2014-05-07 14:51 - 2014-04-13 16:48 - 00000000 ____D () C:\Users\Reyhan\Documents\Ref 2014-05-06 19:06 - 2010-07-20 23:46 - 00654400 _____ () C:\Windows\system32\perfh007.dat 2014-05-06 19:06 - 2010-07-20 23:46 - 00130240 _____ () C:\Windows\system32\perfc007.dat 2014-05-06 19:06 - 2009-07-14 07:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster Files to move or delete: ==================== C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll Some content of TEMP: ==================== C:\Users\Reyhan\AppData\Local\Temp\6_Offer_9.exe C:\Users\Reyhan\AppData\Local\Temp\autorun.dll C:\Users\Reyhan\AppData\Local\Temp\b4rrqmfd.dll C:\Users\Reyhan\AppData\Local\Temp\BackupSetup.exe C:\Users\Reyhan\AppData\Local\Temp\BundleSweetIMSetup.exe C:\Users\Reyhan\AppData\Local\Temp\Delta.exe C:\Users\Reyhan\AppData\Local\Temp\DeltaTB.exe C:\Users\Reyhan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll C:\Users\Reyhan\AppData\Local\Temp\Extract.exe C:\Users\Reyhan\AppData\Local\Temp\f.exe C:\Users\Reyhan\AppData\Local\Temp\glpo0rwa.dll C:\Users\Reyhan\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Reyhan\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe C:\Users\Reyhan\AppData\Local\Temp\MybabylonTB.exe C:\Users\Reyhan\AppData\Local\Temp\propsys.dll C:\Users\Reyhan\AppData\Local\Temp\Resource.exe C:\Users\Reyhan\AppData\Local\Temp\SP51865.exe C:\Users\Reyhan\AppData\Local\Temp\SP52264.exe C:\Users\Reyhan\AppData\Local\Temp\SP54714.exe C:\Users\Reyhan\AppData\Local\Temp\SP56215.exe C:\Users\Reyhan\AppData\Local\Temp\SP56221.exe C:\Users\Reyhan\AppData\Local\Temp\sp58915.exe C:\Users\Reyhan\AppData\Local\Temp\sp64126.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Reyhan\AppData\Local\Temp\WSSetup.exe C:\Users\Reyhan\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_N360_20117.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-08 13:32 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014 Ran by Reyhan at 2014-05-22 23:07:05 Running from C:\Users\Reyhan\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Kaspersky Internet Security (Enabled - Up to date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5} AS: Kaspersky Internet Security (Enabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Kaspersky Internet Security (Enabled) {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E} ==================== Installed Programs ====================== Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe Acrobat 5.0 (HKLM-x32\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.) Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader 9.5.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.1 - Adobe Systems Incorporated) Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc) ATI Catalyst Install Manager (HKLM\...\{1795BAA8-65EC-66D0-9DA4-D4B1FBE7700E}) (Version: 3.0.778.0 - ATI Technologies, Inc.) Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0621.2137.36973 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0621.2137.36973 - ATI) Hidden Catalyst Control Center InstallProxy (x32 Version: 2010.0621.2137.36973 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2010.0621.2137.36973 - ATI) Hidden CCC Help Chinese Standard (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Chinese Traditional (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Czech (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Danish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Dutch (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help English (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Finnish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help French (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help German (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Greek (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Hungarian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Italian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Japanese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Korean (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Norwegian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Polish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Portuguese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Russian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Spanish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Swedish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Thai (x32 Version: 2010.0621.2136.36973 - ATI) Hidden CCC Help Turkish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden ccc-core-static (x32 Version: 2010.0621.2137.36973 - Ihr Firmenname) Hidden ccc-utility64 (Version: 2010.0621.2137.36973 - ATI) Hidden Classic Shell (HKLM\...\{FEA1590B-540A-41FC-A95C-664493C82A21}) (Version: 3.6.8 - IvoSoft) CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.) CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.) CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.) CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version: - Microsoft) DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.5 - DivX, LLC) Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.) Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard) ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard) ffdshow v1.3.4500 [2013-01-06] (HKLM-x32\...\ffdshow_is1) (Version: 1.3.4500.0 - ) Free Video Converter V 3.2 (HKLM-x32\...\Free Video Converter_is1) (Version: 3.2.0.0 - Koyote Soft) Free YouTube Download version 3.2.4.622 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.4.622 - DVDVideoSoft Ltd.) Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.) Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION HDPlayer (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - HDPlayer) <==== ATTENTION Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard) HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard) HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard) HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company) HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company) HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard) HP Software Framework (HKLM-x32\...\{62BD9D85-46D9-400E-95F1-A09B667CB57F}) (Version: 3.5.23.1 - Hewlett-Packard Company) HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company) HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard) HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard) I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP) ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation) Java Auto Updater (x32 Version: 2.0.2.1 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.) Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.) Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Kaspersky Internet Security 2013 (HKLM-x32\...\InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}) (Version: 13.0.1.4190 - Kaspersky Lab) Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190 - Kaspersky Lab) Hidden LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.) LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe) Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla) MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - ) Plus-HD-2.2 (HKLM-x32\...\Plus-HD-2.2) (Version: 1.29.153.3 - Plus HD) <==== ATTENTION PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.) PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6066 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.) Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden RtVOsd (HKLM\...\{F3D7AC17-1FF4-41A8-BB18-3FC39C65AEB9}) (Version: 1.0.3 - Realtek Semiconductor Corp.) SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Speed Analysis 2 (HKLM-x32\...\Speed Analysis 2) (Version: 1.0.0.3 - SpeedAnalysis.com) <==== ATTENTION Studie zur Verbesserung von HP Officejet Pro 8600 Produkten (HKLM\...\{B9824225-2055-4700-BCD4-64B25EC88264}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated) toolplugin (HKLM-x32\...\toolplugin) (Version: - ) Torch (HKCU\...\Torch) (Version: 29.0.0.5394 - Torch Media, Inc) <==== ATTENTION Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft) Updater Service (HKLM-x32\...\Updater Service) (Version: 15,9,28,27 - ) <==== ATTENTION VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN) Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation) Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation) Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) WinRAR 5.00 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH) Zensurenrechner (HKLM-x32\...\{2D6650E5-EB74-489F-BE6B-5E5B2CAB502F}) (Version: 1.00.0000 - Marc-Oliver Stühmer) ==================== Restore Points ========================= 01-04-2014 16:14:15 Windows Update 05-04-2014 10:20:23 Windows Update 10-04-2014 18:08:42 Windows Update 10-04-2014 18:26:50 Windows Update 19-04-2014 20:04:41 Windows Update 28-04-2014 10:58:59 Windows Update 02-05-2014 09:26:12 Windows Update 06-05-2014 15:33:24 Windows Update 10-05-2014 20:34:30 Windows Update 15-05-2014 17:30:17 Windows Update 15-05-2014 21:22:08 Windows Update 21-05-2014 14:30:06 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {15C3458A-BB00-4737-80C4-A18AD391CAEA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {19D28779-8B9E-4BE5-B1D1-CBDAA2B2EB23} - System32\Tasks\HP AR Program Upload - 0916bfa35d324a3b82eee0161673d2c1dbc328c3dd23418d8292c36ce43f44a5 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>) Task: {1F372B15-D99E-4225-B22C-BD5546051ADF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated) Task: {2AF9F8EE-E480-46A1-A48C-E8FD6142F238} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard) Task: {36567CFC-253E-42CE-A9D3-B07AF22B6C96} - System32\Tasks\Plus-HD-2.2-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe [2013-11-05] (Plus HD) <==== ATTENTION Task: {39BB4247-47B8-4E51-827A-8B8585E31425} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-05-21] (PriceMeter) <==== ATTENTION Task: {4395BC09-BD88-4918-944E-F53B81E52A6A} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] () Task: {4428A508-3F22-4D65-BD1D-14C5481C041A} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.) Task: {46117FA1-7659-4580-81D0-A81B039B6CA8} - System32\Tasks\Plus-HD-2.2-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe [2013-11-05] (Plus HD) <==== ATTENTION Task: {54768754-8392-4E52-9C50-101C8BA14E3E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-20] (Google Inc.) Task: {62BF5ACB-A6BB-4742-B804-A3EAEB56793A} - System32\Tasks\Plus-HD-2.2-codedownloader => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe [2013-11-05] (Plus HD) <==== ATTENTION Task: {635ABB19-8A25-4825-9BA0-A577B2B99E3C} - System32\Tasks\HP AR Program Upload - 59dd25c072d24e1b9124c2395de5c0b03f6addd415d142e0817ab56c6f6e9395 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>) Task: {6EC561EE-9047-43F1-88E0-A06C04E1A677} - System32\Tasks\pricemeterdownloader => C:\Users\Reyhan\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION Task: {7193D61F-1C49-4AA3-8EA0-A2A2C386BD0E} - System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>) Task: {76E3365D-9562-48CD-97DF-AF62F73882AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard) Task: {7A58BA56-B0F5-4789-B27B-F8219D6418A4} - System32\Tasks\PriceMeterUpdater => C:\Users\Reyhan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {88406FE4-C8F7-4167-ADBE-AD6BA20E96D5} - System32\Tasks\Plus-HD-2.2-enabler => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe [2013-11-05] (Plus HD) <==== ATTENTION Task: {8E647909-B2ED-4356-BF24-8C2C9B82C9A4} - System32\Tasks\Plus-HD-2.2-updater => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe [2013-11-05] (Plus HD) <==== ATTENTION Task: {A15054DB-AE60-4069-AA94-F4D9C3DF5A77} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-20] (Google Inc.) Task: {A17C5532-BBB0-48E5-9252-B78F245F0E15} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {AAA2E062-EA50-4658-A693-35A87267FC32} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2014-05-13] (Microsoft) Task: {B14FD8F2-2B33-4DD5-A1A1-9D5F3F57534F} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-05-21] (PriceMeter) <==== ATTENTION Task: {D6968F80-7367-46CC-9FD4-DD8A64BBF212} - System32\Tasks\HPCeeScheduleForReyhan => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {E17FC154-EE02-4ED3-8225-6E641D66EE07} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company) Task: {E1F53E64-86F6-48E8-9938-1021E4392243} - System32\Tasks\HP AR Program Upload - 5ce66c71ccfb416c9bbe4617df876fc2cc33c535579141a5ac4678af48b3d875 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>) Task: {F93A880E-DBA1-4456-863B-8028F1805B51} - System32\Tasks\JavaUpdateSched => %COMMONPROGRAMFILES(x86)%\Java\Java Update\jusched.exe Task: {FCDD8B28-012E-4F25-882B-458F0EB62C34} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core.job => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA.job => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\HPCeeScheduleForReyhan.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe Task: C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe <==== ATTENTION Task: C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe <==== ATTENTION Task: C:\Windows\Tasks\Plus-HD-2.2-enabler.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe <==== ATTENTION Task: C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe <==== ATTENTION Task: C:\Windows\Tasks\Plus-HD-2.2-updater.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe <==== ATTENTION Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Reyhan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION ==================== Loaded Modules (whitelisted) ============= 2014-05-19 17:01 - 2014-05-12 15:06 - 00664584 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll 2010-06-10 18:12 - 2010-06-10 18:12 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2010-06-21 22:36 - 2010-06-21 22:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll 2012-08-17 22:39 - 2012-12-18 21:53 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll 2014-05-19 17:01 - 2014-05-12 15:06 - 00489992 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll 2014-05-19 17:01 - 2014-05-12 15:06 - 00020488 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\mgrldr.dll 2010-05-19 11:05 - 2010-05-19 11:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll 2010-05-19 11:05 - 2010-05-19 11:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll 2010-05-19 11:05 - 2010-05-19 11:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll 2012-08-17 22:38 - 2012-08-17 22:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll 2014-05-22 21:55 - 2014-05-22 21:55 - 00041984 _____ () c:\users\reyhan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll 2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\libcef.dll 2013-01-15 17:55 - 2013-01-15 17:55 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9e5dc5d1c75de12100f8c1d8c65de002\IsdiInterop.ni.dll 2010-12-01 04:35 - 2010-04-13 10:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll 2010-02-09 18:58 - 2010-02-09 18:58 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 00065352 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 00674632 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\libglesv2.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 00093000 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\libegl.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 04081480 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 00390472 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 01647432 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll 2014-05-15 20:20 - 2014-05-08 01:29 - 13695816 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupfolder: C:^Users^Reyhan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk => C:\Windows\pss\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk.Startup MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (05/22/2014 09:56:21 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/22/2014 00:23:59 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/22/2014 00:11:53 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/21/2014 10:48:13 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/21/2014 04:26:16 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/19/2014 10:42:20 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/19/2014 05:01:44 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/19/2014 04:00:15 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/19/2014 11:11:54 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/18/2014 10:50:31 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. System errors: ============= Error: (05/22/2014 09:55:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Update ConstaSurf" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (05/22/2014 00:35:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Update ConstaSurf" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (05/22/2014 00:35:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Update ConstaSurf" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (05/22/2014 00:35:36 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Util ConstaSurf" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (05/22/2014 00:10:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/22/2014 00:10:20 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Computer Backup (MyPC Backup) erreicht. Error: (05/22/2014 00:09:43 AM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 22.05.2014 um 00:08:32 unerwartet heruntergefahren. Error: (05/22/2014 00:04:01 AM) (Source: Service Control Manager) (EventID: 7006) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (05/22/2014 00:03:24 AM) (Source: Service Control Manager) (EventID: 7006) (User: ) Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen: %%5 Error: (05/21/2014 11:27:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht. Microsoft Office Sessions: ========================= Error: (05/22/2014 09:56:21 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/22/2014 00:23:59 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/22/2014 00:11:53 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/21/2014 10:48:13 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/21/2014 04:26:16 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/19/2014 10:42:20 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/19/2014 05:01:44 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/19/2014 04:00:15 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/19/2014 11:11:54 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 Error: (05/18/2014 10:50:31 AM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8 CodeIntegrity Errors: =================================== Date: 2014-02-09 10:11:44.398 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-09 10:11:44.398 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-09 10:11:44.383 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-09 10:11:44.383 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-09 10:11:44.367 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-09 10:11:44.367 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-08 12:34:41.113 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-08 12:34:41.113 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-08 12:34:41.113 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-02-08 12:34:41.097 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 53% Total physical RAM: 3893.86 MB Available physical RAM: 1829.81 MB Total Pagefile: 7785.86 MB Available Pagefile: 4934.76 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:280.96 GB) (Free:209.6 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:16.83 GB) (Free:2.43 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=17 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-05-22 23:45:40 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.12.0 298,09GB Running: Gmer-19357.exe; Driver: C:\Users\Reyhan\AppData\Local\Temp\uxdcqpow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 .text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 .text C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe[1292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe[1292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 .text C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe[3728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe[3728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 .text C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe[3956] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe[3956] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2014-01-03 03:42:50) 0000000003cb0000 Library c:\users\reyhan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2014-05-22 19:55:57) 0000000003ba0000 Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2013-10-18 23:55:02) 0000000069e30000 Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000073970000 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- |