| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
09.09.2014, 16:48
| #1 |
 |  Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen Hallo, Ich verwende Windows 7, 32 Bit-System, Service Pack1. seit einiger Zeit habe ich die Meldung, dass das Windows-Sicherheitscenter sich nicht aktivieren lässt, beim Versuch, es zu aktivieren kommt die Fehlermeldung, das es nicht gestartet werden kann. Versuche, das Problem nach verschiedenen Anleitungen aus Empfehlungen für andere Nutzer anderer Foren zu lösen, indem ich in den Diensten die Eigenschaften des Sicherheitscenters manuell starte oder dort die Einstellungen ändere, z.B. Starttyp auf "Automatisch, verzögerter Start" oder die Anmeldungsangaben (als Coputername, Administrator oder lokaler Dienst) schlugen fehl, da sich die Änderungen entweder nicht vornehmen ließen oder nach einer Minute das aktivierte Sicherheitscenter von alleine wieder deaktiviert wurde. Um nach etwaigen Viren etc. zu suchen, wollte ich MS Security Essentials einen gründlichen Scan machen lassen; jedesmal wenn ich versuchte, es zu öffnen, erschien es entweder gar nicht oder nur für den Bruchteil einer Sekunde auf dem Bildschirm. In den Eigenschaften des Microsoft Antimalware Service in den Diensten (entspricht meines Wissens den Security Essentials) erscheint der Status "gestartet", ich kann es jedoch nicht nutzen; auch eine De- und folgende Neu-installation der Security Essentials brachte keine Besserung. Es gibt keine früheren Wiederherstellungspunkte des Systems, die mir bekannt wären. Ich habe z.Zt. keine anderen Virenprogramme installiert. Hier sind die gewünschten logs (defogger_diable and GMER wurden übrigens, anders als in der Anleitung des Forums beschrieben, als log-Datei, nicht als txt-Datei gespeichert, ich hoffe, das macht keinen Unterschied); da der Defogger keine Fehlermeldung ausgab, poste ich defogger_disable.log hier nicht: FRST.txt: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-09-2014
Ran by Maximilian (administrator) on KMPC on 09-09-2014 16:40:00
Running from C:\Users\Maximilian\Desktop
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\Maximilian\AppData\Local\Amazon Music\Amazon Music Helper.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
() C:\Users\Maximilian\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Users\Maximilian\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [PPort11reminder] => C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2012-06-20] (Nullsoft, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [151952 2012-11-29] (Apple Inc.)
HKLM\...\Run: [MMReminderService] => C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe [37144 2007-11-21] (Mindjet)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe ë ë9ªÄsð²s
HKLM\...\Run: [IminentMessenger] => C:\Program Files\Iminent\Iminent.Messengers.exe
HKLM\...\Run: [fst_de_40] => [X]
HKLM\...\Run: [t4pc_en_5] => [X]
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296520 2014-09-07] (RealNetworks, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKU\S-1-5-21-1473903268-3248732401-4262168515-1003\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Maximilian\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-1473903268-3248732401-4262168515-1003\...\Run: [Amazon Music] => C:\Users\Maximilian\AppData\Local\Amazon Music\Amazon Music Helper.exe [3162944 2014-06-05] ()
HKU\S-1-5-21-1473903268-3248732401-4262168515-1003\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1473903268-3248732401-4262168515-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files\phase6\phase6_19\WinStart\p6erinnerung.exe (phase6)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Packer.exe.lnk
ShortcutTarget: Packer.exe.lnk -> C:\Users\Maximilian\AppData\Local\Temp\Nex95D9\Packer.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk
ShortcutTarget: tcbhn.lnk -> C:\Users\Maximilian\AppData\Roaming\BrowserCompanion\tcbhn.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1473903268-3248732401-4262168515-1006\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1473903268-3248732401-4262168515-1005\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1473903268-3248732401-4262168515-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1473903268-3248732401-4262168515-1003\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1473903268-3248732401-4262168515-1000\User: Group Policy restriction detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC8453AD75F9ACD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StKZmhdFMQ5NhCfKoItf6XvwT60786OsN2fRsWr7MwcQfr08GzPo0Uf6EG43lhHFEivIaaEaonQjoEWPsxnAW-PSqFbdGKPcuMy5ZZSGOOxZAbjb3bpXSZrGZpuLQSsNXapDSg50gVVI9nfiTOIl95nYh-kH8HxgbkMiyqNzqm088OYPckMOJ4Jdy1MQ7Vw1Tiig_AdsqyQoDwEg,,&q={searchTerms}
SearchScopes: HKCU - BrowserMngrDefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\bin\ssv.dll (Oracle Corporation)
BHO: No Name -> {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -> No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Maximilian\AppData\Roaming\Mozilla\Firefox\Profiles\fl14rnyh.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF Homepage: C:\\Users\\Maximilian\\Favorites\\max
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.5.0 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 -> C:\Program Files\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll No File
FF user.js: detected! => C:\Users\Maximilian\AppData\Roaming\Mozilla\Firefox\Profiles\fl14rnyh.default\user.js
FF SearchPlugin: C:\Users\Maximilian\AppData\Roaming\Mozilla\Firefox\Profiles\fl14rnyh.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fun Media Bar V11 - C:\Users\Maximilian\AppData\Roaming\Mozilla\Firefox\Profiles\fl14rnyh.default\Extensions\{21bd831c-5f59-432d-9c58-c3162b161816} [2014-09-05]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2013-12-06]
FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-09-07]
Chrome:
=======
CHR CustomProfile: C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-06]
CHR Extension: (Google Drive) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-06]
CHR Extension: (YouTube) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-06]
CHR Extension: (Google Search) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-06]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-11-06]
CHR Extension: (Skype Click to Call) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-11-06]
CHR Extension: (Google Wallet) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]
CHR Extension: (Gmail) - C:\Users\Maximilian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-06]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx []
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279000 2014-01-29] (Intel Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-09-07] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [100328 2011-02-24] (ASMedia Technology Inc)
R3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [308200 2011-02-24] (ASMedia Technology Inc)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
S4 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131856 2008-08-28] (Deterministic Networks, Inc.)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 OVT511Plus; C:\Windows\System32\Drivers\omcamvid.sys [167816 2001-09-18] (OmniVision Technologies, Inc.)
R3 teamviewervpn; C:\Windows\System32\DRIVERS\teamviewervpn.sys [25088 2013-10-17] (TeamViewer GmbH)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva-6.sys [43120 2013-06-19] (Cisco Systems, Inc.)
R1 {0bd9bacb-0a2d-4412-900e-b2473afd87b4}Gw; C:\Windows\System32\drivers\{0bd9bacb-0a2d-4412-900e-b2473afd87b4}Gw.sys [52920 2014-06-09] (StdLib)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 fdrawcmd; \??\C:\Windows\system32\drivers\fdrawcmd.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-09 16:40 - 2014-09-09 16:40 - 00019844 _____ () C:\Users\Maximilian\Desktop\FRST.txt
2014-09-09 16:39 - 2014-09-09 16:40 - 00000000 ____D () C:\FRST
2014-09-09 14:00 - 2014-09-09 14:00 - 01097728 _____ (Farbar) C:\Users\Maximilian\Desktop\FRST.exe
2014-09-09 13:39 - 2014-09-09 13:39 - 00000482 _____ () C:\Users\Maximilian\Desktop\defogger_disable.log
2014-09-09 13:39 - 2014-09-09 13:39 - 00000000 _____ () C:\Users\Maximilian\defogger_reenable
2014-09-09 13:38 - 2014-09-09 13:38 - 00050477 _____ () C:\Users\Maximilian\Desktop\Defogger.exe
2014-09-08 18:52 - 2014-09-08 18:52 - 00002123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-08 18:52 - 2014-09-08 18:52 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-08 17:07 - 2014-09-08 17:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-08 14:56 - 2014-09-08 15:23 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\QuickScan
2014-09-08 14:09 - 2014-09-08 14:10 - 00182832 _____ () C:\Windows\RegBootClean.exe
2014-09-08 04:44 - 2014-09-09 07:33 - 00287545 _____ () C:\Users\Maximilian\AppData\Local\census.cache
2014-09-08 04:44 - 2014-09-09 07:33 - 00158544 _____ () C:\Users\Maximilian\AppData\Local\ars.cache
2014-09-07 22:38 - 2014-09-07 22:38 - 00000036 _____ () C:\Users\Maximilian\AppData\Local\housecall.guid.cache
2014-09-07 12:07 - 2014-09-07 12:07 - 00000072 _____ () C:\Users\Max\AppData\Roaming\WB.CFG
2014-09-07 01:36 - 2014-09-07 01:36 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-07 01:04 - 2014-09-07 01:04 - 00278600 _____ (Progressive Networks) C:\Windows\system32\pncrt.dll
2014-09-07 01:04 - 2014-09-07 01:04 - 00201800 _____ (RealNetworks, Inc.) C:\Windows\system32\rmoc3260.dll
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\ProgramData\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\Program Files\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\Program Files\Common Files\xing shared
2014-09-07 01:03 - 2014-09-07 01:03 - 00505416 _____ (Microsoft Corporation) C:\Windows\system32\msvcp71.dll
2014-09-07 00:57 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-09-07 00:57 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-09-07 00:57 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-09-07 00:57 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-09-07 00:57 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-09-07 00:57 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-09-07 00:46 - 2014-09-07 00:46 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\VirtualStore
2014-09-06 20:33 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-09-06 10:47 - 2014-05-08 11:06 - 02742784 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-09-06 10:47 - 2014-05-08 11:06 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-09-06 08:29 - 2014-09-06 08:29 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\TeamViewer
2014-09-06 08:24 - 2013-10-02 02:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-09-06 08:24 - 2013-10-02 02:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-09-06 08:24 - 2013-10-02 02:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-09-06 08:24 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-09-06 08:24 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-09-06 08:24 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-09-06 08:24 - 2013-10-02 01:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-09-06 08:24 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-09-06 08:24 - 2013-10-02 01:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-09-06 08:24 - 2013-10-02 00:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-09-06 08:24 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-09-06 08:24 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-09-06 08:24 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-09-06 08:24 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-09-06 08:22 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-05 21:33 - 2014-09-05 21:33 - 00001142 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-09-05 21:33 - 2014-09-05 21:33 - 00000000 ____D () C:\Program Files\TeamViewer
2014-09-05 21:33 - 2013-10-17 17:32 - 00025088 _____ (TeamViewer GmbH) C:\Windows\system32\Drivers\teamviewervpn.sys
2014-09-05 13:06 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-05 13:06 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-09-05 13:06 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-05 13:06 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-05 13:00 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-05 13:00 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-05 13:00 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-05 13:00 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-05 13:00 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-05 13:00 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-05 13:00 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-05 13:00 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-05 13:00 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-05 13:00 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-05 13:00 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-05 13:00 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-05 13:00 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-05 13:00 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-05 13:00 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-05 13:00 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-05 13:00 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-05 13:00 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-05 13:00 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-05 13:00 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-05 13:00 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-05 13:00 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-05 13:00 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-05 13:00 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-05 13:00 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-05 13:00 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-05 13:00 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-05 12:59 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-05 12:59 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-05 12:59 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-05 12:59 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-05 12:59 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-05 12:59 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-05 12:59 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-09-05 12:59 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-05 12:59 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-09-05 12:59 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-09-05 12:59 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-09-05 12:59 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-09-05 12:59 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-05 12:59 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-05 12:59 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-09-05 12:51 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-09-05 12:51 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-09-05 12:51 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-09-05 12:51 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-09-05 12:51 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-09-05 12:51 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-09-05 12:51 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-09-05 12:51 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-09-05 12:51 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-09 16:40 - 2014-09-09 16:40 - 00019844 _____ () C:\Users\Maximilian\Desktop\FRST.txt
2014-09-09 16:40 - 2014-09-09 16:39 - 00000000 ____D () C:\FRST
2014-09-09 16:40 - 2014-01-03 14:40 - 00000304 _____ () C:\Windows\Tasks\FoxTab.job
2014-09-09 16:28 - 2012-10-16 19:00 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000UA.job
2014-09-09 15:59 - 2012-10-09 09:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-09 15:52 - 2013-02-28 20:56 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-09 15:41 - 2013-04-27 00:05 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006UA.job
2014-09-09 15:41 - 2013-04-27 00:05 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006Core.job
2014-09-09 14:00 - 2014-09-09 14:00 - 01097728 _____ (Farbar) C:\Users\Maximilian\Desktop\FRST.exe
2014-09-09 13:39 - 2014-09-09 13:39 - 00000482 _____ () C:\Users\Maximilian\Desktop\defogger_disable.log
2014-09-09 13:39 - 2014-09-09 13:39 - 00000000 _____ () C:\Users\Maximilian\defogger_reenable
2014-09-09 13:39 - 2012-09-24 16:14 - 00000000 ____D () C:\Users\Maximilian
2014-09-09 13:38 - 2014-09-09 13:38 - 00050477 _____ () C:\Users\Maximilian\Desktop\Defogger.exe
2014-09-09 12:51 - 2012-07-14 21:24 - 01211202 _____ () C:\Windows\WindowsUpdate.log
2014-09-09 07:33 - 2014-09-08 04:44 - 00287545 _____ () C:\Users\Maximilian\AppData\Local\census.cache
2014-09-09 07:33 - 2014-09-08 04:44 - 00158544 _____ () C:\Users\Maximilian\AppData\Local\ars.cache
2014-09-08 21:52 - 2013-02-28 20:56 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-08 19:28 - 2012-10-16 18:59 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000Core.job
2014-09-08 19:18 - 2009-07-14 06:34 - 00020464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-08 19:18 - 2009-07-14 06:34 - 00020464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-08 19:11 - 2014-04-02 23:05 - 00000322 _____ () C:\Windows\Tasks\TWRVUFFFAL.job
2014-09-08 19:11 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-08 19:11 - 2009-07-14 06:39 - 00171539 _____ () C:\Windows\setupact.log
2014-09-08 18:53 - 2012-07-14 17:51 - 00002057 _____ () C:\Windows\epplauncher.mif
2014-09-08 18:52 - 2014-09-08 18:52 - 00002123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-08 18:52 - 2014-09-08 18:52 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-08 18:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-08 18:26 - 2014-03-09 15:50 - 00022896 _____ () C:\Windows\DPINST.LOG
2014-09-08 17:07 - 2014-09-08 17:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-08 17:06 - 2014-06-16 09:22 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\Adobe
2014-09-08 17:06 - 2012-07-14 15:38 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-08 17:06 - 2012-07-14 15:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-08 15:23 - 2014-09-08 14:56 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\QuickScan
2014-09-08 14:19 - 2009-07-14 06:33 - 00287536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 14:18 - 2012-10-16 20:43 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\Skype
2014-09-08 14:10 - 2014-09-08 14:09 - 00182832 _____ () C:\Windows\RegBootClean.exe
2014-09-08 14:10 - 2014-01-03 14:41 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\genienext
2014-09-08 14:10 - 2014-01-03 14:40 - 00000000 ____D () C:\Program Files\Mobogenie
2014-09-08 14:09 - 2014-01-03 14:41 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\newnext.me
2014-09-07 22:38 - 2014-09-07 22:38 - 00000036 _____ () C:\Users\Maximilian\AppData\Local\housecall.guid.cache
2014-09-07 22:11 - 2012-09-28 21:40 - 00000000 ____D () C:\Users\Max\AppData\Roaming\BrowserCompanion
2014-09-07 12:07 - 2014-09-07 12:07 - 00000072 _____ () C:\Users\Max\AppData\Roaming\WB.CFG
2014-09-07 02:59 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-07 01:36 - 2014-09-07 01:36 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-09-07 01:36 - 2012-08-03 15:19 - 00000000 ____D () C:\ProgramData\Skype
2014-09-07 01:26 - 2012-10-11 21:31 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\RealNetworks
2014-09-07 01:26 - 2012-09-24 16:15 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\Real
2014-09-07 01:15 - 2012-07-20 18:33 - 00000000 ____D () C:\Users\Max\AppData\Roaming\Real
2014-09-07 01:12 - 2012-07-20 18:29 - 00000000 ____D () C:\ProgramData\Real
2014-09-07 01:11 - 2012-10-16 19:01 - 00002354 _____ () C:\Users\Max\Desktop\Google Chrome.lnk
2014-09-07 01:07 - 2012-07-22 22:38 - 00000000 ____D () C:\Users\Max\AppData\Roaming\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00278600 _____ (Progressive Networks) C:\Windows\system32\pncrt.dll
2014-09-07 01:04 - 2014-09-07 01:04 - 00201800 _____ (RealNetworks, Inc.) C:\Windows\system32\rmoc3260.dll
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\ProgramData\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\Program Files\RealNetworks
2014-09-07 01:04 - 2014-09-07 01:04 - 00000000 ____D () C:\Program Files\Common Files\xing shared
2014-09-07 01:04 - 2012-07-20 18:33 - 00000000 ____D () C:\Program Files\Real
2014-09-07 01:03 - 2014-09-07 01:03 - 00505416 _____ (Microsoft Corporation) C:\Windows\system32\msvcp71.dll
2014-09-07 01:01 - 2012-07-14 17:51 - 00064488 _____ () C:\Users\Max\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-07 00:50 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-07 00:46 - 2014-09-07 00:46 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\VirtualStore
2014-09-07 00:45 - 2014-06-14 21:07 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-09-07 00:45 - 2010-11-20 23:48 - 00140606 _____ () C:\Windows\PFRO.log
2014-09-07 00:22 - 2013-11-17 01:14 - 00000000 ____D () C:\ProgramData\Freemake
2014-09-07 00:22 - 2013-11-17 01:14 - 00000000 ____D () C:\Program Files\Freemake
2014-09-07 00:21 - 2014-03-09 15:50 - 00000000 ____D () C:\Program Files\Samsung
2014-09-07 00:14 - 2013-04-26 23:39 - 00000000 ____D () C:\Users\Alicia
2014-09-06 08:36 - 2009-07-14 04:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-06 08:35 - 2010-11-21 02:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-09-06 08:29 - 2014-09-06 08:29 - 00000000 ____D () C:\Users\Maximilian\AppData\Roaming\TeamViewer
2014-09-06 08:24 - 2012-07-14 21:19 - 00000000 ____D () C:\Program Files\Intel
2014-09-05 21:34 - 2012-09-25 17:23 - 00000000 ____D () C:\Users\Maximilian\.gimp-2.6
2014-09-05 21:34 - 2012-09-24 16:15 - 00064488 _____ () C:\Users\Maximilian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-05 21:33 - 2014-09-05 21:33 - 00001142 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-09-05 21:33 - 2014-09-05 21:33 - 00000000 ____D () C:\Program Files\TeamViewer
2014-09-05 21:21 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-05 13:44 - 2014-07-24 12:35 - 00000000 ____D () C:\Program Files\MarkAny
2014-09-05 13:22 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-05 13:08 - 2013-08-14 10:27 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-05 13:08 - 2012-07-14 15:59 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-05 13:01 - 2013-09-28 08:33 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\CrashDumps
2014-09-05 12:58 - 2014-07-24 08:46 - 00000000 ____D () C:\Users\Maximilian\AppData\Local\Samsung
2014-09-05 12:57 - 2014-07-23 23:55 - 00000000 ____D () C:\ProgramData\Samsung
2014-09-05 12:51 - 2012-08-03 15:19 - 00000000 ___RD () C:\Program Files\Skype
2014-08-23 03:46 - 2014-09-05 12:59 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-09-05 12:59 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
Some content of TEMP:
====================
C:\Users\Alicia\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Cassidy\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Cassidy\AppData\Local\Temp\SIntf16.dll
C:\Users\Cassidy\AppData\Local\Temp\SIntf32.dll
C:\Users\Cassidy\AppData\Local\Temp\SIntfNT.dll
C:\Users\Cassidy\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
C:\Users\Max\AppData\Local\Temp\25296-667386-winzip.exe
C:\Users\Max\AppData\Local\Temp\dealply.exe
C:\Users\Max\AppData\Local\Temp\GURB672.exe
C:\Users\Max\AppData\Local\Temp\installer.exe
C:\Users\Max\AppData\Local\Temp\install_flashplayer11x32ax_aaa_aih.exe
C:\Users\Max\AppData\Local\Temp\instloffer.exe
C:\Users\Max\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Max\AppData\Local\Temp\speedupmypc.exe
C:\Users\Max\AppData\Local\Temp\stubhelper.dll
C:\Users\Max\AppData\Local\Temp\tbbabylonv3.exe
C:\Users\Maximilian\AppData\Local\Temp\bs.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 02:44
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-09-2014
Ran by Maximilian at 2014-09-09 16:40:35
Running from C:\Users\Maximilian\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Action Replay PowerSaves 3DS Version 1.01 (HKLM\...\{CD24B06F-0A4D-410A-AEF2-DFE6A28AB4C0}_is1) (Version: 1.01 - Datel Design & Development)
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Amazon Kindle (HKLM\...\Amazon Kindle) (Version: - Amazon)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.0.0.564 - Amazon Services LLC)
Apple Application Support (HKLM\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{459699C3-9430-4381-964B-4248D87B49F9}) (Version: 6.0.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Artweaver Free 3.1 (HKLM\...\{96A9A1C8-FBAD-4703-ABF1-E93AA8FE85A0}_is1) (Version: 3.1 - Boris Eyrich Software)
Ashampoo Burning Studio Elements 10.0.9 (HKLM\...\Ashampoo Burning Studio Elements_is1) (Version: 3.1.1 - Ashampoo GmbH & Co. KG)
AvPx version 0.1 (HKLM\...\{6214FDEA-8101-434C-86C0-6CBF1380D025}_is1) (Version: 0.1 - SirLemonhead)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
BookScan&Whiteboard Suite (HKLM\...\{F4933D9F-89CC-4CA9-B5B0-CF32968890C7}) (Version: 1.0 - Reallusion)
Brother MFL-Pro Suite DCP-195C (HKLM\...\{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Camtasia Studio 8 (HKLM\...\{BFA04EE0-8240-4667-8D53-45496A901C33}) (Version: 8.1.2.1327 - TechSmith Corporation)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DER HERR DER RINGE: DIE GEFÄHRTEN (HKLM\...\InstallShield_{49C98C60-BAC3-4C92-AF4F-E890FD312D60}) (Version: 1.01.0453 - Ihr Firmenname)
DER HERR DER RINGE: DIE GEFÄHRTEN (Version: 1.01.0453 - Ihr Firmenname) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.1.13904 - Landesfinanzdirektion Thüringen)
FFsplit version 0.7 (HKLM\...\{82458834-6226-4A34-AE96-6907354F9F36}_is1) (Version: 0.7 - FFsplit Team)
Fotogalerie (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free YouTube Download version 3.2.31.325 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.31.325 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.31.325 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.31.325 - DVDVideoSoft Ltd.)
GIMP 2.6.11 (HKLM\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
iCloud (HKLM\...\{8CC68433-5837-4075-B81F-EA7E4F14CE60}) (Version: 2.0.2.187 - Apple Inc.)
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
iTunes (HKLM\...\{1B6C0E95-182C-48E0-9C4B-4F916308249C}) (Version: 11.0.0.163 - Apple Inc.)
Java Auto Updater (Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 5 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217005FF}) (Version: 7.0.50 - Oracle)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Mindjet MindManager Lite 7 (HKLM\...\{FFBE334E-06EF-44B5-8CF7-129F7F9526A2}) (Version: 7.1.388 - Mindjet LLC)
Movie Maker (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVC80_x86 (Version: 1.0.1.0 - Nokia) Hidden
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenOffice.org 3.4 (HKLM\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
phase6_19 (HKLM\...\{65D70656-D248-4C83-B594-E3029C43B37A}) (Version: 1.90.0000 - phase6)
Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Portal: First Slice (HKLM\...\Steam App 410) (Version: - Valve)
QuickTime (HKLM\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
RealDownloader (Version: 17.0.11 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer Cloud (HKLM\...\RealPlayer 17.0) (Version: 17.0.11 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6383 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
ScanSoft PaperPort 11 (HKLM\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)
Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
UpdateService (Version: 1.0.0 - RealNetworks, Inc.) Hidden
VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc)
Windows Live Communications Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinSCP 5.1.4 (HKLM\...\winscp3_is1) (Version: 5.1.4 - Martin Prikryl)
WinZip 16.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240D2}) (Version: 16.5.10095 - WinZip Computing, S.L. )
Yu-Gi-Oh! ONLINE 3 (HKLM\...\{22439E2F-1CF7-4F8B-992A-3AA3C0553929}) (Version: 1.00.5000 - Konami Digital Entertainment)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Max\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Max\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Max\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{3f04dadf-6ea4-44d1-a507-03cad176f443}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Max\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Max\AppData\Local\Google\Chrome\Application\36.0.1985.125\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{7ad3508e-238c-584c-9c26-b0d3417ae12f}\InprocServer32 -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.149\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Max\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-1473903268-3248732401-4262168515-1003_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Maximilian\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {02F1FA87-14F6-411D-9DC0-288AEFC61A24} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000UA => C:\Users\Max\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-16] (Google Inc.)
Task: {05571990-E1FC-41CB-A254-3E7706287A72} - System32\Tasks\FoxTab => C:\Users\MAXIMI~1\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {0F903925-96FB-4ED1-B9BF-8C0A8C21E61F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-02-28] (Google Inc.)
Task: {12D20C62-31FB-41CB-8038-B04E56135C6B} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1473903268-3248732401-4262168515-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {164666EA-B5B6-41EF-95B0-A4D76A4B9379} - System32\Tasks\{8A9FCE31-6DA7-4FC6-8C49-467C06A516A5} => D:\Max\NEU\yz\alt\all ireally want.exe
Task: {1E41BE6F-F0CE-4179-8CC1-981173982820} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1473903268-3248732401-4262168515-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {1F1A8EE6-10E5-4AF7-A694-01D5AFE17B95} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {29A59A74-B5E6-41A4-95DF-F62098F9246F} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {3224C09A-E614-4E2F-9845-D2433A412228} - System32\Tasks\DealPly => C:\Users\Max\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {332BC559-E468-4265-A569-52831DD4DDFB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006Core => C:\Users\Alicia\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-27] (Google Inc.)
Task: {37F8EC0A-35E6-41C2-8B10-E31EDF483DDF} - System32\Tasks\{821E5D04-0A47-41E5-A36F-35FEE1D48A30} => D:\Max\NEU\yz\alt\freaking sweet.exe
Task: {3C746E91-A90C-480B-9981-D127513745EA} - System32\Tasks\{01E22E6D-9255-4801-99D9-0F4C2202DF9E} => D:\Max\NEU\spiele\sw\SW.EXE
Task: {3E74E68E-DB2D-477F-88CE-A711672682C9} - System32\Tasks\{E1101E3D-B81C-4161-A167-79B86F38AEBE} => D:\Max\NEU\yz\alt\all ireally want.exe
Task: {3F6A04A3-538F-420A-BB2F-67A79C518057} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {4F544165-D71A-46F9-AD21-9A23DBBE56A5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-02-28] (Google Inc.)
Task: {4F5D8A5D-C5D9-4B14-A1B4-21B709951E07} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1473903268-3248732401-4262168515-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {5DAFBDC1-8698-441C-A03D-079003CB6A9D} - System32\Tasks\{F93BFDDE-171B-49CE-8457-838A96AD8F9C} => D:\Max\NEU\yz\alt\all ireally want.exe
Task: {624C09CA-085C-4A0B-90FA-09F168FAF927} - System32\Tasks\{4DAFF817-6BCD-4178-A917-6FE762746EF0} => D:\Max\NEU\spiele\sw\SETUP.EXE
Task: {65E97831-CDB4-40CF-B50B-2241975BD1F1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006UA => C:\Users\Alicia\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-27] (Google Inc.)
Task: {6C18FB9D-994B-4603-A772-2ECD9DFFA3B1} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {6F432DBF-9775-4A6C-9C34-9B0349746F89} - System32\Tasks\{1EC04E54-4498-47F0-97BF-C25BEF35C346} => D:\Max\NEU\yz\alt\freaking sweet.exe
Task: {843A1634-39EB-4D17-BCD7-D846B78305BE} - System32\Tasks\{3B176F7C-B67C-4281-B52F-BC26494EFE02} => D:\Max\NEU\spiele\AVP\game\Aliens versus Predator\AvP.exe
Task: {8758D79D-3A9C-4EA0-9A17-F86CABB1ACE1} - System32\Tasks\{D14059CA-59C2-418D-B9F9-CC1C1994083D} => D:\Max\NEU\yz\alt\all ireally want.exe
Task: {A33C676E-9283-4FF5-A6A7-35E4F458ECCA} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1473903268-3248732401-4262168515-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {A4741C48-E4CB-4011-875E-BDDC5DD25E66} - System32\Tasks\{56659F18-6FBA-4E78-972A-5C50FA47B825} => D:\Max\NEU\spiele\sw\SETUP.EXE
Task: {BE38A405-EB7A-4547-9B0C-8EB377253107} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)
Task: {C6D4EA86-1483-4104-8C9B-986CCA1407F8} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {C86F6CCA-49BD-40BB-AC87-FC85D95A186D} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {D75F3926-0576-4CD7-8032-B13DA00FC926} - System32\Tasks\{B629A093-33E0-43EB-BFCB-78026FE046FC} => D:\Max\NEU\spiele\AVP\game\Aliens versus Predator\AvP.exe
Task: {D863F8EA-FD8A-4894-AAFA-8E5848E20870} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000Core => C:\Users\Max\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-16] (Google Inc.)
Task: {DFF8FFDD-229E-4747-AC2D-7052244A4310} - System32\Tasks\{F90E1C34-AC20-4254-A709-02CE5CD43462} => D:\Max\NEU\spiele\sw\SW.EXE
Task: {E0837820-5E5F-4C82-9B49-B975363B4CAD} - System32\Tasks\Amazon Music Helper => C:\Users\Maximilian\AppData\Local\Amazon Music\Amazon Music Helper.exe [2014-06-05] ()
Task: {E3163D5A-4CBD-4661-9060-D994AEE657FE} - System32\Tasks\TWRVUFFFAL => Rundll32.exe "C:\Windows\system32\Microsoftv.dll",Dmketld
Task: {EDDE95ED-184D-4D86-B327-5E38B4CEA7F6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-08] (Adobe Systems Incorporated)
Task: {F03BFB79-C066-49F2-A311-7F93607DFEF4} - System32\Tasks\{3A23A8C1-DE5A-4C50-BBCB-34525A5E7AFB} => D:\Max\NEU\spiele\AVP\game\Aliens versus Predator\AvP.exe
Task: {F7694518-8016-4F7C-B6BB-CAD3C29CD155} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1473903268-3248732401-4262168515-1003 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2014-06-26] (RealNetworks, Inc.)
Task: {FCC0C834-D1C3-4C69-8373-E094C0A22F72} - System32\Tasks\4475 => Wscript.exe C:\Users\Max\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {FE2B21A8-7686-4233-AEE4-7460D2568923} - System32\Tasks\{9C5267E4-5F60-4274-B67D-1FAD09A1F11B} => D:\Max\NEU\spiele\sw\SW.EXE
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FoxTab.job => C:\Users\MAXIMI~1\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000Core.job => C:\Users\Max\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1000UA.job => C:\Users\Max\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006Core.job => C:\Users\Alicia\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1473903268-3248732401-4262168515-1006UA.job => C:\Users\Alicia\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\TWRVUFFFAL.job => C:\Windows\system32\Microsoftv.dll
==================== Loaded Modules (whitelisted) =============
2014-09-05 21:33 - 2013-10-17 17:32 - 00019448 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\TeamViewer_PrintProcessor.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-06-10 17:50 - 2014-06-10 17:50 - 00039568 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2014-09-07 01:04 - 2014-09-07 01:04 - 00861784 _____ () c:\program files\real\realplayer\RPDS\Plugins\cldplin.dll
2014-06-26 00:43 - 2014-06-26 00:43 - 00023552 _____ () C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
2014-06-24 22:13 - 2014-06-05 00:18 - 03162944 _____ () C:\Users\Maximilian\AppData\Local\Amazon Music\Amazon Music Helper.exe
2012-07-21 15:42 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files\Brother\BrUtilities\BrLogAPI.dll
2012-07-14 22:08 - 2011-04-15 04:16 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
2013-05-22 20:50 - 2013-05-22 20:50 - 00400704 _____ () C:\Users\Maximilian\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2014-07-23 09:32 - 2014-07-23 09:32 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-09-09 13:38 - 2014-09-09 13:38 - 00050477 _____ () C:\Users\Maximilian\Desktop\Defogger.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: Microsoft-Teredo-Tunneling-Adapter
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/09/2014 07:52:58 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/08/2014 07:13:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 06:53:39 PM) (Source: Microsoft Security Client Setup) (EventID: 100) (User: KMPC)
Description: HRESULT:0x8004FF06
Description:Microsoft Security Essentials is already installed. A newer version of Security Essentials is already installed on your computer. Error code:0x8004FF06.
Error: (09/08/2014 06:29:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 03:42:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 02:21:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 05:06:33 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/07/2014 02:55:31 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/07/2014 01:04:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/07/2014 01:04:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (09/07/2014 00:59:14 AM) (Source: Application Popup) (EventID: 1) (User: )
Description: {Vorgang fehlgeschlagen}
Der Vorgang konnte nicht durchgeführt werden.
Error: (09/06/2014 08:33:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Update für Windows 7 (KB2923545)
Error: (09/06/2014 08:36:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) Content Protection HECI Service" wurde mit folgendem Fehler beendet:
%%-2147024637
Error: (09/06/2014 07:07:22 AM) (Source: Application Popup) (EventID: 1) (User: )
Description: {Vorgang fehlgeschlagen}
Der Vorgang konnte nicht durchgeführt werden.
Error: (09/06/2014 07:02:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079
Error: (09/06/2014 07:01:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079
Error: (09/06/2014 06:37:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079
Error: (09/06/2014 06:37:01 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "Sicherheitscenter" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (09/06/2014 06:36:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079
Error: (09/06/2014 06:35:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Sicherheitscenter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1079
Microsoft Office Sessions:
=========================
Error: (09/09/2014 07:52:58 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{20C2051A-1ACA-48B4-9BA5-24625DCBD880}\recordingmanager.exe
Error: (09/08/2014 07:13:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 06:53:39 PM) (Source: Microsoft Security Client Setup) (EventID: 100) (User: KMPC)
Description: HRESULT:0x8004FF06
Description:Microsoft Security Essentials is already installed. A newer version of Security Essentials is already installed on your computer. Error code:0x8004FF06.
Error: (09/08/2014 06:29:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 03:42:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 02:21:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2014 05:06:33 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{20C2051A-1ACA-48B4-9BA5-24625DCBD880}\recordingmanager.exe
Error: (09/07/2014 02:55:31 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{20C2051A-1ACA-48B4-9BA5-24625DCBD880}\recordingmanager.exe
Error: (09/07/2014 01:04:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\program files\real\realplayer\realplay.exe
Error: (09/07/2014 01:04:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\program files\real\realplayer\realplay.exe
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU G530 @ 2.40GHz
Percentage of memory in use: 50%
Total physical RAM: 2985.23 MB
Available physical RAM: 1489.4 MB
Total Pagefile: 7079.52 MB
Available Pagefile: 5367.34 MB
Total Virtual: 2047.88 MB
Available Virtual: 1891.65 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:80 GB) (Free:32.64 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATEN) (Fixed) (Total:851.51 GB) (Free:647.89 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 44B60D10)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=851.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-09 17:09:11
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.01.0 931,51GB
Running: mhlpobp4.exe; Driver: C:\Users\MAXIMI~1\AppData\Local\Temp\pgldqpog.sys
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83058A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83092212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Real\RealPlayer\Update\realsched.exe[428] kernel32.dll!SetUnhandledExceptionFilter 7777F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4236] kernel32.dll!SetUnhandledExceptionFilter 7777F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\111111111111
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\111111111111@789ed0f4ff36 0x24 0x6E 0x4A 0x9F ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\111111111111 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\111111111111@789ed0f4ff36 0x24 0x6E 0x4A 0x9F ...
---- EOF - GMER 2.1 ----
|
|
09.09.2014, 17:17
| #2 |
| /// TB-Ausbilder   | Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Scan mit Combofix
|
|
09.09.2014, 17:41
| #3 | |
| | Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen Hallo,
__________________leider kann ich vor Durchführen von ComboFix MS Security Essentials nicht beenden, in den Diensten kann ich in den Eigenschaften von MS Antimalware Service keine Einstellungen ändern. Soll ich ComboFix trotzdem laufen lassen oder versuchen, MS Security Essentials zu deinstallieren? Zitat:
leider kann ich vor Durchführen von ComboFix MS Security Essentials nicht beenden, in den Diensten kann ich in den Eigenschaften von MS Antimalware Service keine Einstellungen ändern. Soll ich ComboFix trotzdem laufen lassen oder versuchen, MS Security Essentials zu deinstallieren? Ist es besser, in solchen Problemfällen so wie hier direkt zu antworten, oder über den Antwort-Knopf unterhalb des letzten Posts? |
|
09.09.2014, 17:41
| #4 | |
| /// TB-Ausbilder | Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzenZitat:
So klappt das bei mir auf jeden Fall... |
|
09.09.2014, 17:48
| #5 |
| | Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen Hallo, leider ist es ja Teil meines Problems, dass ich Security Essentials nicht starten kann bzw. immer dann, wenn ich es anklicke, kein entsprechendes Fenster für das Programm erschient bzw. nur für den Bruchteil einer Sekunde. Ich kann also keine Einstellungen vornehmen. |
|
10.09.2014, 08:46
| #6 |
| /// TB-Ausbilder | Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen Servus, dann ComboFix trotzdem ausführen. |
|
| Themen zu Windows 7: Windows-Sicherheitscenter nicht aktivierbar, MS Security Essentials lässt sich nicht benutzen |
| 4d36e972-e325-11ce-bfc1-08002be10318, conduit.search, conduit.search entfernen, conduitsearch, conduitsearch entfernen, converter, dvdvideosoft ltd., error, fehlercode 0x5, flash player, iexplore.exe, log-datei, mobogenie, mobogenie entfernen, popup, registry, scan, security, svchost.exe, viren, win32/adware.ibryte.bg, win32/adware.yontoo.b, win32/browsercompanion.a, win32/browsercompanion.g, win32/conduit.searchprotect.n, win32/systweak.a, win32/toolbar.conduit.y, wscript.exe |
Hybrid-Darstellung
