| |
| |||||||
Log-Analyse und Auswertung: Windows 7: McAfee arlarmiert wegen Settings ManagerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
10.09.2014, 22:22
| #1 |
| |  Windows 7: McAfee arlarmiert wegen Settings Manager Schönen guten Abend! *Seit einigen Tagen schlägt die McAfee 'Scannen-bei-Zugriff-Konsole' ständig wegen einer verdächtigen Datei an, die in einem Ordner namens 'Settings Manager' liegt. *Auch Internet Explorer lässt sich nicht öffenen - mit Verweis darauf dass das Bild nicht autorisiert sei (oder so ähnlich). Wieder gibt es einen Hinweis auf 'Settings Manager'. *Laptop und Browser sind extrem langsam. Anbei die in der Anleitung gewünschten Log-Files... Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:18 on 10/09/2014 (xxxxx)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-09-2014
Ran by xxxxxxx (administrator) on CLAUDIA on 10-09-2014 22:47:25
Running from C:\Users\xxxxxxx\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Toshiba Europe GmbH) C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Spotify Ltd) C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Spotify Ltd) C:\Users\xxxxxxx\AppData\Roaming\Spotify\spotify.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHWE.EXE
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
() C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
(Dropbox, Inc.) C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-07-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM\...\Run: [MagicTuneEngine] => C:\Program Files\MagicTune Premium\MagicTuneLauncher.exe [53760 2010-10-29] ()
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [NBAgent] => c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-09-02] (Nero AG)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [SVPWUTIL] => C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-03-03] (TOSHIBA)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-15] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294136 2009-10-06] (TOSHIBA Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [136512 2009-08-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [124240 2009-10-22] (McAfee, Inc.)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\.DEFAULT\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Badoo Desktop] => C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify Web Helper] => C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify] => C:\Users\xxxxxxx\AppData\Roaming\Spotify\spotify.exe [6621752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHWE.EXE [241280 2014-01-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\MountPoints2: {48f74f1e-28aa-11e4-a5aa-806e6f6e6963} - F:\EzODDPlus.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibration.lnk
ShortcutTarget: Color Calibration.lnk -> C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.exe.lnk
ShortcutTarget: GammaTray.exe.lnk -> C:\Program Files\MagicTune Premium\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk * bootdelete
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837} URL =
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKCU - {02E649DF-A041-4772-B785-75C79A7A0D72} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {07A96013-B16B-46AF-9F89-B67E88FE01E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYAT&apn_uid=3006A785-FFCE-441F-82F6-BFA32953849F&apn_sauid=055E4402-E6FD-4228-AF55-97E7B4268E59
SearchScopes: HKCU - {7273CDE2-F307-001B-7741-61D34380F7EC} URL =
SearchScopes: HKCU - {8E976338-C8F6-42CC-BC14-5486C2850547} URL = hxxp://at.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {C75522F6-5E44-4A99-8EC8-881B32921C90} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
DPF: HKLM-x32 {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} https://univpn.uni-graz.at/+CSCOL+/csvrloader32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{C4FB6DE3-76B7-4AEE-B057-2E580C977068}: [NameServer] 131.130.1.11 131.130.1.12
FireFox:
========
FF ProfilePath: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default
FF Homepage: hxxp://www.default-search.net?sid=498&aid=133&itype=n&ver=13588&tm=430&src=hmp
FF SelectedSearchEngine: default-search.net
FF SearchEngineOrder.1: default-search.net
FF DefaultSearchEngine: default-search.net
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\user.js
FF SearchPlugin: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\Search.xml
FF Extension: No Name - C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\staged [2013-01-27]
FF Extension: Adblock Plus - C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-06]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-11-10]
Chrome:
=======
CHR HomePage: Default -> hxxp://at.msn.com/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.google.at/"
CHR DefaultSearchKeyword: Default -> 86FF71A27EFDF8425255680F0A59B94E599DA29D27152D88A6D213BD4474E14E
CHR DefaultSearchURL: Default -> 5C6BF6FB687AC0872209D6ABD2DE2877FC244D9791AB33D741C989723CC93B45
CHR Profile: C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-28]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-28]
CHR Extension: (Adblock Plus) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-28]
CHR Extension: (Google-Suche) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-28]
CHR Extension: (Google Wallet) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Citavi Picker) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-03-08]
CHR Extension: (Google Mail) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-28]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1811456 2010-08-27] (Realsil Microelectronics Inc.) [File not signed]
R2 McAfeeEngineService; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [19720 2009-10-22] (McAfee, Inc.)
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [103744 2009-08-25] (McAfee, Inc.)
R2 McShield; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe [178920 2009-10-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe [66896 2009-10-22] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [79504 2009-10-22] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ATIAVPCI; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_bda.sys [1565176 2011-01-11] (ATI Technologies Inc.)
S3 AtiIrRcvr; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_hid.sys [32760 2011-01-11] (ATI Technologies Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-09-10] ()
R1 MagicTune; C:\Windows\system32\drivers\MTictwl.sys [23096 2008-11-04] (Samsung Electronics, Inc. )
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [97576 2009-10-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [119968 2009-10-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [469144 2009-10-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [77104 2009-10-22] (McAfee, Inc.)
R1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [83784 2009-10-22] (McAfee, Inc.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-10 22:47 - 2014-09-10 22:49 - 00027488 _____ () C:\Users\xxxxxxx\Desktop\FRST.txt
2014-09-10 22:46 - 2014-09-10 22:46 - 00050477 _____ () C:\Users\xxxxxxx\Downloads\Defogger.exe
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:20 - 2014-09-10 22:47 - 00000000 ____D () C:\FRST
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 22:18 - 00000484 _____ () C:\Users\xxxxxxx\Desktop\defogger_disable.log
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxxx\defogger_reenable
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxxx\Desktop\Defogger.exe
2014-09-10 22:07 - 2014-09-10 22:27 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-10 22:06 - 2014-09-10 22:06 - 11194928 _____ (SurfRight B.V.) C:\Users\xxxxxxx\Downloads\HitmanPro_x64.exe
2014-09-09 23:05 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 23:05 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 23:05 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 23:05 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 23:05 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 23:05 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 23:05 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 23:05 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 23:05 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 23:05 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 23:05 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 23:05 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 23:05 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 23:05 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 23:04 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 23:04 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 23:04 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 23:04 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 23:04 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 23:04 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 23:04 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 23:04 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 23:04 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 22:25 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 22:25 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 22:23 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 22:23 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 22:23 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 22:23 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 22:22 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 22:21 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 22:21 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 22:01 - 2014-09-09 22:05 - 00008965 _____ () C:\Users\xxxxxxx\Documents\sparpotential.xlsx
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-09-08 22:02 - 2014-09-08 22:02 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02 (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00024080 _____ () C:\Users\xxxxxxx\Downloads\drucksch_02.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00013332 _____ () C:\Users\xxxxxxx\Downloads\schuldruck_02.ttf
2014-09-08 21:59 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02.ttf
2014-08-28 16:02 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 16:02 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 16:02 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:34 - 2014-08-22 21:37 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Avery
2014-08-22 21:32 - 2014-08-22 21:32 - 26868072 _____ (Avery Products Corp.) C:\Users\xxxxxxx\Downloads\Avery_Wizard_5_0_0_3026_5_de.exe
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\OTi 5001
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-16 00:28 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:28 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 00:28 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:28 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 00:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 00:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 19:13 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-15 19:13 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-15 19:13 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-15 19:13 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-15 19:13 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 19:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 19:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 19:11 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-15 19:11 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 22:14 - 2014-08-13 22:14 - 00004793 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220559.ics
2014-08-13 22:14 - 2014-08-13 22:14 - 00002320 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220644.csv
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-10 22:49 - 2014-09-10 22:47 - 00027488 _____ () C:\Users\xxxxxxx\Desktop\FRST.txt
2014-09-10 22:47 - 2014-09-10 22:20 - 00000000 ____D () C:\FRST
2014-09-10 22:46 - 2014-09-10 22:46 - 00050477 _____ () C:\Users\xxxxxxx\Downloads\Defogger.exe
2014-09-10 22:44 - 2013-01-28 09:02 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-10 22:44 - 2013-01-28 09:02 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-10 22:44 - 2011-06-08 16:53 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Skype
2014-09-10 22:38 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Spotify
2014-09-10 22:37 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-10 22:37 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-10 22:35 - 2013-02-10 22:18 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Dropbox
2014-09-10 22:35 - 2013-01-16 11:59 - 00000000 ___RD () C:\Users\xxxxxxx\Dropbox
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:30 - 2014-02-02 01:00 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-09-10 22:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-10 22:30 - 2009-07-14 06:51 - 00080526 _____ () C:\Windows\setupact.log
2014-09-10 22:29 - 2014-08-05 09:13 - 00000000 ____D () C:\ProgramData\smdmf
2014-09-10 22:29 - 2011-01-04 19:53 - 01713333 _____ () C:\Windows\WindowsUpdate.log
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:27 - 2014-09-10 22:07 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-10 22:25 - 2012-04-12 11:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 22:18 - 00000484 _____ () C:\Users\xxxxxxx\Desktop\defogger_disable.log
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxxx\defogger_reenable
2014-09-10 22:18 - 2011-05-02 12:43 - 00000000 ____D () C:\Users\xxxxxxx
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxxx\Desktop\Defogger.exe
2014-09-10 22:06 - 2014-09-10 22:06 - 11194928 _____ (SurfRight B.V.) C:\Users\xxxxxxx\Downloads\HitmanPro_x64.exe
2014-09-10 21:58 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Local\Spotify
2014-09-10 21:57 - 2011-06-24 20:35 - 00000000 ____D () C:\QUARANTINE
2014-09-10 21:54 - 2011-01-04 20:06 - 00139418 _____ () C:\Windows\PFRO.log
2014-09-10 21:34 - 2013-01-27 18:37 - 00000000 ____D () C:\ProgramData\SaveByclick
2014-09-10 21:34 - 2013-01-27 18:36 - 00000000 ____D () C:\ProgramData\InstallMate
2014-09-10 21:32 - 2013-01-28 09:03 - 00002218 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-10 21:26 - 2012-04-12 11:03 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 21:26 - 2012-04-12 11:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 21:26 - 2011-06-12 19:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 21:15 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-10 18:46 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-09 23:16 - 2011-05-02 12:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-09 23:03 - 2014-02-26 15:10 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 23:03 - 2009-07-14 19:58 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-09-09 23:03 - 2009-07-14 19:58 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-09-09 23:03 - 2009-07-14 07:13 - 01594964 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-09 23:01 - 2013-09-02 13:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 23:01 - 2013-02-03 08:12 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2014-09-09 22:27 - 2011-05-12 21:15 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 22:25 - 2014-05-07 01:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 22:05 - 2014-09-09 22:01 - 00008965 _____ () C:\Users\xxxxxxx\Documents\sparpotential.xlsx
2014-09-09 22:02 - 2014-02-28 18:14 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Dokumente Scheidung
2014-09-09 13:12 - 2011-05-02 12:46 - 00112912 _____ () C:\Users\xxxxxxx\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 13:09 - 2009-07-14 06:45 - 00418672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 22:48 - 2010-10-21 16:26 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games
2014-09-08 22:47 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\WildTangent
2014-09-08 22:47 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:42 - 2012-07-12 23:11 - 00000000 ____D () C:\ProgramData\ABBYY
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-09-08 22:36 - 2011-08-26 20:44 - 00010770 _____ () C:\ProgramData\hpzinstall.log
2014-09-08 22:34 - 2011-08-26 20:47 - 00000000 ____D () C:\Program Files (x86)\HP
2014-09-08 22:34 - 2011-08-26 20:44 - 00000000 ____D () C:\ProgramData\HP
2014-09-08 22:02 - 2014-09-08 22:02 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02 (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00024080 _____ () C:\Users\xxxxxxx\Downloads\drucksch_02.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00013332 _____ () C:\Users\xxxxxxx\Downloads\schuldruck_02.ttf
2014-09-08 22:00 - 2014-09-08 21:59 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02.ttf
2014-09-08 21:06 - 2011-11-04 12:08 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Local\Paint.NET
2014-09-05 04:10 - 2014-09-09 22:21 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 22:21 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-23 04:07 - 2014-08-28 16:02 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 16:02 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 16:02 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:37 - 2014-08-22 21:34 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Avery
2014-08-22 21:32 - 2014-08-22 21:32 - 26868072 _____ (Avery Products Corp.) C:\Users\xxxxxxx\Downloads\Avery_Wizard_5_0_0_3026_5_de.exe
2014-08-22 08:53 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\Skype
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\OTi 5001
2014-08-19 23:33 - 2014-02-28 23:26 - 00000000 ____D () C:\Users\xxxxxxx\Documents\VISA
2014-08-19 20:05 - 2014-09-09 23:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-09 23:05 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-19 02:30 - 2014-06-16 21:15 - 00000000 ____D () C:\Users\xxxxxxx\Documents\IL3 Website
2014-08-19 02:29 - 2013-11-06 10:30 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Erstes Schreiben
2014-08-19 02:28 - 2014-07-18 23:10 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Neuer Ordner
2014-08-19 01:01 - 2014-09-09 23:05 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-09 23:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-09 23:04 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-09 23:04 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-09 23:04 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-09 23:04 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-09 23:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-09 23:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-09 23:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-09 23:05 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-09 23:05 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-09 23:04 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-09 23:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-09 23:05 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-09 23:05 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-09 23:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-09 23:05 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-09 23:05 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-09 23:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:23 - 2014-09-09 23:04 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:22 - 2014-09-09 23:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-09 23:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-09 23:04 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-09 23:05 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-09 23:04 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-09 23:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-09 23:04 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-09 23:04 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-09 23:05 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:38 - 2014-09-09 23:04 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:36 - 2014-09-09 23:05 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 15:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-17 09:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 16:35 - 2014-07-18 23:27 - 00001042 _____ () C:\Users\xxxxxxx\Desktop\Dropbox.lnk
2014-08-14 16:35 - 2014-07-18 23:26 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-13 22:14 - 2014-08-13 22:14 - 00004793 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220559.ics
2014-08-13 22:14 - 2014-08-13 22:14 - 00002320 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220644.csv
Some content of TEMP:
====================
C:\Users\xxxxxxx\AppData\Local\Temp\ApnStub.exe
C:\Users\xxxxxxx\AppData\Local\Temp\avguidx.dll
C:\Users\xxxxxxx\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\xxxxxxx\AppData\Local\Temp\contentDATs.exe
C:\Users\xxxxxxx\AppData\Local\Temp\csvrelay32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrelay64.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrjavaloader32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrjavaloader64.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrxul32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpazlmbw.dll
C:\Users\xxxxxxx\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\xxxxxxx\AppData\Local\Temp\GenericWndApi.dll
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\xxxxxxx\AppData\Local\Temp\MSNC8AB.exe
C:\Users\xxxxxxx\AppData\Local\Temp\oi_{DC54B024-FDFB-419F-9453-91687BA0691A}.exe
C:\Users\xxxxxxx\AppData\Local\Temp\ose00000.exe
C:\Users\xxxxxxx\AppData\Local\Temp\rtdrvmon.exe
C:\Users\xxxxxxx\AppData\Local\Temp\Samsung_MonSetup_091006.exe
C:\Users\xxxxxxx\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\xxxxxxx\AppData\Local\Temp\SkypeSetup.exe
C:\Users\xxxxxxx\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\xxxxxxx\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\xxxxxxx\AppData\Local\Temp\_isB96F.exe
C:\Users\xxxxxxx\AppData\Local\Temp\{7763A600-5041-472D-B1A9-CB57707C8441}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxxx\AppData\Local\Temp\{E4A67257-FB22-4660-9C49-DE6F0F4E5777}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxxx\AppData\Local\Temp\~convert2007733013507243218.exe
C:\Users\xxxxxxx\AppData\Local\Temp\~convert708054009521529151.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 17:40
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-09-2014
Ran by xxxxxxx at 2014-09-10 22:51:08
Running from C:\Users\xxxxxxx\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: McAfee VirusScan Enterprise (Enabled - Up to date) {86355677-4064-3EA7-ABB3-1B136EB04637}
AS: McAfee VirusScan Enterprise Antispyware Module (Enabled - Up to date) {3D54B793-665E-3129-9103-206115370C8A}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 2.0.3.13070 - Adobe Systems Inc.) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Avery Wizard 5.0 (HKLM-x32\...\{FC3B3A5D-7058-4627-9F1E-F95CC38B6054}) (Version: 5.0.5 - Avery)
Benutzerhandbuch EPSON BX630FW Series (HKLM-x32\...\EPSON BX630FW Series Useg) (Version: - )
BIPA FotoShop (HKLM-x32\...\BIPA FotoShop) (Version: 5.1.5 - CEWE Stiftung u Co. KGaA)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.16(T) - TOSHIBA CORPORATION)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.42 - Broadcom Corporation)
Cinergy T Stick Video HD Driver Installation (64 Bit) (HKLM-x32\...\{59BA9146-A1DB-4C90-B720-3488BBD48777}) (Version: 6.14.10.400 - TERRATEC Electronic GmbH)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04072 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072 - Cisco Systems, Inc.) Hidden
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.4.0.1 - Swiss Academic Software)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.27 - Dropbox, Inc.)
EPSON BX630FW Series Printer Uninstall (HKLM\...\EPSON BX630FW Series) (Version: - SEIKO EPSON Corporation)
Epson Connect Printer Setup (HKLM-x32\...\{D9B1D51B-EB56-410D-AEB5-1CCFAC4B6C8C}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (HKLM-x32\...\{FFF841F3-9A15-4F61-BD16-C19F132E5A27}) (Version: 2.3.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (HKLM-x32\...\{FA9D303D-0FB2-49C7-9397-8E6B11EA892D}) (Version: 2.50.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.20.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (HKLM-x32\...\EPSON PC-FAX Driver 2) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
f4 3.1.0 (HKLM-x32\...\f4) (Version: 3.1.0 - MAXqda)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2086 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
MagicTunePremium (HKLM-x32\...\{79E9C7C5-4FCC-4DFF-B79E-17319E9522F3}) (Version: 4.0.07 - Samsung Electronics Ltd.)
McAfee Agent (HKLM-x32\...\{AA951B10-7089-4D60-B288-516E641F48E6}) (Version: 4.0.0.1496 - McAfee, Inc.)
McAfee AntiSpyware Enterprise Module (HKLM-x32\...\McAfee Anti-Spyware Enterprise Module) (Version: 8.7.0.129 - McAfee, Inc.)
McAfee VirusScan Enterprise (HKLM-x32\...\{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}) (Version: 8.7.0 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MT2.5_RAFF (HKLM-x32\...\{EEB41F26-E9FC-4430-843F-AAD8553EAF72}) (Version: 1.00.0000 - )
Nero 10 Movie ThemePack Basic (x32 Version: 10.0.10600.6.0 - Nero AG) Hidden
Nero BackItUp 10 (HKLM-x32\...\{68AB6930-5BFF-4FF6-923B-516A91984FE6}) (Version: 5.4.24700.31.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.0.11300.14.100 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.2.200.0.2 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.16800.7.15 - Nero AG) Hidden
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.0.12100.22.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.0.11400.15.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero MediaHub 10 (HKLM-x32\...\{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}) (Version: 1.0.14800.28.100 - Nero AG)
Nero MediaHub 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{0FF68F26-416C-4954-ACA5-6AD5F9DE99C1}) (Version: 10.0.15000 - Nero AG)
Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.0.11800.26.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.0.12300.27.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 1.0.10900 - Nero AG) Hidden
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
Netzwerkhandbuch EPSON BX630FW Series (HKLM-x32\...\EPSON BX630FW Series Netg) (Version: - )
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.28.924.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30111 - Realtek Semiconductor Corp.)
Samsung_MonSetup (HKLM-x32\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.12.10.g89b2a4fc - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.01.00 - TOSHIBA CORPORATION)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.08.64 - TOSHIBA Corporation)
TOSHIBA Bulletin Board (Version: 1.6.08.64 - TOSHIBA Corporation) Hidden
TOSHIBA ConfigFree (HKLM-x32\...\{E0FAA369-B0E3-48B8-9447-4873103B0012}) (Version: 8.0.33 - TOSHIBA CORPORATION)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.3.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (Version: 3.1.3.64 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (HKLM-x32\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.11C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.11C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.27C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.27C - TOSHIBA CORPORATION) Hidden
TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.6 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.02 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.80.8.64 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.11 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 2.09.0001 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.5 x64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.16.64 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.7.16.64 - TOSHIBA Corporation) Hidden
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
TOSHIBA Supervisor Password (x32 Version: 1.63.0.10C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM-x32\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.10C - TOSHIBA CORPORATION)
Toshiba TEMPRO (HKLM-x32\...\{DBB7021A-3437-446F-ACE5-7261644A972C}) (Version: 3.33 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.3.19.64 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.3.19.64 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.3.19.64 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.16 - TOSHIBA Corporation)
TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - )
TRORMCLauncher (Version: 1.0.0.10 - TOSHIBA) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Utility Common Driver (x32 Version: 1.0.52.2C - TOSHIBA) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - TERRATEC (ATIAVPCI) Media (07/28/2010 6.14.10.400) (HKLM\...\726BA9CEACD4CE33EAF2782873664D94ACE1041C) (Version: 07/28/2010 6.14.10.400 - TERRATEC )
Windows-Treiberpaket - TERRATEC (AtiIrRcvr) HIDClass (10/06/2009 6.14.10.393) (HKLM\...\F9CAEBCDABB29F58BE8C796268ABF547936EF2C7) (Version: 10/06/2009 6.14.10.393 - TERRATEC )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}\InprocServer32 -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\sys\x64\TosBtExt.dll (TOSHIBA)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1576544144-1309573009-1586081336-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
22-08-2014 19:33:09 Avery Wizard 5.0 wurde installiert.
28-08-2014 20:04:57 Windows Update
06-09-2014 15:48:34 Geplanter Prüfpunkt
08-09-2014 20:37:58 Removed PDF Architect
08-09-2014 20:40:51 Removed HP Update.
08-09-2014 20:43:58 Removed pdfforge Toolbar v6.2.
09-09-2014 20:24:48 Windows Update
10-09-2014 20:21:31 Prüfpunkt von HitmanPro
10-09-2014 20:26:07 Prüfpunkt von HitmanPro
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {620ED9C2-4DDA-4BF1-B3C6-E730DA8DEE1C} - System32\Tasks\{4223C4A3-543A-4F82-A684-FBBB0938A053} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.)
Task: {79499D78-D345-4D64-B56D-B35BD9ED2221} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {7A5B2EA5-FBE2-4E4D-8B77-CDD042A59B1D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {87EEA72F-E5C4-44EA-B128-19CBE8EF7D8D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28] (Google Inc.)
Task: {D0856E19-88ED-4F89-BF78-F603E582FB94} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-28] (Google Inc.)
Task: {F1B31A5B-6E0E-4615-A82C-84C4D3020C2E} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-06-03] (TOSHIBA CORPORATION)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-10-22 20:07 - 2009-10-22 20:07 - 00140288 _____ () C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\VsEvntUI.dll
2010-04-23 13:58 - 2010-04-23 13:58 - 03409256 _____ () C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll
2010-04-07 17:07 - 2010-04-07 17:07 - 09468728 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2009-11-03 14:26 - 2009-11-03 14:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 15:15 - 2010-03-03 15:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 15:15 - 2010-03-03 15:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-10-21 16:06 - 2010-08-31 15:21 - 00017272 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2009-03-12 20:08 - 2009-03-12 20:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 17:38 - 2009-07-25 17:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2011-12-16 11:36 - 2004-07-02 18:15 - 00036864 _____ () C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe
2014-01-28 22:12 - 2014-08-29 23:09 - 00610872 _____ () C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2010-02-05 18:44 - 2010-02-05 18:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-10-10 23:48 - 2013-10-10 23:48 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2005-08-22 16:38 - 2005-08-22 16:38 - 03264512 _____ () C:\Program Files (x86)\McAfee\Common Framework\cryptocme2.dll
2009-08-25 16:00 - 2009-08-25 16:00 - 00057344 _____ () C:\Program Files (x86)\McAfee\Common Framework\boost_thread-vc71-mt-1_32.dll
2014-01-28 22:12 - 2014-08-29 23:10 - 36966968 _____ () C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\libcef.dll
2014-09-10 22:34 - 2014-09-10 22:34 - 00043008 _____ () c:\Users\xxxxxxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpazlmbw.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\libcef.dll
2009-07-13 23:03 - 2009-07-14 03:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2014-07-18 21:33 - 2014-08-29 23:10 - 00867896 _____ () C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\ffmpegsumo.dll
2014-01-28 22:12 - 2014-08-29 23:10 - 00886840 _____ () C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\libglesv2.dll
2014-01-28 22:12 - 2014-08-29 23:10 - 00108600 _____ () C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\libegl.dll
2014-09-10 21:31 - 2014-09-04 05:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll
2014-09-10 21:31 - 2014-09-04 05:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll
2014-09-10 21:31 - 2014-09-04 05:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll
2014-09-10 21:31 - 2014-09-04 05:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll
2014-09-10 21:31 - 2014-09-04 05:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/10/2014 10:33:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MagicTune.exe, Version: 1.0.0.1, Zeitstempel: 0x4cca62fb
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c4102
ID des fehlerhaften Prozesses: 0xedc
Startzeit der fehlerhaften Anwendung: 0xMagicTune.exe0
Pfad der fehlerhaften Anwendung: MagicTune.exe1
Pfad des fehlerhaften Moduls: MagicTune.exe2
Berichtskennung: MagicTune.exe3
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000001dc,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,000000000154EFB0.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000002b8,(null),0,REG_BINARY,0000000001C4E250.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {7734cbe7-a102-4f4e-a357-29da64dee1d7}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000002b8,(null),0,REG_BINARY,0000000001C4E250.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {7734cbe7-a102-4f4e-a357-29da64dee1d7}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000007a0,(null),0,REG_BINARY,000000000295E430.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Generatorname: WMI Writer
Generatorinstanz-ID: {a46dc365-47ef-4147-b9b1-b71655789526}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000a38,(null),0,REG_BINARY,00000000049FE510.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Generatorname: MSSearch Service Writer
Generatorinstanz-ID: {1b92d736-c7c2-4bea-9d28-aa54508d5ee2}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000007a0,(null),0,REG_BINARY,000000000295E430.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Generatorname: WMI Writer
Generatorinstanz-ID: {a46dc365-47ef-4147-b9b1-b71655789526}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000200,SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer,0,REG_BINARY,000000000116E7E0.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Generatorname: Shadow Copy Optimization Writer
Generatorinstanz-ID: {90a82fef-7df8-455d-bc12-e99446981839}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000001c0,SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer,0,REG_BINARY,000000000249EEE0.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Generatorname: Registry Writer
Generatorinstanz-ID: {5e8f66ac-9798-41b5-9433-7dc3bb9a144b}
Error: (09/10/2014 10:27:27 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000001c8,SYSTEM\CurrentControlSet\Services\VSS\Diag\COM+ REGDB Writer,0,REG_BINARY,000000000171F240.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Generatorname: COM+ REGDB Writer
Generatorinstanz-ID: {2985d134-a8ec-4f9c-8bd7-c9f8d0bbaf3b}
System errors:
=============
Error: (09/10/2014 10:30:50 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem Fehler beendet: %%0.
Error: (09/10/2014 10:30:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SmdmF Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/10/2014 10:26:59 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "DeleteFlag" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (09/10/2014 10:26:55 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "DeleteFlag" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (09/10/2014 10:08:22 PM) (Source: iaStor) (EventID: 9) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.
Error: (09/10/2014 09:56:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "McAfee Task Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/10/2014 09:56:20 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.
Error: (09/10/2014 09:36:03 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "McAfee McShield" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/10/2014 09:35:59 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst McShield erreicht.
Error: (09/10/2014 09:35:29 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst McShield erreicht.
Microsoft Office Sessions:
=========================
Error: (04/10/2012 01:38:06 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 377 seconds with 360 seconds of active time. This session ended with a crash.
Error: (04/10/2012 01:31:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1482 seconds with 1320 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T6670 @ 2.20GHz
Percentage of memory in use: 84%
Total physical RAM: 1912.88 MB
Available physical RAM: 302.25 MB
Total Pagefile: 3825.76 MB
Available Pagefile: 1292.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: (WINDOWS) (Fixed) (Total:149.04 GB) (Free:58.05 GB) NTFS
Drive d: (Data) (Fixed) (Total:148.65 GB) (Free:134.32 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 873E49CA)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=148.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-10 23:00:02
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GH10 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\GERDEN~1\AppData\Local\Temp\pxldqpog.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:2216] 0000000075497587
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:2288] 00000000738c7712
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:2568] 00000000778e2e65
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:3560] 00000000778e3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:4536] 00000000778e3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [612:5456] 00000000778e3e85
---- Processes - GMER 2.1 ----
Library C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe [4808](2014-07-30 00:20:20) 0000000003da0000
Library c:\users\gerden~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpazlmbw.dll (*** suspicious ***) @ C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe [4808](2014-09-10 20:34:53) 0000000003b00000
Library C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe [4808](2013-08-23 19:01:44) 0000000066890000
Library C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe [4808] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000065f00000
---- EOF - GMER 2.1 ----
Schöne Grüße, CG Geändert von cgerdenit (10.09.2014 um 22:40 Uhr) Grund: Log-Files noch nicht eingefügt gewesen... |
|
11.09.2014, 06:46
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: McAfee arlarmiert wegen Settings Manager hi,
__________________Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
11.09.2014, 17:27
| #3 |
| | Windows 7: McAfee arlarmiert wegen Settings Manager Hallo!
__________________Vielen Dank für die rasche Antwort. Hier die LogFiles: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 11.09.2014 Suchlauf-Zeit: 17:14:44 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.11.04 Rootkit Datenbank: v2014.09.10.02 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: xxxxxxx Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 388427 Verstrichene Zeit: 34 Min, 34 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 9 PUP.Optional.FunMoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}, In Quarantäne, [b8a838b423586bcb961100957191837d], PUP.Optional.FunMoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}, In Quarantäne, [b8a838b423586bcb961100957191837d], PUP.Optional.FunMoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}, In Quarantäne, [b8a838b423586bcb961100957191837d], PUP.Optional.Funmoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, In Quarantäne, [74ec6e7e5c1f261044b2575f837fac54], PUP.Optional.Funmoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, In Quarantäne, [74ec6e7e5c1f261044b2575f837fac54], PUP.Optional.Funmoods.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}, In Quarantäne, [74ec6e7e5c1f261044b2575f837fac54], PUP.Optional.SettingsManager.A, HKLM\SOFTWARE\WOW6432NODE\SmdmF, In Quarantäne, [63fdb23a09725cda1dbdc738f111748c], PUP.Optional.SProtector.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SProtector, In Quarantäne, [ea7602ea0f6c9f972a9a4204c440718f], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [9ac61ece2655b284fb4f8eb67391fa06], Registrierungswerte: 3 PUP.Optional.SettingsManager, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\APPCERTDLLS|x64, c:\program files (x86)\settings manager\smdmf\x64\sysapcrt.dll, In Quarantäne, [b4ac1fcd0d6ef93d83e0bc4755aeab55] PUP.Optional.SettingsManager, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER\APPCERTDLLS|x86, c:\program files (x86)\settings manager\smdmf\sysapcrt.dll, In Quarantäne, [68f8f4f8b2c99a9c4a190cf70300a45c] PUP.Optional.InstallCore.A, HKU\S-1-5-21-1576544144-1309573009-1586081336-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0B1L1J1F2X1U1BzxtF0A, In Quarantäne, [9ac61ece2655b284fb4f8eb67391fa06] Registrierungsdaten: 0 (No malicious items detected) Ordner: 6 PUP.Optional.SaveByClick.A, C:\ProgramData\SaveByclick, In Quarantäne, [86da0fddaccfaa8c294c03e0cb3720e0], PUP.Optional.SaveByClick.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick, In Quarantäne, [243c38b47ffc60d673ebb03a0ef42ad6], PUP.Optional.SettingsManager.A, C:\Program Files (x86)\Settings Manager\smdmf, In Quarantäne, [a1bfdb1192e91521cfba4e9c80829e62], PUP.Optional.SettingsManager.A, C:\Program Files (x86)\Settings Manager\smdmf\x64, In Quarantäne, [a1bfdb1192e91521cfba4e9c80829e62], PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf, In Quarantäne, [0c546c80a1da75c1a3966987c14118e8], PUP.Optional.SettingsManager.A, C:\Users\xxxxxxx\AppData\Roaming\FirefoxToolbar\Settings Manager, In Quarantäne, [c29ee10b037849eda892618fdb272ed2], Dateien: 12 PUP.Optional.Spigot.A, C:\Users\xxxxxxx\AppData\Local\Temp\SearchSettings.exe.8713607, In Quarantäne, [431d33b9c7b459dd446617a3a25faa56], PUP.Optional.Dealply, C:\Users\xxxxxxx\AppData\Local\Temp\is357113909\dealply.exe, In Quarantäne, [d888c329710af046f98bf7271ee70cf4], PUP.Optional.SaveByClick.A, C:\ProgramData\SaveByclick\510556f9dd6e0.dll, In Quarantäne, [86da0fddaccfaa8c294c03e0cb3720e0], PUP.Optional.SaveByClick.A, C:\ProgramData\SaveByclick\510556f9dd6e0.tlb, In Quarantäne, [86da0fddaccfaa8c294c03e0cb3720e0], PUP.Optional.SaveByClick.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick\SaveByclick.lnk, In Quarantäne, [243c38b47ffc60d673ebb03a0ef42ad6], PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf\coordinator.cfg, In Quarantäne, [0c546c80a1da75c1a3966987c14118e8], PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf\general.cfg, In Quarantäne, [0c546c80a1da75c1a3966987c14118e8], PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf\S-1-5-21-1576544144-1309573009-1586081336-1000.cfg, In Quarantäne, [0c546c80a1da75c1a3966987c14118e8], PUP.Optional.SettingsManager.A, C:\ProgramData\smdmf\S-1-5-32.cfg, In Quarantäne, [0c546c80a1da75c1a3966987c14118e8], PUP.Optional.DefaultSearch, C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.defaultenginename", "default-search.net");), Ersetzt,[f868f0fccead8bab5671a6843dc836ca] PUP.Optional.DefaultSearch, C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.selectedEngine", "default-search.net");), Ersetzt,[6ef26686d7a4c472a52365c53ec709f7] PUP.Optional.DefaultSearch.A, C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.default-search.net?sid=498&aid=133&itype=n&ver=13588&tm=430&src=hmp");), Ersetzt,[99c73cb04437e94dc415ad7eed18b24e] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 11/09/2014 um 18:08:03
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : xxxxxxx - CLAUDIA
# Gestartet von : C:\Users\xxxxxxx\Desktop\adwcleaner_3.309.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ClickIT
Ordner Gelöscht : C:\Program Files (x86)\Settings Manager
[/!\] Nicht Gelöscht ( Junction ) : C:\Program Files\Gemeinsame Dateien
Ordner Gelöscht : C:\Users\GERDEN~1\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\FirefoxToolbar
Ordner Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\pdfforge@mybrowserbar.com
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\wtxpcom@mybrowserbar.com
Datei Gelöscht : C:\Users\GERDEN~1\AppData\Local\Temp\Uninstall.exe
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\searchplugins\search.xml
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\user.js
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage
Datei Gelöscht : C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsLatest_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsLatest_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_661c9f97
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\SP Global
Schlüssel Gelöscht : HKLM\SOFTWARE\SProtector
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v
[ Datei : C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.order.1", "default-search.net");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
-\\ Google Chrome v37.0.2062.120
[ Datei : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://www.bikester.at/index.php?id=390&strSearchQuery={searchTerms}
Gelöscht [Extension] : bbjciahceamgodcoidkjpchnokgfpphh
Gelöscht [Extension] : cjpglkicenollcignonpgiafdgfeehoj
*************************
AdwCleaner[R0].txt - [5923 octets] - [11/09/2014 18:04:55]
AdwCleaner[S0].txt - [5780 octets] - [11/09/2014 18:08:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5840 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by xxxxxx on 11.09.2014 at 18:19:23,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{07A96013-B16B-46AF-9F89-B67E88FE01E0}
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{08716742-EDA0-48E5-90B3-910460C94A7B}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{0F7B492B-BC7D-40E1-87A5-92BEE24E4F78}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{19EFFCCF-557B-433E-B8C9-9478346B05A4}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{26C09E75-B541-4C31-94EE-984F1F7A7A41}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{54188390-DB4B-4C19-B02A-5D4696DFD9D5}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{6BE2585C-F76E-43E5-A189-2907BC5AB13E}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{81345429-42BA-4393-B217-4AF367D76DEC}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{94283AFD-96BF-469B-A1BA-345D20F50053}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{95E2399F-5845-4A4C-B13F-54479B828C27}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{9985B5A6-6E39-4D2D-B29E-57AB8988A5A0}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{9BDF0D13-75FB-4F92-BB7E-AED92B49028F}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{9E91DCC9-DE4D-43AF-B1DF-3FC38DE99BBA}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{A821D0F8-ED16-4EBA-BFFE-B21F065EECFF}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{C3186E61-478D-4EDC-8B2C-FFF8A54431C1}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{C94494B6-7B9C-4466-9C65-0E0C7931A99F}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{E7C2537F-0375-49CC-A252-9D6373626438}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{EB060C67-C37D-48AA-BBB1-76EA7CDB87D2}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{ED5688CD-2390-481C-979C-36311FB5DDBB}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{F319139F-574C-4AAA-916F-DEB1CEDE796A}
Successfully deleted: [Empty Folder] C:\Users\xxxxxx\appdata\local\{F364C044-8734-4231-86B4-BB98FE462F21}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.09.2014 at 18:28:45,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-09-2014
Ran by xxxxxxx (administrator) on CLAUDIA on 11-09-2014 18:29:19
Running from C:\Users\xxxxxxx\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Toshiba Europe GmbH) C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\xxxxxxx\AppData\Roaming\Spotify\spotify.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHWE.EXE
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
() C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXSTM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
() C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-07-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM\...\Run: [MagicTuneEngine] => C:\Program Files\MagicTune Premium\MagicTuneLauncher.exe [53760 2010-10-29] ()
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [NBAgent] => c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-09-02] (Nero AG)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [SVPWUTIL] => C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-03-03] (TOSHIBA)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-15] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294136 2009-10-06] (TOSHIBA Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [136512 2009-08-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [124240 2009-10-22] (McAfee, Inc.)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\.DEFAULT\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Badoo Desktop] => C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify Web Helper] => C:\Users\xxxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify] => C:\Users\xxxxxxx\AppData\Roaming\Spotify\spotify.exe [6621752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHWE.EXE [241280 2014-01-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\MountPoints2: {48f74f1e-28aa-11e4-a5aa-806e6f6e6963} - F:\EzODDPlus.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibration.lnk
ShortcutTarget: Color Calibration.lnk -> C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.exe.lnk
ShortcutTarget: GammaTray.exe.lnk -> C:\Program Files\MagicTune Premium\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk * bootdelete
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKCU - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKCU - {02E649DF-A041-4772-B785-75C79A7A0D72} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {7273CDE2-F307-001B-7741-61D34380F7EC} URL =
SearchScopes: HKCU - {8E976338-C8F6-42CC-BC14-5486C2850547} URL = hxxp://at.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {C75522F6-5E44-4A99-8EC8-881B32921C90} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
DPF: HKLM-x32 {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} https://univpn.uni-graz.at/+CSCOL+/csvrloader32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{C4FB6DE3-76B7-4AEE-B057-2E580C977068}: [NameServer] 131.130.1.11 131.130.1.12
FireFox:
========
FF ProfilePath: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\staged [2013-01-27]
FF Extension: Adblock Plus - C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-06]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-11-10]
Chrome:
=======
CHR HomePage: Default -> hxxp://at.msn.com/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.google.at/"
CHR DefaultSearchKeyword: Default -> 86FF71A27EFDF8425255680F0A59B94E599DA29D27152D88A6D213BD4474E14E
CHR DefaultSearchURL: Default -> 5C6BF6FB687AC0872209D6ABD2DE2877FC244D9791AB33D741C989723CC93B45
CHR Profile: C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-28]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-28]
CHR Extension: (Adblock Plus) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-28]
CHR Extension: (Google-Suche) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-28]
CHR Extension: (Google Wallet) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Citavi Picker) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-03-08]
CHR Extension: (Google Mail) - C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-28]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1811456 2010-08-27] (Realsil Microelectronics Inc.) [File not signed]
R2 McAfeeEngineService; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [19720 2009-10-22] (McAfee, Inc.)
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [103744 2009-08-25] (McAfee, Inc.)
U2 McShield; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe [178920 2009-10-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe [66896 2009-10-22] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [79504 2009-10-22] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ATIAVPCI; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_bda.sys [1565176 2011-01-11] (ATI Technologies Inc.)
S3 AtiIrRcvr; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_hid.sys [32760 2011-01-11] (ATI Technologies Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-09-10] ()
R1 MagicTune; C:\Windows\system32\drivers\MTictwl.sys [23096 2008-11-04] (Samsung Electronics, Inc. )
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [97576 2009-10-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [119968 2009-10-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [469144 2009-10-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [77104 2009-10-22] (McAfee, Inc.)
R1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [83784 2009-10-22] (McAfee, Inc.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-11 18:28 - 2014-09-11 18:29 - 00002915 _____ () C:\Users\xxxxxxx\Desktop\JRT.txt
2014-09-11 18:19 - 2014-09-11 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-09-11 18:17 - 2014-09-11 18:17 - 01016261 _____ (Thisisu) C:\Users\xxxxxxx\Desktop\JRT.exe
2014-09-11 18:11 - 2014-09-11 18:13 - 00005900 _____ () C:\Users\xxxxxxx\Desktop\AdwCleaner[S0].txt
2014-09-11 18:07 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-11 18:04 - 2014-09-11 18:08 - 00000000 ____D () C:\AdwCleaner
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxxx\Downloads\adwcleaner_3.309 (1).exe
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxxx\Desktop\adwcleaner_3.309.exe
2014-09-11 18:01 - 2014-09-11 18:12 - 00006571 _____ () C:\Users\xxxxxxx\Desktop\mbam.txt
2014-09-11 17:13 - 2014-09-11 17:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-11 17:13 - 2014-09-11 17:13 - 00001073 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-11 17:13 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-11 17:13 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-11 17:12 - 2014-09-11 17:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxxxxx\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-10 23:00 - 2014-09-10 23:11 - 00002829 _____ () C:\Users\xxxxxxx\Desktop\gmer.txt
2014-09-10 22:54 - 2014-09-10 22:53 - 00380416 _____ () C:\Users\xxxxxxx\Desktop\Gmer-19357.exe
2014-09-10 22:53 - 2014-09-10 22:53 - 00380416 _____ () C:\Users\xxxxxxx\Downloads\Gmer-19357.exe
2014-09-10 22:51 - 2014-09-10 23:11 - 00041968 _____ () C:\Users\xxxxxxx\Desktop\Addition.txt
2014-09-10 22:47 - 2014-09-11 18:29 - 00025516 _____ () C:\Users\xxxxxxx\Desktop\FRST.txt
2014-09-10 22:46 - 2014-09-10 22:46 - 00050477 _____ () C:\Users\xxxxxxx\Downloads\Defogger.exe
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:20 - 2014-09-11 18:29 - 00000000 ____D () C:\FRST
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 23:09 - 00000474 _____ () C:\Users\xxxxxxx\Desktop\defogger_disable.log
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxxx\defogger_reenable
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxxx\Desktop\Defogger.exe
2014-09-10 22:07 - 2014-09-10 22:27 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-10 22:06 - 2014-09-10 22:06 - 11194928 _____ (SurfRight B.V.) C:\Users\xxxxxxx\Downloads\HitmanPro_x64.exe
2014-09-09 23:05 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 23:05 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 23:05 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 23:05 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 23:05 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 23:05 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 23:05 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 23:05 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 23:05 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 23:05 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 23:05 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 23:05 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 23:05 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 23:05 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 23:04 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 23:04 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 23:04 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 23:04 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 23:04 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 23:04 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 23:04 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 23:04 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 23:04 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 22:25 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 22:25 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 22:23 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 22:23 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 22:23 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 22:23 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 22:22 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 22:21 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 22:21 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 22:01 - 2014-09-09 22:05 - 00008965 _____ () C:\Users\xxxxxxx\Documents\sparpotential.xlsx
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-09-08 22:02 - 2014-09-08 22:02 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02 (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00024080 _____ () C:\Users\xxxxxxx\Downloads\drucksch_02.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00013332 _____ () C:\Users\xxxxxxx\Downloads\schuldruck_02.ttf
2014-09-08 21:59 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02.ttf
2014-08-28 16:02 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 16:02 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 16:02 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:34 - 2014-08-22 21:37 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Avery
2014-08-22 21:32 - 2014-08-22 21:32 - 26868072 _____ (Avery Products Corp.) C:\Users\xxxxxxx\Downloads\Avery_Wizard_5_0_0_3026_5_de.exe
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\OTi 5001
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-16 00:28 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:28 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 00:28 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:28 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 00:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 00:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 19:13 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-15 19:13 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-15 19:13 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-15 19:13 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-15 19:13 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 19:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 19:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 19:11 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-15 19:11 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 22:14 - 2014-08-13 22:14 - 00004793 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220559.ics
2014-08-13 22:14 - 2014-08-13 22:14 - 00002320 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220644.csv
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-11 18:31 - 2014-09-10 22:47 - 00025516 _____ () C:\Users\xxxxxxx\Desktop\FRST.txt
2014-09-11 18:31 - 2011-06-08 16:53 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Skype
2014-09-11 18:29 - 2014-09-11 18:28 - 00002915 _____ () C:\Users\xxxxxxx\Desktop\JRT.txt
2014-09-11 18:29 - 2014-09-10 22:20 - 00000000 ____D () C:\FRST
2014-09-11 18:25 - 2012-04-12 11:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-11 18:19 - 2014-09-11 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-09-11 18:19 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-11 18:19 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-11 18:17 - 2014-09-11 18:17 - 01016261 _____ (Thisisu) C:\Users\xxxxxxx\Desktop\JRT.exe
2014-09-11 18:16 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Spotify
2014-09-11 18:13 - 2014-09-11 18:11 - 00005900 _____ () C:\Users\xxxxxxx\Desktop\AdwCleaner[S0].txt
2014-09-11 18:13 - 2013-02-10 22:18 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Dropbox
2014-09-11 18:13 - 2013-01-16 11:59 - 00000000 ___RD () C:\Users\xxxxxxx\Dropbox
2014-09-11 18:12 - 2014-09-11 18:01 - 00006571 _____ () C:\Users\xxxxxxx\Desktop\mbam.txt
2014-09-11 18:10 - 2014-02-02 01:00 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-09-11 18:10 - 2013-01-28 09:02 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-11 18:10 - 2011-01-04 20:06 - 00143660 _____ () C:\Windows\PFRO.log
2014-09-11 18:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-11 18:10 - 2009-07-14 06:51 - 00080694 _____ () C:\Windows\setupact.log
2014-09-11 18:09 - 2011-01-04 19:53 - 01763065 _____ () C:\Windows\WindowsUpdate.log
2014-09-11 18:08 - 2014-09-11 18:04 - 00000000 ____D () C:\AdwCleaner
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxxx\Downloads\adwcleaner_3.309 (1).exe
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxxx\Desktop\adwcleaner_3.309.exe
2014-09-11 17:57 - 2014-09-11 17:13 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-11 17:49 - 2010-10-21 16:22 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-09-11 17:45 - 2013-01-28 09:02 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-11 17:13 - 2014-09-11 17:13 - 00001073 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-11 17:12 - 2014-09-11 17:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\xxxxxxx\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-10 23:11 - 2014-09-10 23:00 - 00002829 _____ () C:\Users\xxxxxxx\Desktop\gmer.txt
2014-09-10 23:11 - 2014-09-10 22:51 - 00041968 _____ () C:\Users\xxxxxxx\Desktop\Addition.txt
2014-09-10 23:09 - 2014-09-10 22:18 - 00000474 _____ () C:\Users\xxxxxxx\Desktop\defogger_disable.log
2014-09-10 22:53 - 2014-09-10 22:54 - 00380416 _____ () C:\Users\xxxxxxx\Desktop\Gmer-19357.exe
2014-09-10 22:53 - 2014-09-10 22:53 - 00380416 _____ () C:\Users\xxxxxxx\Downloads\Gmer-19357.exe
2014-09-10 22:46 - 2014-09-10 22:46 - 00050477 _____ () C:\Users\xxxxxxx\Downloads\Defogger.exe
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:27 - 2014-09-10 22:07 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxxx\defogger_reenable
2014-09-10 22:18 - 2011-05-02 12:43 - 00000000 ____D () C:\Users\xxxxxxx
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxxx\Desktop\Defogger.exe
2014-09-10 22:06 - 2014-09-10 22:06 - 11194928 _____ (SurfRight B.V.) C:\Users\xxxxxxx\Downloads\HitmanPro_x64.exe
2014-09-10 21:58 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Local\Spotify
2014-09-10 21:57 - 2011-06-24 20:35 - 00000000 ____D () C:\QUARANTINE
2014-09-10 21:34 - 2013-01-27 18:36 - 00000000 ____D () C:\ProgramData\InstallMate
2014-09-10 21:32 - 2013-01-28 09:03 - 00002218 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-10 21:26 - 2012-04-12 11:03 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 21:26 - 2012-04-12 11:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 21:26 - 2011-06-12 19:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 21:15 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-10 18:46 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-09 23:16 - 2011-05-02 12:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-09 23:03 - 2014-02-26 15:10 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 23:03 - 2009-07-14 19:58 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-09-09 23:03 - 2009-07-14 19:58 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-09-09 23:03 - 2009-07-14 07:13 - 01594964 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-09 23:01 - 2013-09-02 13:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 23:01 - 2013-02-03 08:12 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2014-09-09 22:27 - 2011-05-12 21:15 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 22:25 - 2014-05-07 01:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 22:05 - 2014-09-09 22:01 - 00008965 _____ () C:\Users\xxxxxxx\Documents\sparpotential.xlsx
2014-09-09 22:02 - 2014-02-28 18:14 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Dokumente Scheidung
2014-09-09 13:12 - 2011-05-02 12:46 - 00112912 _____ () C:\Users\xxxxxxx\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 13:09 - 2009-07-14 06:45 - 00418672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 22:48 - 2010-10-21 16:26 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games
2014-09-08 22:47 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\WildTangent
2014-09-08 22:47 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:42 - 2012-07-12 23:11 - 00000000 ____D () C:\ProgramData\ABBYY
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-09-08 22:36 - 2011-08-26 20:44 - 00010770 _____ () C:\ProgramData\hpzinstall.log
2014-09-08 22:34 - 2011-08-26 20:47 - 00000000 ____D () C:\Program Files (x86)\HP
2014-09-08 22:34 - 2011-08-26 20:44 - 00000000 ____D () C:\ProgramData\HP
2014-09-08 22:02 - 2014-09-08 22:02 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02 (1).ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00035432 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02R.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00024080 _____ () C:\Users\xxxxxxx\Downloads\drucksch_02.ttf
2014-09-08 22:00 - 2014-09-08 22:00 - 00013332 _____ () C:\Users\xxxxxxx\Downloads\schuldruck_02.ttf
2014-09-08 22:00 - 2014-09-08 21:59 - 00037216 _____ () C:\Users\xxxxxxx\Downloads\schulsch_02.ttf
2014-09-08 21:06 - 2011-11-04 12:08 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Local\Paint.NET
2014-09-05 04:10 - 2014-09-09 22:21 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 22:21 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-23 04:07 - 2014-08-28 16:02 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 16:02 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 16:02 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:37 - 2014-08-22 21:34 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Avery
2014-08-22 21:32 - 2014-08-22 21:32 - 26868072 _____ (Avery Products Corp.) C:\Users\xxxxxxx\Downloads\Avery_Wizard_5_0_0_3026_5_de.exe
2014-08-22 08:53 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\Skype
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\OTi 5001
2014-08-19 23:33 - 2014-02-28 23:26 - 00000000 ____D () C:\Users\xxxxxxx\Documents\VISA
2014-08-19 20:05 - 2014-09-09 23:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-09 23:05 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-19 02:30 - 2014-06-16 21:15 - 00000000 ____D () C:\Users\xxxxxxx\Documents\IL3 Website
2014-08-19 02:29 - 2013-11-06 10:30 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Erstes Schreiben
2014-08-19 02:28 - 2014-07-18 23:10 - 00000000 ____D () C:\Users\xxxxxxx\Documents\Neuer Ordner
2014-08-19 01:01 - 2014-09-09 23:05 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-09 23:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-09 23:04 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-09 23:04 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-09 23:04 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-09 23:04 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-09 23:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-09 23:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-09 23:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-09 23:05 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-09 23:05 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-09 23:04 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-09 23:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-09 23:05 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-09 23:05 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-09 23:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-09 23:05 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-09 23:05 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-09 23:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:23 - 2014-09-09 23:04 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:22 - 2014-09-09 23:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-09 23:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-09 23:04 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-09 23:05 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-09 23:04 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-09 23:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-09 23:04 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-09 23:04 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-09 23:05 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:38 - 2014-09-09 23:04 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:36 - 2014-09-09 23:05 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 15:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-17 09:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 16:35 - 2014-07-18 23:27 - 00001042 _____ () C:\Users\xxxxxxx\Desktop\Dropbox.lnk
2014-08-14 16:35 - 2014-07-18 23:26 - 00000000 ____D () C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-13 22:14 - 2014-08-13 22:14 - 00004793 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220559.ics
2014-08-13 22:14 - 2014-08-13 22:14 - 00002320 _____ () C:\Users\xxxxxxx\Downloads\export_20140813_220644.csv
Some content of TEMP:
====================
C:\Users\xxxxxxx\AppData\Local\Temp\ApnStub.exe
C:\Users\xxxxxxx\AppData\Local\Temp\avguidx.dll
C:\Users\xxxxxxx\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\xxxxxxx\AppData\Local\Temp\contentDATs.exe
C:\Users\xxxxxxx\AppData\Local\Temp\csvrelay32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrelay64.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrjavaloader32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrjavaloader64.dll
C:\Users\xxxxxxx\AppData\Local\Temp\csvrxul32.dll
C:\Users\xxxxxxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp1eqf07.dll
C:\Users\xxxxxxx\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\xxxxxxx\AppData\Local\Temp\GenericWndApi.dll
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\xxxxxxx\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\xxxxxxx\AppData\Local\Temp\MSNC8AB.exe
C:\Users\xxxxxxx\AppData\Local\Temp\oi_{DC54B024-FDFB-419F-9453-91687BA0691A}.exe
C:\Users\xxxxxxx\AppData\Local\Temp\ose00000.exe
C:\Users\xxxxxxx\AppData\Local\Temp\Quarantine.exe
C:\Users\xxxxxxx\AppData\Local\Temp\rtdrvmon.exe
C:\Users\xxxxxxx\AppData\Local\Temp\Samsung_MonSetup_091006.exe
C:\Users\xxxxxxx\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\xxxxxxx\AppData\Local\Temp\SkypeSetup.exe
C:\Users\xxxxxxx\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\xxxxxxx\AppData\Local\Temp\_isB96F.exe
C:\Users\xxxxxxx\AppData\Local\Temp\{7763A600-5041-472D-B1A9-CB57707C8441}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxxx\AppData\Local\Temp\{E4A67257-FB22-4660-9C49-DE6F0F4E5777}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxxx\AppData\Local\Temp\~convert2007733013507243218.exe
C:\Users\xxxxxxx\AppData\Local\Temp\~convert708054009521529151.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 17:40
==================== End Of Log ============================
Schönen Gruß, CG |
|
12.09.2014, 10:54
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: McAfee arlarmiert wegen Settings ManagerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.09.2014, 07:02
| #5 |
| | Windows 7: McAfee arlarmiert wegen Settings ManagerCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=dd8c5df5a2f01d4995d632449defe0c9
# engine=20133
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-13 05:05:23
# local_time=2014-09-13 07:05:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='McAfee VirusScan Enterprise'
# compatibility_mode=5126 16777213 100 100 39268732 154349903 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 32462107 162214573 0 0
# scanned=460520
# found=46
# cleaned=0
# scan_time=21116
sh=3FDA53F88C2B98DE37AC2C2080502BE2E576E901 ft=1 fh=3800e8a51d246518 vn="Win32/SProtector.B evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-1576544144-1309573009-1586081336-1000\$RJCKXUS\uninstall.exe"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\GERDEN~1\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=EAE2784C9115FE9CFA44A116B74E72C1BCCFA7F6 ft=1 fh=2e79e77116fe19c4 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\GERDEN~1\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\456a7aaa4898da7bbdff88a06fd66a2a\MyPhoneExplorer_1.8.5.exe.vir"
sh=781DB292EEEFCA01CC36FDC2D6C30C2E917185A6 ft=1 fh=fd4b2ed3c9dce2c7 vn="Variante von Win32/Toolbar.SearchSuite.U evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxxxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JDUDD9Y\SettingsManagerSetup[1].exe"
sh=0A12774E4D19A9867069C8D3CD3E380D7CB2F59C ft=1 fh=c950eacd9b1cc265 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\xxxxxxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JDUDD9Y\WajamChecker[1].exe"
sh=38980E7E6233CF76E983D79823E628F0372BD110 ft=1 fh=38a1a2a67d0368dd vn="Variante von Win32/Toolbar.Widgi.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Temp\pdfforgeToolbar.exe"
sh=76A33F18410CD93DC994975222AA0AC5606AF1DC ft=1 fh=2b6dd7985b72d1de vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$R6FUMCL.exe"
sh=B48740DDDC53596F49D0DD3682F66670D6154322 ft=1 fh=cc57152d6fedd190 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$R9GJBAL.exe"
sh=3C50ABE607AE540862C4B3B4BF6EDB585455D1AD ft=1 fh=34433724d8c1df3d vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$RAAVQ20.exe"
sh=B48740DDDC53596F49D0DD3682F66670D6154322 ft=1 fh=cc57152d6fedd190 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$RE3VKCP.exe"
sh=3C50ABE607AE540862C4B3B4BF6EDB585455D1AD ft=1 fh=34433724d8c1df3d vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$RHJ2VJL.exe"
sh=B48740DDDC53596F49D0DD3682F66670D6154322 ft=1 fh=cc57152d6fedd190 vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\$Recycle.Bin\S-1-5-21-1367272671-387413212-586888167-1001\$RTDW0K0.exe"
sh=D67A33CEB13E362E02CE274646331CFE7CF37AEC ft=1 fh=c71c001169bb6296 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll"
sh=4809ED6CE4E44E10CDD0B7BF47D00B637555E2B9 ft=1 fh=0fdc0c8965e17046 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5"
sh=D67A33CEB13E362E02CE274646331CFE7CF37AEC ft=1 fh=c71c001169bb6296 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6"
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Conduit\Community Alerts\Alert.dll"
sh=3D09B4A1E2E55E7D1DF62B739D434F3F4E51DB90 ft=1 fh=31688d33c108b3f2 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe"
sh=D48000BCD21B997E86AE894925B4A753BC4A7F5B ft=1 fh=8b4de582c071a5f2 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\pdfforge Toolbar\WidgiHelper.exe"
sh=37054C8EACFEA64C87F1EF9A8F432A91A3C71E76 ft=1 fh=88ed21461b6f188a vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll"
sh=EB2BBCB97120C69F0E738DF9B521BCAD4CA1DCC8 ft=1 fh=5a1211cb00ea2a3d vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Veoh_Web_Player_New\ldrtbVeoh.dll"
sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Veoh_Web_Player_New\prxtbVeoh.dll"
sh=2FA3B0E186C3448F5E1CCCCD64B269B9B42454BD ft=1 fh=ca7d86d7cc20a5fb vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Veoh_Web_Player_New\tbVeoh.dll"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="F:\Program Files\Veoh_Web_Player_New\Veoh_Web_Player_NewToolbarHelper.exe"
sh=48EF8B4E06E0F1D3C06C4D6E1EA2B6CE48AA5231 ft=1 fh=ac26df35aa8ade69 vn="Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="F:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll"
sh=5F437ECC88A691B6161B1D168B3F4A93624F5832 ft=1 fh=400e77a5e5d54a3a vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Babylon\Setup\Setup.exe"
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Conduit\CT3264748\Veoh_Web_Player_NewAutoUpdateHelper.exe"
sh=E164E1FB2A16307241AA6639C399A9E6E80EFEA4 ft=1 fh=ec22e82e311df5e3 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C4MRIIAB\Veoh_Web_Player_New[1].exe"
sh=FDA649864BF98C3797541352FD0C25091D7477E0 ft=1 fh=3cbc9c655799fe48 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4RH7HB2\Veoh_Web_Player_New[1].exe"
sh=4ED6E8313BB5164C001B08FDED409AE8C72530C6 ft=1 fh=8a8b19828fde40b4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZI26EKEK\statisticsstub[1].exe"
sh=153D61D882922BA440ED0EDB0BE44F58CB47DC5B ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PH5B032S\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}[1].cpi"
sh=CA6D614D6150D926E3578EA6A9A295B648CC9E57 ft=1 fh=b641a4fc3877f356 vn="Win32/Adware.Yontoo Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\YontooSetup-Silent.exe"
sh=3CA96836E5258ABAC55BDF186808CCD8773D068F ft=1 fh=2547baac6d1fe263 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\425DA9D8-BAB0-7891-8A1C-1395D62981AF\MyBabylonTB.exe"
sh=5F437ECC88A691B6161B1D168B3F4A93624F5832 ft=1 fh=400e77a5e5d54a3a vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\425DA9D8-BAB0-7891-8A1C-1395D62981AF\Setup.exe"
sh=FDA649864BF98C3797541352FD0C25091D7477E0 ft=1 fh=3cbc9c655799fe48 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\ct3264748\chLogic.exe"
sh=BD56F2ACE52335DFE7BE793F3F3D84BB2BC2DB25 ft=1 fh=58154fa84c99c884 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\ct3264748\ffLogic.exe"
sh=E164E1FB2A16307241AA6639C399A9E6E80EFEA4 ft=1 fh=ec22e82e311df5e3 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\ct3264748\ieLogic.exe"
sh=4ED6E8313BB5164C001B08FDED409AE8C72530C6 ft=1 fh=8a8b19828fde40b4 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Local\Temp\ct3264748\statisticsStub.exe"
sh=EB2BBCB97120C69F0E738DF9B521BCAD4CA1DCC8 ft=1 fh=5a1211cb00ea2a3d vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\LocalLow\Veoh_Web_Player_New\ldrtbVeoh.dll"
sh=2FA3B0E186C3448F5E1CCCCD64B269B9B42454BD ft=1 fh=ca7d86d7cc20a5fb vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\LocalLow\Veoh_Web_Player_New\tbVeoh.dll"
sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\LocalLow\Veoh_Web_Player_New\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll"
sh=D3B261347DEA979D9F42B85B7CCED6741CCD8AE6 ft=1 fh=a72bb79d4905971b vn="Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\AppData\Roaming\OpenCandy\588E36D36D0D4E6FAF4D2D3BDEDDBCEE\pcspeedup_oc.exe"
sh=522B4ED124934B7CA59C0BB89E0964840FFE592A ft=1 fh=76cb6506bd0af14e vn="Variante von Win32/KBM.A evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\Downloads\DropDownDealsSetup.exe"
sh=B6761818005099E1B659A4D85FF49C5B2C43F4EE ft=1 fh=fc5d69653423d624 vn="Mehrere Bedrohungen" ac=I fn="F:\Users\claudia\Downloads\Update.exe"
sh=D722BB3B24DD7F6225C0D2EFE573DA7D0C110761 ft=1 fh=1a8e7c7c205d2cc3 vn="Win32/Toolbar.Conduit.M evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\Downloads\VeohWebPlayerSetup_eng (1).exe"
sh=D722BB3B24DD7F6225C0D2EFE573DA7D0C110761 ft=1 fh=1a8e7c7c205d2cc3 vn="Win32/Toolbar.Conduit.M evtl. unerwünschte Anwendung" ac=I fn="F:\Users\claudia\Downloads\VeohWebPlayerSetup_eng.exe"
sh=82186CB14F7B8DEFC06F061BC319C7DFD85EF5FD ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="F:\Windows\Installer\11318e2.msi"
Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
McAfee VirusScan Enterprise
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
McAfee AntiSpyware Enterprise Module
Java 7 Update 67
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Google Chrome 37.0.2062.103
Google Chrome 37.0.2062.120
````````Process Check: objlist.exe by Laurent````````
McAfee VirusScan Enterprise x64 engineserver.exe
McAfee VirusScan Enterprise vstskmgr.exe
McAfee VirusScan Enterprise x64 mcshield.exe
McAfee VirusScan Enterprise x64 mfeann.exe
McAfee VirusScan Enterprise shstat.exe
TOSHIBA TOSHIBA Online Product Information TOPI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-09-2014
Ran by xxxxxx (administrator) on CLAUDIA on 13-09-2014 08:04:13
Running from C:\Users\xxxxxx\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Toshiba Europe GmbH) C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Spotify Ltd) C:\Users\xxxxxx\AppData\Roaming\Spotify\spotify.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHWE.EXE
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
() C:\Program Files\MagicTune Premium\GammaTray.exe
(Dropbox, Inc.) C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
() C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
() C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
() C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-07-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-05-11] (Toshiba Europe GmbH)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM\...\Run: [MagicTuneEngine] => C:\Program Files\MagicTune Premium\MagicTuneLauncher.exe [53760 2010-10-29] ()
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [NBAgent] => c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-09-02] (Nero AG)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [SVPWUTIL] => C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-03-03] (TOSHIBA)
HKLM-x32\...\Run: [KeNotify] => C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-15] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294136 2009-10-06] (TOSHIBA Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [136512 2009-08-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [124240 2009-10-22] (McAfee, Inc.)
HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\.DEFAULT\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Badoo Desktop] => C:\ProgramData\Badoo\Badoo Desktop\1.6.38.1042\Badoo.Desktop.exe
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify Web Helper] => C:\Users\xxxxxx\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Spotify] => C:\Users\xxxxxx\AppData\Roaming\Spotify\spotify.exe [6621752 2014-08-29] (Spotify Ltd)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHWE.EXE [241280 2014-01-25] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1576544144-1309573009-1586081336-1000\...\MountPoints2: {48f74f1e-28aa-11e4-a5aa-806e6f6e6963} - F:\EzODDPlus.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibration.lnk
ShortcutTarget: Color Calibration.lnk -> C:\Program Files (x86)\SEC\MT2.5_RAFF\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.exe.lnk
ShortcutTarget: GammaTray.exe.lnk -> C:\Program Files\MagicTune Premium\GammaTray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk * bootdelete
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKCU - Backup.Old.DefaultScope {2271BAE2-D157-4ACD-9A6E-322818AF3837}
SearchScopes: HKCU - {02E649DF-A041-4772-B785-75C79A7A0D72} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {7273CDE2-F307-001B-7741-61D34380F7EC} URL =
SearchScopes: HKCU - {8E976338-C8F6-42CC-BC14-5486C2850547} URL = hxxp://at.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {C75522F6-5E44-4A99-8EC8-881B32921C90} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
DPF: HKLM-x32 {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} https://univpn.uni-graz.at/+CSCOL+/csvrloader32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
Tcpip\..\Interfaces\{C4FB6DE3-76B7-4AEE-B057-2E580C977068}: [NameServer] 131.130.1.11 131.130.1.12
FireFox:
========
FF ProfilePath: C:\Users\xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\staged [2013-01-27]
FF Extension: Adblock Plus - C:\Users\xxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\598434np.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-06]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-11-10]
Chrome:
=======
CHR HomePage: Default -> hxxp://at.msn.com/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.google.at/"
CHR DefaultSearchKeyword: Default -> 86FF71A27EFDF8425255680F0A59B94E599DA29D27152D88A6D213BD4474E14E
CHR DefaultSearchURL: Default -> 5C6BF6FB687AC0872209D6ABD2DE2877FC244D9791AB33D741C989723CC93B45
CHR Profile: C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-28]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-28]
CHR Extension: (Adblock Plus) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-28]
CHR Extension: (Google-Suche) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-28]
CHR Extension: (Google Wallet) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05]
CHR Extension: (Citavi Picker) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-03-08]
CHR Extension: (Google Mail) - C:\Users\xxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-28]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1811456 2010-08-27] (Realsil Microelectronics Inc.) [File not signed]
R2 McAfeeEngineService; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [19720 2009-10-22] (McAfee, Inc.)
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [103744 2009-08-25] (McAfee, Inc.)
U2 McShield; C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe [178920 2009-10-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe [66896 2009-10-22] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [79504 2009-10-22] (McAfee, Inc.)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ATIAVPCI; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_bda.sys [1565176 2011-01-11] (ATI Technologies Inc.)
S3 AtiIrRcvr; C:\Windows\System32\DRIVERS\cinergy_t_stick_video_hid.sys [32760 2011-01-11] (ATI Technologies Inc.)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-09-10] ()
R1 MagicTune; C:\Windows\system32\drivers\MTictwl.sys [23096 2008-11-04] (Samsung Electronics, Inc. )
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [97576 2009-10-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [119968 2009-10-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [469144 2009-10-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [77104 2009-10-22] (McAfee, Inc.)
R1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [83784 2009-10-22] (McAfee, Inc.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 07:21 - 2014-09-13 07:21 - 00854417 _____ () C:\Users\xxxxxx\Desktop\SecurityCheck.exe
2014-09-13 01:06 - 2014-09-13 01:06 - 02347384 _____ (ESET) C:\Users\xxxxxx\Desktop\esetsmartinstaller_deu.exe
2014-09-11 18:32 - 2014-09-11 18:32 - 00062209 _____ () C:\Users\xxxxxx\Desktop\FRST_2.txt
2014-09-11 18:28 - 2014-09-11 18:29 - 00002915 _____ () C:\Users\xxxxxx\Desktop\JRT.txt
2014-09-11 18:19 - 2014-09-11 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-09-11 18:17 - 2014-09-11 18:17 - 01016261 _____ (Thisisu) C:\Users\xxxxxx\Desktop\JRT.exe
2014-09-11 18:11 - 2014-09-11 18:13 - 00005900 _____ () C:\Users\xxxxxx\Desktop\AdwCleaner[S0].txt
2014-09-11 18:07 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-09-11 18:04 - 2014-09-11 18:08 - 00000000 ____D () C:\AdwCleaner
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxx\Desktop\adwcleaner_3.309.exe
2014-09-11 18:01 - 2014-09-11 18:12 - 00006571 _____ () C:\Users\xxxxxx\Desktop\mbam.txt
2014-09-11 17:13 - 2014-09-11 17:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-11 17:13 - 2014-09-11 17:13 - 00001073 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-11 17:13 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-11 17:13 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-10 23:00 - 2014-09-10 23:11 - 00002829 _____ () C:\Users\xxxxxx\Desktop\gmer.txt
2014-09-10 22:54 - 2014-09-10 22:53 - 00380416 _____ () C:\Users\xxxxxx\Desktop\Gmer-19357.exe
2014-09-10 22:51 - 2014-09-10 23:11 - 00041968 _____ () C:\Users\xxxxxx\Desktop\Addition.txt
2014-09-10 22:47 - 2014-09-13 08:04 - 00025835 _____ () C:\Users\xxxxxx\Desktop\FRST.txt
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:20 - 2014-09-13 08:04 - 00000000 ____D () C:\FRST
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 23:09 - 00000474 _____ () C:\Users\xxxxxx\Desktop\defogger_disable.log
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxx\defogger_reenable
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxx\Desktop\Defogger.exe
2014-09-10 22:07 - 2014-09-10 22:27 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-09 23:05 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-09 23:05 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-09 23:05 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-09 23:05 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-09 23:05 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-09 23:05 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-09 23:05 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-09 23:05 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-09 23:05 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-09 23:05 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-09 23:05 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-09 23:05 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-09 23:05 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-09 23:05 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-09 23:05 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-09 23:05 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-09 23:05 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-09 23:05 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-09 23:05 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-09 23:05 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-09 23:05 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-09 23:05 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-09 23:05 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-09 23:05 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-09 23:05 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-09 23:05 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-09 23:04 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-09 23:04 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-09 23:04 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-09 23:04 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-09 23:04 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-09 23:04 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-09 23:04 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-09 23:04 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-09 23:04 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-09 23:04 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-09 23:04 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-09 22:25 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-09 22:25 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-09 22:23 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-09 22:23 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-09 22:23 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-09 22:23 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-09 22:22 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-09 22:22 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-09 22:22 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 22:21 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-09 22:21 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-09 22:01 - 2014-09-09 22:05 - 00008965 _____ () C:\Users\xxxxxx\Documents\sparpotential.xlsx
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-08-28 16:02 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 16:02 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 16:02 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:34 - 2014-08-22 21:37 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Avery
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\OTi 5001
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-16 00:28 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 00:28 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 00:28 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 00:28 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 00:28 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 00:27 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-16 00:27 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 19:13 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-15 19:13 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-15 19:13 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-15 19:13 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-15 19:13 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-15 19:13 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-15 19:13 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 19:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 19:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 19:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 19:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 19:11 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-15 19:11 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-13 08:04 - 2014-09-10 22:47 - 00025835 _____ () C:\Users\xxxxxx\Desktop\FRST.txt
2014-09-13 08:04 - 2014-09-10 22:20 - 00000000 ____D () C:\FRST
2014-09-13 08:01 - 2011-06-08 16:53 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Skype
2014-09-13 07:58 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Spotify
2014-09-13 07:44 - 2013-01-28 09:02 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-13 07:25 - 2012-04-12 11:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-13 07:21 - 2014-09-13 07:21 - 00854417 _____ () C:\Users\xxxxxx\Desktop\SecurityCheck.exe
2014-09-13 06:26 - 2009-07-14 19:58 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-09-13 06:26 - 2009-07-14 19:58 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-09-13 06:26 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-13 01:06 - 2014-09-13 01:06 - 02347384 _____ (ESET) C:\Users\xxxxxx\Desktop\esetsmartinstaller_deu.exe
2014-09-13 01:04 - 2014-02-28 18:14 - 00000000 ____D () C:\Users\xxxxxx\Documents\Dokumente Scheidung
2014-09-13 00:38 - 2013-01-28 09:02 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-13 00:32 - 2014-02-02 01:00 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-09-13 00:32 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-12 12:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-12 11:48 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-12 11:48 - 2009-07-14 06:45 - 00019248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-12 11:19 - 2013-01-16 11:59 - 00000000 ___RD () C:\Users\xxxxxx\Dropbox
2014-09-12 11:18 - 2013-02-10 22:18 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Dropbox
2014-09-12 11:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-12 11:11 - 2009-07-14 06:51 - 00080806 _____ () C:\Windows\setupact.log
2014-09-11 23:29 - 2011-01-04 19:53 - 01792688 _____ () C:\Windows\WindowsUpdate.log
2014-09-11 18:32 - 2014-09-11 18:32 - 00062209 _____ () C:\Users\xxxxxx\Desktop\FRST_2.txt
2014-09-11 18:29 - 2014-09-11 18:28 - 00002915 _____ () C:\Users\xxxxxx\Desktop\JRT.txt
2014-09-11 18:19 - 2014-09-11 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-09-11 18:17 - 2014-09-11 18:17 - 01016261 _____ (Thisisu) C:\Users\xxxxxx\Desktop\JRT.exe
2014-09-11 18:13 - 2014-09-11 18:11 - 00005900 _____ () C:\Users\xxxxxx\Desktop\AdwCleaner[S0].txt
2014-09-11 18:12 - 2014-09-11 18:01 - 00006571 _____ () C:\Users\xxxxxx\Desktop\mbam.txt
2014-09-11 18:10 - 2011-01-04 20:06 - 00143660 _____ () C:\Windows\PFRO.log
2014-09-11 18:08 - 2014-09-11 18:04 - 00000000 ____D () C:\AdwCleaner
2014-09-11 18:02 - 2014-09-11 18:02 - 01370483 _____ () C:\Users\xxxxxx\Desktop\adwcleaner_3.309.exe
2014-09-11 17:57 - 2014-09-11 17:13 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-11 17:52 - 2010-10-21 16:22 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-09-11 17:13 - 2014-09-11 17:13 - 00001073 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-11 17:13 - 2014-09-11 17:13 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-10 23:11 - 2014-09-10 23:00 - 00002829 _____ () C:\Users\xxxxxx\Desktop\gmer.txt
2014-09-10 23:11 - 2014-09-10 22:51 - 00041968 _____ () C:\Users\xxxxxx\Desktop\Addition.txt
2014-09-10 23:09 - 2014-09-10 22:18 - 00000474 _____ () C:\Users\xxxxxx\Desktop\defogger_disable.log
2014-09-10 22:53 - 2014-09-10 22:54 - 00380416 _____ () C:\Users\xxxxxx\Desktop\Gmer-19357.exe
2014-09-10 22:30 - 2014-09-10 22:30 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-09-10 22:27 - 2014-09-10 22:27 - 00052256 _____ () C:\Windows\system32\.crusader
2014-09-10 22:27 - 2014-09-10 22:07 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-09-10 22:19 - 2014-09-10 22:19 - 02105856 _____ (Farbar) C:\Users\xxxxxx\Desktop\FRST64.exe
2014-09-10 22:18 - 2014-09-10 22:18 - 00000000 _____ () C:\Users\xxxxxx\defogger_reenable
2014-09-10 22:18 - 2011-05-02 12:43 - 00000000 ____D () C:\Users\xxxxxx
2014-09-10 22:17 - 2014-09-10 22:17 - 00050477 _____ () C:\Users\xxxxxx\Desktop\Defogger.exe
2014-09-10 21:58 - 2014-01-28 22:12 - 00000000 ____D () C:\Users\xxxxxx\AppData\Local\Spotify
2014-09-10 21:57 - 2011-06-24 20:35 - 00000000 ____D () C:\QUARANTINE
2014-09-10 21:34 - 2013-01-27 18:36 - 00000000 ____D () C:\ProgramData\InstallMate
2014-09-10 21:32 - 2013-01-28 09:03 - 00002218 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-10 21:26 - 2012-04-12 11:03 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 21:26 - 2012-04-12 11:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-10 21:26 - 2011-06-12 19:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 21:15 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-09 23:16 - 2011-05-02 12:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-09 23:03 - 2014-02-26 15:10 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-09 23:01 - 2013-09-02 13:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-09 23:01 - 2013-02-03 08:12 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2014-09-09 22:27 - 2011-05-12 21:15 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 22:25 - 2014-05-07 01:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-09 22:05 - 2014-09-09 22:01 - 00008965 _____ () C:\Users\xxxxxx\Documents\sparpotential.xlsx
2014-09-09 13:12 - 2011-05-02 12:46 - 00112912 _____ () C:\Users\xxxxxx\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-09 13:09 - 2009-07-14 06:45 - 00418672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 22:48 - 2010-10-21 16:26 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games
2014-09-08 22:47 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\WildTangent
2014-09-08 22:47 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-08 22:43 - 2014-09-08 22:43 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute
2014-09-08 22:42 - 2012-07-12 23:11 - 00000000 ____D () C:\ProgramData\ABBYY
2014-09-08 22:39 - 2014-09-08 22:39 - 00000000 ____D () C:\ProgramData\PDF Architect
2014-09-08 22:36 - 2011-08-26 20:44 - 00010770 _____ () C:\ProgramData\hpzinstall.log
2014-09-08 22:34 - 2011-08-26 20:47 - 00000000 ____D () C:\Program Files (x86)\HP
2014-09-08 22:34 - 2011-08-26 20:44 - 00000000 ____D () C:\ProgramData\HP
2014-09-08 21:06 - 2011-11-04 12:08 - 00000000 ____D () C:\Users\xxxxxx\AppData\Local\Paint.NET
2014-09-05 04:10 - 2014-09-09 22:21 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-09 22:21 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-23 04:07 - 2014-08-28 16:02 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 16:02 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 16:02 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 21:37 - 2014-08-22 21:34 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Avery
2014-08-22 08:53 - 2010-10-21 16:25 - 00000000 ____D () C:\ProgramData\Skype
2014-08-20 22:50 - 2014-08-20 22:50 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\OTi 5001
2014-08-19 23:33 - 2014-02-28 23:26 - 00000000 ____D () C:\Users\xxxxxx\Documents\VISA
2014-08-19 20:05 - 2014-09-09 23:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-09 23:05 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 02:31 - 2014-08-19 02:31 - 00003758 _____ () C:\Users\xxxxxx\Desktop\trennen_aber_richtig_ooe_stmk_ktn - Verknüpfung.lnk
2014-08-19 02:30 - 2014-06-16 21:15 - 00000000 ____D () C:\Users\xxxxxx\Documents\IL3 Website
2014-08-19 02:29 - 2013-11-06 10:30 - 00000000 ____D () C:\Users\xxxxxx\Documents\Erstes Schreiben
2014-08-19 02:28 - 2014-07-18 23:10 - 00000000 ____D () C:\Users\xxxxxx\Documents\Neuer Ordner
2014-08-19 01:01 - 2014-09-09 23:05 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-09 23:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-09 23:04 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-09 23:04 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-09 23:04 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-09 23:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-09 23:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-09 23:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-09 23:04 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-09 23:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-09 23:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-09 23:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-09 23:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-09 23:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-09 23:05 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-09 23:05 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-09 23:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-09 23:04 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-09 23:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-09 23:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-09 23:05 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-09 23:05 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-09 23:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-09 23:05 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-09 23:05 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-09 23:05 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-09 23:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:23 - 2014-09-09 23:04 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:22 - 2014-09-09 23:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-09 23:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-09 23:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-09 23:04 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-09 23:04 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-09 23:05 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-09 23:04 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-09 23:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-09 23:04 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-09 23:04 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-09 23:05 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:38 - 2014-09-09 23:04 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:36 - 2014-09-09 23:05 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 09:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 16:35 - 2014-07-18 23:27 - 00001042 _____ () C:\Users\xxxxxx\Desktop\Dropbox.lnk
2014-08-14 16:35 - 2014-07-18 23:26 - 00000000 ____D () C:\Users\xxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
Some content of TEMP:
====================
C:\Users\xxxxxx\AppData\Local\Temp\ApnStub.exe
C:\Users\xxxxxx\AppData\Local\Temp\avguidx.dll
C:\Users\xxxxxx\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\xxxxxx\AppData\Local\Temp\contentDATs.exe
C:\Users\xxxxxx\AppData\Local\Temp\csvrelay32.dll
C:\Users\xxxxxx\AppData\Local\Temp\csvrelay64.dll
C:\Users\xxxxxx\AppData\Local\Temp\csvrjavaloader32.dll
C:\Users\xxxxxx\AppData\Local\Temp\csvrjavaloader64.dll
C:\Users\xxxxxx\AppData\Local\Temp\csvrxul32.dll
C:\Users\xxxxxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkxvz77.dll
C:\Users\xxxxxx\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\xxxxxx\AppData\Local\Temp\GenericWndApi.dll
C:\Users\xxxxxx\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\xxxxxx\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\xxxxxx\AppData\Local\Temp\MSNC8AB.exe
C:\Users\xxxxxx\AppData\Local\Temp\oi_{DC54B024-FDFB-419F-9453-91687BA0691A}.exe
C:\Users\xxxxxx\AppData\Local\Temp\ose00000.exe
C:\Users\xxxxxx\AppData\Local\Temp\Quarantine.exe
C:\Users\xxxxxx\AppData\Local\Temp\rtdrvmon.exe
C:\Users\xxxxxx\AppData\Local\Temp\Samsung_MonSetup_091006.exe
C:\Users\xxxxxx\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\xxxxxx\AppData\Local\Temp\SkypeSetup.exe
C:\Users\xxxxxx\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\xxxxxx\AppData\Local\Temp\_isB96F.exe
C:\Users\xxxxxx\AppData\Local\Temp\{7763A600-5041-472D-B1A9-CB57707C8441}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxx\AppData\Local\Temp\{E4A67257-FB22-4660-9C49-DE6F0F4E5777}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
C:\Users\xxxxxx\AppData\Local\Temp\~convert2007733013507243218.exe
C:\Users\xxxxxx\AppData\Local\Temp\~convert708054009521529151.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 17:40
==================== End Of Log ============================
Eset hat einige Bedrohungen gefunden? Kann/soll man die auch noch entfernen? Nur, um zu verstehen, was gemacht wurde: die vielen Scans und Suchprogramme waren dafür da, um nichts zu übersehen? Melde mich, falls es noch Probleme gibt! Vielen Dank für die raschen und verständlichen Anleitungen! Schönes Wochenende aus Österreich! CG |
|
13.09.2014, 18:40
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: McAfee arlarmiert wegen Settings Manager mit den Tools haben wir die Malware entfernt. Funde auf F: von ESET kannste manuell löschen. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ --> Windows 7: McAfee arlarmiert wegen Settings Manager |
|
14.09.2014, 21:01
| #7 |
| | Windows 7: McAfee arlarmiert wegen Settings Manager Danke für die Hilfe. Glaube, es passt wieder. Well done :-) Danke auch für die Anwenderinnen-Tipps zum Schluss! Schöne Grüße, CG |
|
15.09.2014, 14:39
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: McAfee arlarmiert wegen Settings Manager Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
