|
Plagegeister aller Art und deren Bekämpfung: Deutlicher LeistungsabfallWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.10.2014, 10:33 | #1 |
| Deutlicher Leistungsabfall Hallo Trojaner-Board, nachdem ihr mir schon mal so super geholfen habt, plagt mich seit Kurzem ein deutlicher Leistungsabfall meines Systems, der sich u.a. äußert in: - langsames Hochfahren - langsames Öffnen von Fenstern, Dateien und Programmen - langsamer Browser (zunächst nur Firefox; nach Deinstallation ist aber auch der IE nicht schneller; allein beim Eingaben eines Suchbegriffs bei Google hakt die Worteingabe) Ich habe nach der letzten Malwareattacke alle eure Tipps befolgt. Avast meldet aktuell nichts, Antimalware (lasse ich alle 4 Wochen drüberlaufen) sagt auch alles wäre OK. Bin folglich etwas ratlos. Mir kommts so vor, als ob irgendwas im Hintergrund läuft, was die Leistung deutlich reduziert. Besten Dank vorab für Eure Hilfestellung! Viele Grüße Markus |
05.10.2014, 10:39 | #2 |
/// the machine /// TB-Ausbilder | Deutlicher Leistungsabfall hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
05.10.2014, 10:48 | #3 |
| Deutlicher Leistungsabfall FIRST:
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-10-2014 01 Ran by Markus ****** (administrator) on MARKUS****** on 05-10-2014 11:43:37 Running from C:\Users\Markus ******\Desktop Loaded Profile: Markus ****** (Available profiles: Markus ******) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) () C:\Windows\System32\DTS.exe (Lenovo) C:\Windows\System32\ibmpmsvc.exe (AuthenTec, Inc.) C:\Windows\System32\AtService.exe (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\lpksetup.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (AMD) C:\Windows\System32\atieclxx.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe (Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Lenovo Group Limited) C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Lenovo.) C:\Windows\System32\TpShocks.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\password_manager.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe (Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1541416 2009-07-14] (Synaptics Incorporated) HKLM\...\Run: [TPHOTKEY] => C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [68976 2009-03-13] (Lenovo Group Limited) HKLM\...\Run: [LENOVO.TPFNF6R] => C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe [62752 2009-08-20] (Lenovo Group Limited) HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358424 2009-08-04] (Intel Corporation) HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [337184 2009-07-08] (Lenovo.) HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor HKLM\...\Run: [cssauth] => C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [3089720 2009-08-26] (Lenovo Group Limited) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [980368 2010-11-04] (The Eraser Project) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-01] (AVAST Software) HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKU\S-1-5-21-1732376492-3782921457-3814634441-1000\...\Run: [Google Update] => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-07-23] (Google Inc.) HKU\S-1-5-21-1732376492-3782921457-3814634441-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01 SearchScopes: HKLM - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: IePasswordManagerHelper Class -> {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} -> C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {439B6D3C-A359-4D73-8515-2AFE8CF90C08} hxxp://www.tradesignalonline.com/charts/bin/axts5we.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default FF SearchEngineOrder.1: Microsoft (Bing) FF Homepage: https://www.google.de/ FF Keyword.URL: hxxp://www.bing.com/search FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\searchplugins\bing-avast.xml FF Extension: Tradesignal Online Chart - C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f} [2014-09-09] FF HKLM\...\Firefox\Extensions: [{3112ca9c-de6d-4884-a869-9855de68056c}] - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} FF Extension: Google Toolbar for Firefox - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010-12-24] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-22] FF HKCU\...\Firefox\Extensions: [{FCF36B88-1BBA-487f-B64B-D2E8980A9293}] - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension FF Extension: ThinkVantage Password Manager - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension [2010-12-22] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR CustomProfile: C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-17] CHR Extension: (Google Docs) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-17] CHR Extension: (Google Drive) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-17] CHR Extension: (YouTube) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-17] CHR Extension: (Google-Suche) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-17] CHR Extension: (Google Tabellen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-17] CHR Extension: (avast! Online Security) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-17] CHR Extension: (Google Wallet) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-17] CHR Extension: (Google Mail) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-17] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-09] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [124192 2009-09-04] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [242976 2009-09-04] (Lenovo) S3 ADMonitor; C:\Windows\system32\ADMonitor.exe [106496 2009-09-01] () [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-09] (AVAST Software) R2 dtsvc; C:\Windows\system32\DTS.exe [98304 2009-09-01] () [File not signed] S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [45424 2009-07-03] (Lenovo Group Limited) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed] R2 SUService; C:\Program Files\Lenovo\System Update\SUService.exe [28672 2011-02-18] (Lenovo Group Limited) [File not signed] R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-08-04] (Intel Corporation) S2 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 5U875UVC; C:\Windows\System32\DRIVERS\5U875.sys [72320 2009-07-08] (Ricoh co.,Ltd.) R3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [5073920 2009-08-24] (ATI Technologies Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-07-09] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-07-09] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-07-09] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-07-09] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-07-09] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-07-09] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-07-09] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-07-09] () R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [5924864 2009-08-24] (Intel Corporation) S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] S3 catchme; \??\C:\Users\MARKUS~1\AppData\Local\Temp\catchme.sys [X] S3 PCDSRVC{C4B36920-79E24793-06000000}_0; \??\c:\progra~1\pc-doc~1\pcdsrvc.pkms [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-05 11:43 - 2014-10-05 11:45 - 00018063 _____ () C:\Users\Markus ******\Desktop\FRST.txt 2014-10-05 11:43 - 2014-10-05 11:43 - 00000000 ____D () C:\FRST 2014-10-05 11:42 - 2014-10-05 11:42 - 01100800 _____ (Farbar) C:\Users\Markus ******\Desktop\FRST.exe 2014-10-05 07:56 - 2014-10-05 07:56 - 00001024 _____ () C:\.rnd 2014-10-04 20:26 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-09-24 17:57 - 2014-09-24 18:21 - 00002022 ____H () C:\Users\Markus ******\Documents\Default.rdp 2014-09-24 16:28 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-17 09:21 - 2014-09-17 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-09-16 11:12 - 2014-09-16 11:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iPod 2014-09-15 13:02 - 2014-09-16 12:16 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-11 20:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-11 20:13 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-11 20:13 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-11 20:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-11 20:13 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-11 20:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-11 20:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-11 20:13 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-11 20:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-11 20:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-11 20:13 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-11 20:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-11 20:13 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-11 20:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-11 20:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-11 20:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-11 20:13 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-11 20:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-11 20:13 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-11 20:13 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-11 20:13 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-11 20:13 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-11 20:13 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-11 20:13 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-11 20:12 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-11 18:30 - 2012-02-11 07:37 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe 2014-09-11 18:28 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-11 18:28 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-11 18:28 - 2011-02-25 07:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe 2014-09-09 18:33 - 2014-09-09 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2014-09-09 18:18 - 2014-09-09 18:18 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-09-09 18:14 - 2012-07-26 04:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys 2014-09-09 18:14 - 2012-07-26 04:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys 2014-09-09 18:13 - 2012-07-26 05:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe 2014-09-09 18:13 - 2012-07-26 05:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll 2014-09-09 18:13 - 2012-06-02 16:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2014-09-09 18:08 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2014-09-09 18:08 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2014-09-09 17:49 - 2013-10-04 03:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2014-09-09 17:49 - 2013-10-04 03:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2014-09-09 17:49 - 2012-08-22 19:16 - 00712048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys 2014-09-09 17:49 - 2012-07-04 21:45 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-09-09 17:48 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-09-09 17:48 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-09-09 17:48 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-09-09 17:48 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-09-09 17:48 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2014-09-09 17:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2014-09-09 17:48 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2014-09-09 17:48 - 2013-03-19 05:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll 2014-09-09 17:48 - 2013-01-24 06:47 - 00196328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2014-09-09 17:48 - 2012-10-03 18:42 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll 2014-09-09 17:48 - 2012-10-03 18:40 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-09-09 17:48 - 2012-10-03 17:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys 2014-09-09 17:48 - 2012-08-21 22:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe 2014-09-09 17:48 - 2012-07-06 21:23 - 00393728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys 2014-09-09 17:48 - 2011-12-30 07:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl 2014-09-09 17:48 - 2011-06-16 06:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll 2014-09-09 17:48 - 2011-03-11 07:39 - 00143744 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys 2014-09-09 17:48 - 2011-03-11 07:39 - 00117120 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00332160 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00080256 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00022400 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys 2014-09-09 17:48 - 2011-03-11 07:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll 2014-09-09 17:48 - 2011-03-11 07:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe 2014-09-09 17:48 - 2011-03-11 06:01 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-09-09 17:48 - 2011-02-18 07:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe 2014-09-09 17:47 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-09-09 17:47 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-09-09 17:47 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll 2014-09-09 17:47 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll 2014-09-09 17:47 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs 2014-09-09 17:47 - 2012-05-05 09:46 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2014-09-09 17:47 - 2011-05-04 06:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll 2014-09-09 17:47 - 2011-05-04 06:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe 2014-09-09 17:46 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-09-09 17:46 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-09-09 17:46 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-09-09 17:46 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2014-09-09 17:46 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2014-09-09 17:46 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2014-09-09 17:46 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2014-09-09 17:46 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll 2014-09-09 17:46 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll 2014-09-09 17:46 - 2012-05-01 06:44 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2014-09-09 17:46 - 2012-01-04 10:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll 2014-09-09 17:00 - 2014-09-09 17:56 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Windows Live Writer 2014-09-09 17:00 - 2014-09-09 17:00 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live Writer 2014-09-09 15:30 - 2014-09-09 15:30 - 00001291 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00001222 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00000000 ____D () C:\Windows\de 2014-09-09 15:29 - 2014-09-09 15:29 - 00001375 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2014-09-09 15:29 - 2014-09-09 15:29 - 00000020 _____ () C:\Windows\ÀøÉ 2014-09-09 15:29 - 2014-09-09 15:29 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition 2014-09-09 15:27 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2014-09-09 15:27 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2014-09-09 15:26 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2014-09-09 15:24 - 2014-09-22 11:58 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live 2014-09-09 15:18 - 2014-09-09 15:18 - 01245384 _____ (Microsoft Corporation) C:\Users\Markus ******\Downloads\wlsetup-web.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-05 11:31 - 2012-04-07 20:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-05 11:26 - 2013-07-23 20:41 - 00001156 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job 2014-10-05 10:46 - 2010-12-24 17:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-05 08:03 - 2012-08-04 15:24 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Dropbox 2014-10-05 08:01 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-05 08:01 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-05 08:00 - 2010-12-22 18:47 - 01541774 _____ () C:\Windows\WindowsUpdate.log 2014-10-05 07:56 - 2014-06-01 22:09 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\FreePDF_XP 2014-10-05 07:56 - 2014-05-22 14:17 - 00001024 _____ () C:\Users\Markus ******\.rnd 2014-10-05 07:56 - 2012-08-04 15:32 - 00000000 ___RD () C:\Users\Markus ******\Dropbox 2014-10-05 07:56 - 2010-12-24 17:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-05 07:53 - 2013-09-17 12:49 - 00029500 _____ () C:\Windows\setupact.log 2014-10-05 07:53 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-25 19:26 - 2013-07-23 20:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job 2014-09-24 21:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-24 17:57 - 2012-04-07 20:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-24 17:57 - 2011-05-16 07:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-24 17:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-09-19 18:25 - 2009-07-21 07:30 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-18 08:59 - 2010-12-22 18:42 - 00114014 _____ () C:\Windows\PFRO.log 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Google 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Program Files\Google 2014-09-17 09:19 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Deployment 2014-09-17 09:19 - 2010-12-23 14:19 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Apps\2.0 2014-09-16 11:11 - 2012-05-05 16:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-09-16 10:45 - 2014-05-19 21:29 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-15 09:06 - 2010-12-23 21:25 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 10:59 - 2011-11-17 19:58 - 00000000 ____D () C:\Users\Markus ******\Desktop\temp 2014-09-12 09:23 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-11 20:15 - 2011-06-05 14:56 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-11 20:11 - 2013-07-11 23:30 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-11 20:07 - 2010-12-24 12:20 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-11 09:12 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-09 18:42 - 2010-12-23 13:39 - 00124728 _____ () C:\Users\Markus ******\AppData\Local\GDIPFONTCACHEV1.DAT 2014-09-09 18:39 - 2009-07-14 06:33 - 03802808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-09 18:37 - 2012-07-13 16:08 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-09 18:35 - 2010-12-23 03:30 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-09-09 18:20 - 2011-06-05 14:56 - 00000000 ____D () C:\Program Files\Microsoft Office 2014-09-09 18:09 - 2012-07-13 16:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-09-09 18:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-09-09 18:05 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\System 2014-09-09 18:05 - 2009-07-14 04:04 - 00000478 _____ () C:\Windows\win.ini 2014-09-09 15:29 - 2010-12-22 18:57 - 00000000 ____D () C:\Program Files\Windows Live Some content of TEMP: ==================== C:\Users\Markus ******\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6n06bc.dll C:\Users\Markus ******\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\Markus ******\AppData\Local\Temp\jre-8u20-windows-au.exe C:\Users\Markus ******\AppData\Local\Temp\SkypeSetup.exe C:\Users\Markus ******\AppData\Local\Temp\vlc-2.1.5-win32.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-26 23:47 ==================== End Of Log ============================ --- --- --- TXT Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 04-10-2014 01 Ran by Markus ****** at 2014-10-05 11:45:30 Running from C:\Users\Markus ******\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Registry Patch to arrange icons in Device and Printers folder of Windows 7 (HKLM\...\W7DevOR) (Version: 1.00 - ) 2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) 2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden 7-Zip 9.22beta (HKLM\...\7-Zip) (Version: - ) Access Help (HKLM\...\{C6FA39A7-26B1-480A-BC74-6D17531AC222}) (Version: 3.00 - Lenovo) ActiveTrader Deutschland (HKLM\...\{0DE75F32-3E22-42F7-B6CD-5A6644581F4E}) (Version: 6.1.1 - Cortal Consors) Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 5.32.00 - ) Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{C0CC75CD-F5B7-46AD-B016-17C0F5171718}) (Version: 8.0.0.23 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AT&T Service Activation (HKLM\...\{D81486A1-2371-4059-AC70-1AB894AC96E6}) (Version: 1.8.7.0 - AT&T) ATI Catalyst Install Manager (HKLM\...\{10EBB6AD-673B-EE60-7D3D-7C438E5F9BE5}) (Version: 3.0.736.0 - ATI Technologies, Inc.) ATI Uninstaller (HKLM\...\ATI Uninstaller) (Version: 8.641.1-090825m-087782C-Lenovo - ATI Technologies, Inc.) avast! Free Antivirus (HKLM\...\Avast) (Version: 9.0.2021 - AVAST Software) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Core Implementation (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full Existing (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full New (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Light (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center InstallProxy (Version: 2009.0825.2146.37269 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (Version: 2009.0825.2146.37269 - ATI) Hidden CCC Help Chinese Standard (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Chinese Traditional (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Dutch (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help English (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help French (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help German (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Italian (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Japanese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Korean (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Portuguese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Spanish (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Swedish (Version: 2009.0825.2145.37269 - ATI) Hidden ccc-core-static (Version: 2009.0825.2146.37269 - Ihr Firmenname) Hidden ccc-utility (Version: 2009.0825.2146.37269 - ATI) Hidden CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP) Client Security - Password Manager (HKLM\...\{18554B3F-46EA-40A9-B4EA-7EEE83C0559D}) (Version: 8.30.0023.00 - Lenovo Group Limited) Conexant 20561 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.92.10.0 - Conexant) Create Recovery Media (HKLM\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden Dienstprogramm "ThinkPad UltraNav" (HKLM\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.11 - Lenovo) DirectX 9 Runtime (Version: 1.00.0000 - Sonic Solutions) Hidden ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen) Eraser 6.0.8.2273 (HKLM\...\{392A74D0-4DFE-49F7-87C3-8A61708F8856}) (Version: 6.0.2273 - The Eraser Project) Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Free Fire Screensaver (HKLM\...\Free Fire Screensaver) (Version: - Laconic Software) FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - ) Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.) Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Toolbar for Firefox (HKLM\...\{2CCBABCB-6427-4A55-B091-49864623C43F}) (Version: 7.1.20101113 - Google Inc.) Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.) Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.) Integrated Camera Driver Installer Package Ver.1.27.500.0 (HKLM\...\{82EB6CEA-749A-410F-8AD2-372A286BA3BE}) (Version: 1.27.500.0 - RICOH) Integrated Camera TWAIN (HKLM\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.7.331 - Chicony Electronics Co.,Ltd.) Intel(R) Management Engine Interface (HKLM\...\HECI) (Version: - Intel Corporation) Intel® Active-Management-Technologie (HKLM\...\MESOL) (Version: - Intel Corporation) InterVideo WinDVD 8 (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0.20.112 - InterVideo Inc.) InterVideo WinDVD 8 (Version: 8.0.20.112 - InterVideo Inc.) Hidden iTunes (HKLM\...\{F32DC846-4457-40A8-BECA-BCC0E960BC53}) (Version: 11.4.0.18 - Apple Inc.) Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle) Java 8 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218020F0}) (Version: 8.0.200 - Oracle Corporation) Java Auto Updater (Version: 2.8.20.26 - Oracle Corporation) Hidden Java SE Development Kit 7 Update 55 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170550}) (Version: 1.7.0.550 - Oracle) Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Lenovo Fingerprint Software (HKLM\...\{2D440AF4-7330-43F0-A085-35DE1A90E703}) (Version: 3.3.0.50 - AuthenTec, Inc.) Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.01 - ) Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5387.13 - PC-Doctor, Inc.) Lenovo Welcome (HKLM\...\Lenovo Welcome_is1) (Version: 2.0.018.0 - Lenovo) Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Message Center Plus (HKLM\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited) Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Research AutoCollage Touch 2009 (HKLM\...\{1F8DA253-3C27-4B01-A63A-BA3533120833}) (Version: 2.00.2009 - Microsoft Research) Microsoft Search Enhancement Pack (Version: 1.2.121.0 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50701 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.50706 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.50701 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50701 - Microsoft Corporation) Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000 - Adobe) Hidden Mobile Broadband Connect (HKLM\...\{5C111F14-D9BE-459D-B0B6-B4D082F03749}) (Version: 3.5.0006 - Lenovo) Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd) Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) PX Profile Update (Version: 1.00.1. - AMD) Hidden RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd) Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - ) Rescue and Recovery (HKLM\...\{B383F243-0ABC-4E56-AA30-923B8D85076E}) (Version: 4.30.0025.00 - Lenovo Group Limited) Roxio Activation Module (Version: 1.0 - Roxio) Hidden Roxio Central Audio (Version: 3.8.0 - Roxio) Hidden Roxio Central Copy (Version: 3.8.0 - Roxio) Hidden Roxio Central Core (Version: 3.8.0 - Roxio) Hidden Roxio Central Data (Version: 3.8.0 - Roxio) Hidden Roxio Central Tools (Version: 3.8.0 - Roxio) Hidden Roxio Creator Business Edition (HKLM\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio) Roxio Creator Business Edition (Version: 10.3.081 - Roxio) Hidden Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) Sonic CinePlayer Decoder Pack (Version: 4.3.0 - Sonic Solutions) Hidden Sonic Icons for Lenovo (HKLM\...\{B334D9AE-1393-423E-97C0-3BDC3360E692}) (Version: 2.0.0 - Lenovo) System Update (HKLM\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 4.00.0046 - Lenovo) TeamSIP 2go (HKLM\...\{B303639A-2CDF-42A1-8532-0E3338CE5A6D}) (Version: 2.5.14 - TeamFON GmbH) TeamSIP 2go (Version: 2.5.14 - TeamFON GmbH) Hidden ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9600 - Broadcom Corporation) ThinkPad Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.04 - ) ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.06 - ) ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems) ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.55 - ) ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.4.12 - ) ThinkVantage Access Connections (HKLM\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.40 - Lenovo) ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.70 - Lenovo) Tradesignal Online Chart (HKLM\...\{3FB043FD-4C4C-4E99-8678-BA00A465C3F8}) (Version: 7.3.0.15 - Tradesignal GmbH) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) Verizon Wireless Mobile Broadband Self Activation (HKLM\...\{7A408D56-A9CF-4219-9F78-23E6B48A1C0D}) (Version: 3.1.1 - Smith Micro Software, Inc.) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - ) Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (07/07/2009 8.1.2.56) (HKLM\...\8E6CE26AD682E6D46DCCDD39CD93277A2EAF2449) (Version: 07/07/2009 8.1.2.56 - AuthenTec Inc.) Windows-Treiberpaket - Intel System (06/04/2009 1.0.0.0002) (HKLM\...\E7B58217635B8F723D4744A328A4B3237DB35FA9) (Version: 06/04/2009 1.0.0.0002 - Intel) Windows-Treiberpaket - Lenovo 1.55 (08/18/2009 1.55) (HKLM\...\112AA64E0C8CC704E307FE914F7DEC1C0035598E) (Version: 08/18/2009 1.55 - Lenovo) Windows-Treiberpaket - Ricoh (5U875UVC) Image (07/08/2009 1.27.500.0) (HKLM\...\E59560E2F5B162D40255FCD327ACA5E989D995D2) (Version: 07/08/2009 1.27.500.0 - Ricoh) Windows-Treiberpaket - Ricoh Company (rimsptsk) hdc (06/25/2009 6.10.01.03) (HKLM\...\D91056A9B3130B90EC1BB37F232FA5C4D61DF66F) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Windows-Treiberpaket - Ricoh Company (rismxdp) hdc (06/25/2009 6.10.01.04) (HKLM\...\414685941AB074B2478B18498E0CCA85F81CCBE6) (Version: 06/25/2009 6.10.01.04 - Ricoh Company) Windows-Treiberpaket - Ricoh Company MMC Host Controller (06/25/2009 6.10.01.03) (HKLM\...\6F84AC23718E31DE66E2EBEDAE047257F4E785D0) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Wise Registry Cleaner 8.11 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.11 - WiseCleaner.com, Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Chrome\Application\34.0.1847.137\delegate_execute.exe" (the data entry has 8 more characters). CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File ==================== Restore Points ========================= 04-10-2014 18:26:13 Windows Update 04-10-2014 20:59:22 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:04 - 2014-05-21 08:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0DEE7595-F069-449D-B9C9-FC3C78F2B6DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {36991A1E-6A6C-487A-8A5D-8B38DB72BB0D} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2009-08-23] (Lenovo Group Limited) Task: {3CFBA15D-48A7-4242-8658-D2779DA6F044} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {5245162F-8F9D-42AD-A58A-C31EE8FEE18E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated) Task: {6AF8D474-2932-4846-9749-69375C8508E5} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe [2009-08-26] (PC-Doctor, Inc.) Task: {6B4630C1-04C0-40E6-A068-29B93D900C94} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {96BA89CD-37E1-4951-8F32-BA6A465FE18F} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe Task: {97901924-BA6B-4546-894C-D4FBDE36A724} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {97AC3792-9BD1-45B3-A57F-6EF4DB6B4447} - System32\Tasks\JavaUpdateSched => C:\Windows\System32\jusched.exe Task: {B96F4CCE-CE64-4CAD-B9AE-269275568224} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe Task: {D5B4032B-7340-4B43-893C-B753E7A189F5} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe Task: {EF3D195A-B55E-4A5B-8E41-E27B949690AC} - System32\Tasks\{49C7F31D-7E66-4DDB-A4B5-F1BF4327AFC7} => C:\Program Files\Skype\\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.) Task: {F988FF61-E194-44DA-BA0D-DBF8A3833ECD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-09] (AVAST Software) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe ==================== Loaded Modules (whitelisted) ============= 2009-09-01 00:32 - 2009-09-01 00:32 - 00098304 ____N () C:\Windows\system32\DTS.exe 2014-07-09 09:11 - 2014-07-09 09:11 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-10-04 20:19 - 2014-10-04 20:19 - 02859008 _____ () C:\Program Files\AVAST Software\Avast\defs\14100400\algo.dll 2014-10-05 07:54 - 2014-10-05 07:54 - 02859008 _____ () C:\Program Files\AVAST Software\Avast\defs\14100401\algo.dll 2014-06-01 22:08 - 2012-06-21 07:25 - 00094208 _____ () C:\Windows\System32\redmon32.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2010-12-22 18:42 - 2009-08-23 20:04 - 00037888 ____N () C:\Program Files\ThinkPad\Utilities\GR\PWMRT32V.DLL 2014-07-09 09:11 - 2014-07-09 09:11 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-03-31 21:35 - 2014-03-31 21:35 - 00282304 _____ () C:\Program Files\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RCIMGDIR.exe.lnk => C:\Windows\pss\RCIMGDIR.exe.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TeamSIP 2go.lnk => C:\Windows\pss\TeamSIP 2go.lnk.CommonStartup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^6120.lnk => C:\Windows\pss\6120.lnk.Startup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^aj7zfy.lnk => C:\Windows\pss\aj7zfy.lnk.Startup MSCONFIG\startupreg: FingerPrintSoftware => "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s MSCONFIG\startupreg: Message Center Plus => C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start ========================= Accounts: ========================== Administrator (S-1-5-21-1732376492-3782921457-3814634441-500 - Administrator - Disabled) Gast (S-1-5-21-1732376492-3782921457-3814634441-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1732376492-3782921457-3814634441-1003 - Limited - Enabled) Markus ****** (S-1-5-21-1732376492-3782921457-3814634441-1000 - Administrator - Enabled) => C:\Users\Markus ****** ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/05/2014 08:54:32 AM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (10/05/2014 08:50:42 AM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (10/04/2014 10:12:29 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (10/04/2014 10:07:45 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/26/2014 11:52:14 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/26/2014 11:48:52 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/25/2014 06:51:17 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/25/2014 06:48:00 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/24/2014 01:02:15 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (09/24/2014 00:59:06 PM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. System errors: ============= Error: (10/05/2014 07:53:37 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: Der Dienst "Avira Browser-Schutz" ist von folgendem Dienst abhängig: AntiVirService. Dieser Dienst ist eventuell nicht installiert. Error: (10/05/2014 07:53:33 AM) (Source: amdkmdag) (EventID: 10261) (User: ) Description: Display is not active Error: (10/05/2014 07:53:33 AM) (Source: amdkmdag) (EventID: 19468) (User: ) Description: CPLIB :: General - Invalid Parameter Error: (10/04/2014 11:00:21 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet: %%1115 Error: (10/04/2014 11:00:09 PM) (Source: Service Control Manager) (EventID: 7016) (User: ) Description: Der Dienst "Data Transfer Service" hat einen ungültigen aktuellen Status gemeldet: 0 Error: (10/04/2014 10:24:38 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/04/2014 10:24:37 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/04/2014 10:24:37 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/04/2014 09:02:00 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/04/2014 09:01:59 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Microsoft Office Sessions: ========================= Error: (12/10/2013 10:04:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 283 seconds with 180 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:35:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 138 seconds with 120 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:32:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 34 seconds with 0 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:30:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 21691 seconds with 2880 seconds of active time. This session ended with a crash. Error: (02/11/2013 11:50:41 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4233 seconds with 2520 seconds of active time. This session ended with a crash. Error: (05/24/2012 06:13:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1365 seconds with 420 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz Percentage of memory in use: 66% Total physical RAM: 2520.03 MB Available physical RAM: 849.22 MB Total Pagefile: 6298.32 MB Available Pagefile: 4025.06 MB Total Virtual: 2047.88 MB Available Virtual: 1907.34 MB ==================== Drives ================================ Drive c: (Windows7_OS) (Fixed) (Total:286.66 GB) (Free:96.77 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive q: (Lenovo_Recovery) (Fixed) (Total:10.25 GB) (Free:5.01 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298.1 GB) (Disk ID: 504A2363) Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=286.7 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=10.3 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
06.10.2014, 08:18 | #4 |
/// the machine /// TB-Ausbilder | Deutlicher Leistungsabfall hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
06.10.2014, 20:05 | #5 |
| Deutlicher LeistungsabfallCode:
ATTFilter ComboFix 14-10-04.01 - Markus ****** 06.10.2014 19:15:56.1.2 - x86 Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2520.1554 [GMT 2:00] ausgeführt von:: c:\users\Markus ******\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B} SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . ((((((((((((((((((((((( Dateien erstellt von 2014-09-06 bis 2014-10-06 )))))))))))))))))))))))))))))) . . 2014-10-06 17:27 . 2014-10-06 17:27 -------- d-----w- c:\users\Test\AppData\Local\temp 2014-10-06 17:27 . 2014-10-06 17:27 -------- d-----w- c:\users\Public\AppData\Local\temp 2014-10-06 17:27 . 2014-10-06 17:27 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-10-05 09:43 . 2014-10-05 09:46 -------- d-----w- C:\FRST 2014-10-04 18:26 . 2014-09-09 01:24 8806800 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BC862F1C-1CDE-44BA-9C09-2C8140D8BF19}\mpengine.dll 2014-10-04 18:26 . 2014-09-25 01:40 519680 ----a-w- c:\windows\system32\qdvd.dll 2014-09-24 14:28 . 2014-09-09 21:47 2048 ----a-w- c:\windows\system32\tzres.dll 2014-09-16 09:11 . 2014-09-16 09:11 -------- d-----w- c:\program files\iPod 2014-09-16 09:11 . 2014-09-16 09:11 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-09-16 09:11 . 2014-09-16 09:11 -------- d-----w- c:\program files\iTunes 2014-09-11 18:12 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\system32\msmpeg2vdec.dll 2014-09-11 16:30 . 2014-07-07 01:40 550912 ----a-w- c:\windows\system32\kerberos.dll 2014-09-11 16:30 . 2014-07-07 01:40 1059840 ----a-w- c:\windows\system32\lsasrv.dll 2014-09-11 16:30 . 2012-02-11 05:37 317440 ----a-w- c:\windows\system32\spoolsv.exe 2014-09-11 16:28 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\system32\d3d10warp.dll 2014-09-11 16:28 . 2011-02-25 05:30 2616320 ----a-w- c:\windows\explorer.exe 2014-09-11 16:28 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll 2014-09-09 16:22 . 2014-09-09 16:22 -------- d-----w- c:\windows\Migration 2014-09-09 16:14 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2014-09-09 16:14 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2014-09-09 16:13 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll 2014-09-09 16:13 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll 2014-09-09 16:13 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe 2014-09-09 16:13 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll 2014-09-09 16:13 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2014-09-09 16:08 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\system32\wmploc.DLL 2014-09-09 16:08 . 2013-05-10 03:48 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe 2014-09-09 15:49 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys 2014-09-09 15:49 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys 2014-09-09 15:49 . 2013-10-04 01:58 152576 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll 2014-09-09 15:49 . 2013-10-04 01:56 168960 ----a-w- c:\windows\system32\credui.dll 2014-09-09 15:47 . 2011-05-04 04:34 1549312 ----a-w- c:\windows\system32\tquery.dll 2014-09-09 15:46 . 2014-05-30 07:52 172032 ----a-w- c:\windows\system32\wdigest.dll 2014-09-09 15:00 . 2014-09-09 15:56 -------- d-----w- c:\users\Markus ******\AppData\Roaming\Windows Live Writer 2014-09-09 15:00 . 2014-09-09 15:00 -------- d-----w- c:\users\Markus ******\AppData\Local\Windows Live Writer 2014-09-09 13:30 . 2014-09-09 13:30 -------- d-----w- c:\windows\de 2014-09-09 13:29 . 2014-09-09 13:29 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2014-09-09 13:27 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll 2014-09-09 13:27 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll 2014-09-09 13:27 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll 2014-09-09 13:27 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll 2014-09-09 13:26 . 2009-09-04 15:29 453456 ----a-w- c:\windows\system32\d3dx10_42.dll 2014-09-09 13:24 . 2014-09-09 13:24 89944 ----a-w- c:\program files\Common Files\Windows Live\.cache\6449d1111cfcc3104\DSETUP.dll 2014-09-09 13:24 . 2014-09-09 13:24 537432 ----a-w- c:\program files\Common Files\Windows Live\.cache\6449d1111cfcc3104\DXSETUP.exe 2014-09-09 13:24 . 2014-09-09 13:24 1801048 ----a-w- c:\program files\Common Files\Windows Live\.cache\6449d1111cfcc3104\dsetup32.dll 2014-09-09 13:24 . 2014-09-09 13:24 525656 ----a-w- c:\program files\Common Files\Windows Live\.cache\6170c5ef1cfcc3103\DXSETUP.exe 2014-09-09 13:24 . 2014-09-09 13:24 1691480 ----a-w- c:\program files\Common Files\Windows Live\.cache\6170c5ef1cfcc3103\dsetup32.dll 2014-09-09 13:24 . 2014-09-09 13:24 94040 ----a-w- c:\program files\Common Files\Windows Live\.cache\6170c5ef1cfcc3103\DSETUP.dll 2014-09-09 13:24 . 2014-09-09 13:24 89944 ----a-w- c:\program files\Common Files\Windows Live\.cache\600f56f71cfcc3102\DSETUP.dll 2014-09-09 13:24 . 2014-09-09 13:24 537432 ----a-w- c:\program files\Common Files\Windows Live\.cache\600f56f71cfcc3102\DXSETUP.exe 2014-09-09 13:24 . 2014-09-09 13:24 1801048 ----a-w- c:\program files\Common Files\Windows Live\.cache\600f56f71cfcc3102\dsetup32.dll 2014-09-09 13:24 . 2014-09-22 09:58 -------- d-----w- c:\users\Markus ******\AppData\Local\Windows Live . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-09-24 15:57 . 2012-04-07 18:18 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-09-24 15:57 . 2011-05-16 05:48 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-09-16 08:45 . 2014-05-19 19:29 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-09-15 07:06 . 2010-12-23 19:25 231568 ------w- c:\windows\system32\MpSigStub.exe 2014-09-09 13:28 . 2012-07-17 12:37 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-08-27 19:49 . 2014-07-22 17:58 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2014-08-23 01:46 . 2014-08-28 05:42 305152 ----a-w- c:\windows\system32\gdi32.dll 2014-08-23 00:42 . 2014-08-28 05:42 2352640 ----a-w- c:\windows\system32\win32k.sys 2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\system32\msvcr120_clr0400.dll 2014-07-14 01:42 . 2014-08-13 18:06 654336 ----a-w- c:\windows\system32\rpcrt4.dll 2014-07-09 07:12 . 2014-05-22 15:22 414520 ----a-w- c:\windows\system32\drivers\aswsp.sys 2014-07-09 07:11 . 2014-05-22 15:22 71944 ----a-w- c:\windows\system32\drivers\aswstm.sys 2014-07-09 07:11 . 2014-05-22 15:22 192352 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2014-07-09 07:11 . 2014-05-22 15:22 779536 ----a-w- c:\windows\system32\drivers\aswsnx.sys 2014-07-09 07:11 . 2014-05-22 15:22 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2014-07-09 07:11 . 2014-05-22 15:22 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2014-07-09 07:11 . 2014-05-22 15:22 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys 2014-07-09 07:11 . 2014-05-22 15:22 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys 2014-07-09 07:11 . 2014-07-09 07:11 43152 ----a-w- c:\windows\avastSS.scr 2014-07-09 07:11 . 2014-05-22 15:22 276432 ----a-w- c:\windows\system32\aswBoot.exe . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-07-09 07:11 578240 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-14 1541416] "TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-03-13 68976] "LENOVO.TPFNF6R"="c:\program files\Lenovo\HOTKEY\TPFNF6R.exe" [2009-08-20 62752] "picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2009-08-04 358424] "TpShocks"="TpShocks.exe" [2009-07-08 337184] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-24 174104] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-24 151064] "PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2009-08-23 709920] "cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2009-08-26 3089720] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-11-04 980368] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 43816] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-01 4085896] "FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2014-03-18 373760] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-09-01 152392] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableSecureUIAPath"= 1 (0x1) . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk backup=c:\windows\pss\Bluetooth.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RCIMGDIR.exe.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\RCIMGDIR.exe.lnk backup=c:\windows\pss\RCIMGDIR.exe.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TeamSIP 2go.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TeamSIP 2go.lnk backup=c:\windows\pss\TeamSIP 2go.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^6120.lnk] path=c:\users\Markus ******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6120.lnk backup=c:\windows\pss\6120.lnk.Startup backupExtension=.Startup . [HKLM\~\startupfolder\C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^aj7zfy.lnk] path=c:\users\Markus ******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aj7zfy.lnk backup=c:\windows\pss\aj7zfy.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FingerPrintSoftware] c:\program files\Lenovo Fingerprint Software\fpapp.exe \s [X] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Message Center Plus] 2009-05-27 21:09 49976 ------w- c:\program files\Lenovo\Message Center Plus\MCPLaunch.exe . R2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [x] R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-07-09 71944] R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2009-07-03 45424] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-04-03 315008] R3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [2009-08-31 106496] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-08-18 108032] R3 PCDSRVC{C4B36920-79E24793-06000000}_0;PCDSRVC{C4B36920-79E24793-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\pcdsrvc.pkms [2009-08-18 20848] R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-08-23 75040] R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-08-04 1124848] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-10 1343400] S0 aswRvrt;avast! Revert; [x] S0 aswVmm;avast! VM Monitor; [x] S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2009-06-29 20520] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-07-09 779536] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-07-09 414520] S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2008-05-12 13480] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-24 172032] S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-07-09 24184] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-07-09 67824] S2 ATService;AuthenTec Fingerprint Service;c:\windows\system32\AtService.exe [2009-08-31 1692920] S2 dtsvc;Data Transfer Service;c:\windows\system32\DTS.exe [2009-08-31 98304] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992] S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032] S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2009-07-15 62320] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2009-08-04 2058776] S3 5U875UVC;Integrated Camera;c:\windows\system32\DRIVERS\5U875.sys [2009-07-08 72320] S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-09-01 485376] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472] S3 e1yexpress;Intel(R) Gigabit-Netzwerkverbindungstreiber;c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016] S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd32.sys [2009-08-24 5924864] S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-05-13 4231680] S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2009-07-02 38336] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HsfXAudioService REG_MULTI_SZ HsfXAudioService . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-09-25 06:47 1096520 ----a-w- c:\program files\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-10-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 15:57] . 2014-10-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 15:51] . 2014-10-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 15:51] . 2014-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job - c:\users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23 18:41] . 2014-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job - c:\users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23 18:41] . 2014-03-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-08-25 23:12] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.1.1 DPF: {439B6D3C-A359-4D73-8515-2AFE8CF90C08} - hxxp://www.tradesignalonline.com/charts/bin/axts5we.cab . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{C4B36920-79E24793-06000000}_0] "ImagePath"="\??\c:\progra~1\pc-doc~1\pcdsrvc.pkms" . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- . - - - - - - - > 'Explorer.exe'(17468) c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL c:\progra~1\ThinkPad\UTILIT~1\GR\PWMRT32V.DLL . Zeit der Fertigstellung: 2014-10-06 19:29:09 ComboFix-quarantined-files.txt 2014-10-06 17:29 . Vor Suchlauf: 16 Verzeichnis(se), 103.666.667.520 Bytes frei Nach Suchlauf: 17 Verzeichnis(se), 104.053.309.440 Bytes frei . - - End Of File - - 4B7C1E8E0AB40A967F28853E004E8D75 FB04B46BFD351D0484624D390F1BA191 |
07.10.2014, 13:56 | #6 |
/// the machine /// TB-Ausbilder | Deutlicher Leistungsabfall Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Deutlicher Leistungsabfall |
07.10.2014, 19:46 | #7 |
| Deutlicher Leistungsabfall MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 07.10.2014 Suchlauf-Zeit: 19:42:48 Logdatei: MBAM.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.10.07.11 Rootkit Datenbank: v2014.09.19.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Markus ****** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 347819 Verstrichene Zeit: 8 Min, 38 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) AdwCleaner: Code:
ATTFilter # AdwCleaner v3.311 - Bericht erstellt am 07/10/2014 um 20:13:47 # Aktualisiert 30/09/2014 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits) # Benutzername : Markus ****** - MARKUS****** # Gestartet von : C:\Users\Markus ******\Desktop\AdwCleaner_3.311.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17280 -\\ Mozilla Firefox v [ Datei : C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\prefs.js ] -\\ Google Chrome v37.0.2062.124 [ Datei : C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [994 octets] - [07/10/2014 20:10:55] AdwCleaner[S0].txt - [916 octets] - [07/10/2014 20:13:47] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [975 octets] ########## JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.3.1 (10.06.2014:1) OS: Windows 7 Professional x86 Ran by Markus ****** on 07.10.2014 at 20:25:23,66 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files Successfully deleted: [File] C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 07.10.2014 at 20:27:18,79 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 01 Ran by Markus ****** (administrator) on MARKUS****** on 07-10-2014 20:40:17 Running from C:\Users\Markus ******\Desktop Loaded Profile: Markus ****** (Available profiles: Markus ******) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) () C:\Windows\System32\DTS.exe (Lenovo) C:\Windows\System32\ibmpmsvc.exe (AuthenTec, Inc.) C:\Windows\System32\AtService.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Lenovo.) C:\Windows\System32\TpShocks.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\password_manager.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe (Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Lenovo Group Limited) C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe (Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1541416 2009-07-14] (Synaptics Incorporated) HKLM\...\Run: [TPHOTKEY] => C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [68976 2009-03-13] (Lenovo Group Limited) HKLM\...\Run: [LENOVO.TPFNF6R] => C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe [62752 2009-08-20] (Lenovo Group Limited) HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358424 2009-08-04] (Intel Corporation) HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [337184 2009-07-08] (Lenovo.) HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor HKLM\...\Run: [cssauth] => C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [3089720 2009-08-26] (Lenovo Group Limited) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [980368 2010-11-04] (The Eraser Project) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-01] (AVAST Software) HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKU\S-1-5-21-1732376492-3782921457-3814634441-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01 SearchScopes: HKLM - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: IePasswordManagerHelper Class -> {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} -> C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {439B6D3C-A359-4D73-8515-2AFE8CF90C08} hxxp://www.tradesignalonline.com/charts/bin/axts5we.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default FF SearchEngineOrder.1: Microsoft (Bing) FF Homepage: https://www.google.de/ FF Keyword.URL: hxxp://www.bing.com/search FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\searchplugins\bing-avast.xml FF Extension: Tradesignal Online Chart - C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f} [2014-09-09] FF HKLM\...\Firefox\Extensions: [{3112ca9c-de6d-4884-a869-9855de68056c}] - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} FF Extension: Google Toolbar for Firefox - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010-12-24] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-22] FF HKCU\...\Firefox\Extensions: [{FCF36B88-1BBA-487f-B64B-D2E8980A9293}] - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension FF Extension: ThinkVantage Password Manager - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension [2010-12-22] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR HomePage: Default -> CHR CustomProfile: C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-17] CHR Extension: (Google Docs) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-17] CHR Extension: (Google Drive) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-17] CHR Extension: (YouTube) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-17] CHR Extension: (Google-Suche) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-17] CHR Extension: (Google Tabellen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-17] CHR Extension: (avast! Online Security) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-17] CHR Extension: (Google Wallet) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-17] CHR Extension: (Google Mail) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-17] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-09] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [124192 2009-09-04] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [242976 2009-09-04] (Lenovo) S3 ADMonitor; C:\Windows\system32\ADMonitor.exe [106496 2009-09-01] () [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-09] (AVAST Software) R2 dtsvc; C:\Windows\system32\DTS.exe [98304 2009-09-01] () [File not signed] S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [45424 2009-07-03] (Lenovo Group Limited) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed] R2 SUService; C:\Program Files\Lenovo\System Update\SUService.exe [28672 2011-02-18] (Lenovo Group Limited) [File not signed] R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-08-04] (Intel Corporation) S2 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 5U875UVC; C:\Windows\System32\DRIVERS\5U875.sys [72320 2009-07-08] (Ricoh co.,Ltd.) R3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [5073920 2009-08-24] (ATI Technologies Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-07-09] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-07-09] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-07-09] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-07-09] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-07-09] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-07-09] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-07-09] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-07-09] () R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [5924864 2009-08-24] (Intel Corporation) S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] S3 catchme; \??\C:\Users\MARKUS~1\AppData\Local\Temp\catchme.sys [X] S3 PCDSRVC{C4B36920-79E24793-06000000}_0; \??\c:\progra~1\pc-doc~1\pcdsrvc.pkms [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 20:40 - 2014-10-07 20:41 - 00017521 _____ () C:\Users\Markus ******\Desktop\FRST.txt 2014-10-07 20:27 - 2014-10-07 20:27 - 00000722 _____ () C:\Users\Markus ******\Desktop\JRT.txt 2014-10-07 20:24 - 2014-10-07 20:24 - 01705141 _____ (Thisisu) C:\Users\Markus ******\Desktop\JRT.exe 2014-10-07 20:18 - 2014-10-07 20:18 - 00001054 _____ () C:\Users\Markus ******\Desktop\AdwCleaner[S0].txt 2014-10-07 20:16 - 2014-10-07 20:16 - 00001024 _____ () C:\.rnd 2014-10-07 20:10 - 2014-10-07 20:13 - 00000000 ____D () C:\AdwCleaner 2014-10-07 20:09 - 2014-10-07 20:09 - 00001167 _____ () C:\Users\Markus ******\Desktop\MBAM.txt 2014-10-07 19:40 - 2014-10-07 19:40 - 01375089 _____ () C:\Users\Markus ******\Desktop\AdwCleaner_3.311.exe 2014-10-06 19:29 - 2014-10-06 19:29 - 00018314 _____ () C:\ComboFix.txt 2014-10-06 19:13 - 2014-10-06 19:29 - 00000000 ____D () C:\Qoobox 2014-10-06 19:13 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-10-06 19:13 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-10-06 19:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-10-06 09:57 - 2014-10-06 09:57 - 05582481 ____R (Swearware) C:\Users\Markus ******\Desktop\ComboFix.exe 2014-10-05 11:43 - 2014-10-07 20:40 - 00000000 ____D () C:\FRST 2014-10-05 11:42 - 2014-10-07 19:30 - 01101312 _____ (Farbar) C:\Users\Markus ******\Desktop\FRST.exe 2014-10-04 20:26 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-09-24 17:57 - 2014-09-24 18:21 - 00002022 ____H () C:\Users\Markus ******\Documents\Default.rdp 2014-09-24 16:28 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-17 09:21 - 2014-09-17 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-09-16 11:12 - 2014-09-16 11:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iPod 2014-09-15 13:02 - 2014-09-16 12:16 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-11 20:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-11 20:13 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-11 20:13 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-11 20:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-11 20:13 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-11 20:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-11 20:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-11 20:13 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-11 20:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-11 20:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-11 20:13 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-11 20:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-11 20:13 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-11 20:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-11 20:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-11 20:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-11 20:13 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-11 20:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-11 20:13 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-11 20:13 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-11 20:13 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-11 20:13 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-11 20:13 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-11 20:13 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-11 20:12 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-11 18:30 - 2012-02-11 07:37 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe 2014-09-11 18:28 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-11 18:28 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-11 18:28 - 2011-02-25 07:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe 2014-09-09 18:33 - 2014-09-09 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2014-09-09 18:18 - 2014-09-09 18:18 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-09-09 18:14 - 2012-07-26 04:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys 2014-09-09 18:14 - 2012-07-26 04:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys 2014-09-09 18:13 - 2012-07-26 05:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe 2014-09-09 18:13 - 2012-07-26 05:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll 2014-09-09 18:13 - 2012-06-02 16:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2014-09-09 18:08 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2014-09-09 18:08 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2014-09-09 17:49 - 2013-10-04 03:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2014-09-09 17:49 - 2013-10-04 03:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2014-09-09 17:49 - 2012-08-22 19:16 - 00712048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys 2014-09-09 17:49 - 2012-07-04 21:45 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-09-09 17:48 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-09-09 17:48 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-09-09 17:48 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-09-09 17:48 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-09-09 17:48 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2014-09-09 17:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2014-09-09 17:48 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2014-09-09 17:48 - 2013-03-19 05:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll 2014-09-09 17:48 - 2013-01-24 06:47 - 00196328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2014-09-09 17:48 - 2012-10-03 18:42 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll 2014-09-09 17:48 - 2012-10-03 18:40 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-09-09 17:48 - 2012-10-03 17:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys 2014-09-09 17:48 - 2012-08-21 22:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe 2014-09-09 17:48 - 2012-07-06 21:23 - 00393728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys 2014-09-09 17:48 - 2011-12-30 07:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl 2014-09-09 17:48 - 2011-06-16 06:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll 2014-09-09 17:48 - 2011-03-11 07:39 - 00143744 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys 2014-09-09 17:48 - 2011-03-11 07:39 - 00117120 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00332160 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00080256 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00022400 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys 2014-09-09 17:48 - 2011-03-11 07:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll 2014-09-09 17:48 - 2011-03-11 07:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe 2014-09-09 17:48 - 2011-03-11 06:01 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-09-09 17:48 - 2011-02-18 07:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe 2014-09-09 17:47 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-09-09 17:47 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-09-09 17:47 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll 2014-09-09 17:47 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll 2014-09-09 17:47 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs 2014-09-09 17:47 - 2012-05-05 09:46 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2014-09-09 17:47 - 2011-05-04 06:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll 2014-09-09 17:47 - 2011-05-04 06:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe 2014-09-09 17:46 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-09-09 17:46 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-09-09 17:46 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-09-09 17:46 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2014-09-09 17:46 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2014-09-09 17:46 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2014-09-09 17:46 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2014-09-09 17:46 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll 2014-09-09 17:46 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll 2014-09-09 17:46 - 2012-05-01 06:44 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2014-09-09 17:46 - 2012-01-04 10:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll 2014-09-09 17:00 - 2014-09-09 17:56 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Windows Live Writer 2014-09-09 17:00 - 2014-09-09 17:00 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live Writer 2014-09-09 15:30 - 2014-09-09 15:30 - 00001291 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00001222 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00000000 ____D () C:\Windows\de 2014-09-09 15:29 - 2014-09-09 15:29 - 00001375 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2014-09-09 15:29 - 2014-09-09 15:29 - 00000020 _____ () C:\Windows\ÀøÉ 2014-09-09 15:29 - 2014-09-09 15:29 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition 2014-09-09 15:27 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2014-09-09 15:27 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2014-09-09 15:26 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2014-09-09 15:24 - 2014-09-22 11:58 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live 2014-09-09 15:18 - 2014-09-09 15:18 - 01245384 _____ (Microsoft Corporation) C:\Users\Markus ******\Downloads\wlsetup-web.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 20:31 - 2012-04-07 20:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-07 20:26 - 2013-07-23 20:41 - 00001156 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job 2014-10-07 20:22 - 2010-12-22 18:47 - 01637087 _____ () C:\Windows\WindowsUpdate.log 2014-10-07 20:22 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-07 20:22 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-07 20:16 - 2014-06-01 22:09 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\FreePDF_XP 2014-10-07 20:16 - 2014-05-22 14:17 - 00001024 _____ () C:\Users\Markus ******\.rnd 2014-10-07 20:16 - 2010-12-24 17:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-07 20:14 - 2013-09-17 12:49 - 00029724 _____ () C:\Windows\setupact.log 2014-10-07 20:14 - 2010-12-22 18:42 - 00115498 _____ () C:\Windows\PFRO.log 2014-10-07 20:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-07 19:46 - 2010-12-24 17:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-07 19:42 - 2014-05-19 21:29 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-07 19:26 - 2013-07-23 20:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job 2014-10-06 19:27 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-10-06 19:12 - 2014-05-21 08:20 - 00000000 ____D () C:\Windows\erdnt 2014-10-06 17:47 - 2009-07-21 07:30 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-10-05 08:03 - 2012-08-04 15:24 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Dropbox 2014-10-05 07:56 - 2012-08-04 15:32 - 00000000 ___RD () C:\Users\Markus ******\Dropbox 2014-09-24 21:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-24 17:57 - 2012-04-07 20:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-24 17:57 - 2011-05-16 07:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-24 17:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Google 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Program Files\Google 2014-09-17 09:19 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Deployment 2014-09-17 09:19 - 2010-12-23 14:19 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Apps\2.0 2014-09-16 11:11 - 2012-05-05 16:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-09-15 09:06 - 2010-12-23 21:25 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 10:59 - 2011-11-17 19:58 - 00000000 ____D () C:\Users\Markus ******\Desktop\temp 2014-09-12 09:23 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-11 20:15 - 2011-06-05 14:56 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-11 20:11 - 2013-07-11 23:30 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-11 20:07 - 2010-12-24 12:20 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-11 09:12 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-09 18:42 - 2010-12-23 13:39 - 00124728 _____ () C:\Users\Markus ******\AppData\Local\GDIPFONTCACHEV1.DAT 2014-09-09 18:39 - 2009-07-14 06:33 - 03802808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-09 18:37 - 2012-07-13 16:08 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-09 18:35 - 2010-12-23 03:30 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-09-09 18:20 - 2011-06-05 14:56 - 00000000 ____D () C:\Program Files\Microsoft Office 2014-09-09 18:09 - 2012-07-13 16:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-09-09 18:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-09-09 18:05 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\System 2014-09-09 18:05 - 2009-07-14 04:04 - 00000478 _____ () C:\Windows\win.ini 2014-09-09 15:29 - 2010-12-22 18:57 - 00000000 ____D () C:\Program Files\Windows Live Some content of TEMP: ==================== C:\Users\Markus ******\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 09:18 ==================== End Of Log ============================ --- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06-10-2014 01 Ran by Markus ****** at 2014-10-07 20:41:21 Running from C:\Users\Markus ******\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Registry Patch to arrange icons in Device and Printers folder of Windows 7 (HKLM\...\W7DevOR) (Version: 1.00 - ) 2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) 2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden 7-Zip 9.22beta (HKLM\...\7-Zip) (Version: - ) Access Help (HKLM\...\{C6FA39A7-26B1-480A-BC74-6D17531AC222}) (Version: 3.00 - Lenovo) ActiveTrader Deutschland (HKLM\...\{0DE75F32-3E22-42F7-B6CD-5A6644581F4E}) (Version: 6.1.1 - Cortal Consors) Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 5.32.00 - ) Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{C0CC75CD-F5B7-46AD-B016-17C0F5171718}) (Version: 8.0.0.23 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AT&T Service Activation (HKLM\...\{D81486A1-2371-4059-AC70-1AB894AC96E6}) (Version: 1.8.7.0 - AT&T) ATI Catalyst Install Manager (HKLM\...\{10EBB6AD-673B-EE60-7D3D-7C438E5F9BE5}) (Version: 3.0.736.0 - ATI Technologies, Inc.) ATI Uninstaller (HKLM\...\ATI Uninstaller) (Version: 8.641.1-090825m-087782C-Lenovo - ATI Technologies, Inc.) avast! Free Antivirus (HKLM\...\Avast) (Version: 9.0.2021 - AVAST Software) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Core Implementation (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full Existing (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full New (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Light (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center InstallProxy (Version: 2009.0825.2146.37269 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (Version: 2009.0825.2146.37269 - ATI) Hidden CCC Help Chinese Standard (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Chinese Traditional (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Dutch (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help English (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help French (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help German (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Italian (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Japanese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Korean (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Portuguese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Spanish (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Swedish (Version: 2009.0825.2145.37269 - ATI) Hidden ccc-core-static (Version: 2009.0825.2146.37269 - Ihr Firmenname) Hidden ccc-utility (Version: 2009.0825.2146.37269 - ATI) Hidden CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP) Client Security - Password Manager (HKLM\...\{18554B3F-46EA-40A9-B4EA-7EEE83C0559D}) (Version: 8.30.0023.00 - Lenovo Group Limited) Conexant 20561 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.92.10.0 - Conexant) Create Recovery Media (HKLM\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden Dienstprogramm "ThinkPad UltraNav" (HKLM\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.11 - Lenovo) DirectX 9 Runtime (Version: 1.00.0000 - Sonic Solutions) Hidden ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen) Eraser 6.0.8.2273 (HKLM\...\{392A74D0-4DFE-49F7-87C3-8A61708F8856}) (Version: 6.0.2273 - The Eraser Project) Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Free Fire Screensaver (HKLM\...\Free Fire Screensaver) (Version: - Laconic Software) FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - ) Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.) Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Toolbar for Firefox (HKLM\...\{2CCBABCB-6427-4A55-B091-49864623C43F}) (Version: 7.1.20101113 - Google Inc.) Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.) Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.) Integrated Camera Driver Installer Package Ver.1.27.500.0 (HKLM\...\{82EB6CEA-749A-410F-8AD2-372A286BA3BE}) (Version: 1.27.500.0 - RICOH) Integrated Camera TWAIN (HKLM\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.7.331 - Chicony Electronics Co.,Ltd.) Intel(R) Management Engine Interface (HKLM\...\HECI) (Version: - Intel Corporation) Intel® Active-Management-Technologie (HKLM\...\MESOL) (Version: - Intel Corporation) InterVideo WinDVD 8 (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0.20.112 - InterVideo Inc.) InterVideo WinDVD 8 (Version: 8.0.20.112 - InterVideo Inc.) Hidden iTunes (HKLM\...\{F32DC846-4457-40A8-BECA-BCC0E960BC53}) (Version: 11.4.0.18 - Apple Inc.) Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle) Java 8 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218020F0}) (Version: 8.0.200 - Oracle Corporation) Java Auto Updater (Version: 2.8.20.26 - Oracle Corporation) Hidden Java SE Development Kit 7 Update 55 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170550}) (Version: 1.7.0.550 - Oracle) Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Lenovo Fingerprint Software (HKLM\...\{2D440AF4-7330-43F0-A085-35DE1A90E703}) (Version: 3.3.0.50 - AuthenTec, Inc.) Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.01 - ) Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5387.13 - PC-Doctor, Inc.) Lenovo Welcome (HKLM\...\Lenovo Welcome_is1) (Version: 2.0.018.0 - Lenovo) Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Message Center Plus (HKLM\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited) Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Research AutoCollage Touch 2009 (HKLM\...\{1F8DA253-3C27-4B01-A63A-BA3533120833}) (Version: 2.00.2009 - Microsoft Research) Microsoft Search Enhancement Pack (Version: 1.2.121.0 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50701 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.50706 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.50701 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50701 - Microsoft Corporation) Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000 - Adobe) Hidden Mobile Broadband Connect (HKLM\...\{5C111F14-D9BE-459D-B0B6-B4D082F03749}) (Version: 3.5.0006 - Lenovo) Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd) Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) PX Profile Update (Version: 1.00.1. - AMD) Hidden RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd) Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - ) Rescue and Recovery (HKLM\...\{B383F243-0ABC-4E56-AA30-923B8D85076E}) (Version: 4.30.0025.00 - Lenovo Group Limited) Roxio Activation Module (Version: 1.0 - Roxio) Hidden Roxio Central Audio (Version: 3.8.0 - Roxio) Hidden Roxio Central Copy (Version: 3.8.0 - Roxio) Hidden Roxio Central Core (Version: 3.8.0 - Roxio) Hidden Roxio Central Data (Version: 3.8.0 - Roxio) Hidden Roxio Central Tools (Version: 3.8.0 - Roxio) Hidden Roxio Creator Business Edition (HKLM\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio) Roxio Creator Business Edition (Version: 10.3.081 - Roxio) Hidden Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) Sonic CinePlayer Decoder Pack (Version: 4.3.0 - Sonic Solutions) Hidden Sonic Icons for Lenovo (HKLM\...\{B334D9AE-1393-423E-97C0-3BDC3360E692}) (Version: 2.0.0 - Lenovo) System Update (HKLM\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 4.00.0046 - Lenovo) TeamSIP 2go (HKLM\...\{B303639A-2CDF-42A1-8532-0E3338CE5A6D}) (Version: 2.5.14 - TeamFON GmbH) TeamSIP 2go (Version: 2.5.14 - TeamFON GmbH) Hidden ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9600 - Broadcom Corporation) ThinkPad Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.04 - ) ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.06 - ) ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems) ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.55 - ) ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.4.12 - ) ThinkVantage Access Connections (HKLM\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.40 - Lenovo) ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.70 - Lenovo) Tradesignal Online Chart (HKLM\...\{3FB043FD-4C4C-4E99-8678-BA00A465C3F8}) (Version: 7.3.0.15 - Tradesignal GmbH) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) Verizon Wireless Mobile Broadband Self Activation (HKLM\...\{7A408D56-A9CF-4219-9F78-23E6B48A1C0D}) (Version: 3.1.1 - Smith Micro Software, Inc.) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - ) Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (07/07/2009 8.1.2.56) (HKLM\...\8E6CE26AD682E6D46DCCDD39CD93277A2EAF2449) (Version: 07/07/2009 8.1.2.56 - AuthenTec Inc.) Windows-Treiberpaket - Intel System (06/04/2009 1.0.0.0002) (HKLM\...\E7B58217635B8F723D4744A328A4B3237DB35FA9) (Version: 06/04/2009 1.0.0.0002 - Intel) Windows-Treiberpaket - Lenovo 1.55 (08/18/2009 1.55) (HKLM\...\112AA64E0C8CC704E307FE914F7DEC1C0035598E) (Version: 08/18/2009 1.55 - Lenovo) Windows-Treiberpaket - Ricoh (5U875UVC) Image (07/08/2009 1.27.500.0) (HKLM\...\E59560E2F5B162D40255FCD327ACA5E989D995D2) (Version: 07/08/2009 1.27.500.0 - Ricoh) Windows-Treiberpaket - Ricoh Company (rimsptsk) hdc (06/25/2009 6.10.01.03) (HKLM\...\D91056A9B3130B90EC1BB37F232FA5C4D61DF66F) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Windows-Treiberpaket - Ricoh Company (rismxdp) hdc (06/25/2009 6.10.01.04) (HKLM\...\414685941AB074B2478B18498E0CCA85F81CCBE6) (Version: 06/25/2009 6.10.01.04 - Ricoh Company) Windows-Treiberpaket - Ricoh Company MMC Host Controller (06/25/2009 6.10.01.03) (HKLM\...\6F84AC23718E31DE66E2EBEDAE047257F4E785D0) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Wise Registry Cleaner 8.11 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.11 - WiseCleaner.com, Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Chrome\Application\34.0.1847.137\delegate_execute.exe" (the data entry has 8 more characters). CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File ==================== Restore Points ========================= 04-10-2014 18:26:13 Windows Update 04-10-2014 20:59:22 Windows Update 06-10-2014 17:13:40 ComboFix created restore point ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:04 - 2014-05-21 08:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0DEE7595-F069-449D-B9C9-FC3C78F2B6DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {36991A1E-6A6C-487A-8A5D-8B38DB72BB0D} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2009-08-23] (Lenovo Group Limited) Task: {3CFBA15D-48A7-4242-8658-D2779DA6F044} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {5245162F-8F9D-42AD-A58A-C31EE8FEE18E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated) Task: {6AF8D474-2932-4846-9749-69375C8508E5} - \PCDoctorBackgroundMonitorTask No Task File <==== ATTENTION Task: {6B4630C1-04C0-40E6-A068-29B93D900C94} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {96BA89CD-37E1-4951-8F32-BA6A465FE18F} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe Task: {97901924-BA6B-4546-894C-D4FBDE36A724} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {97AC3792-9BD1-45B3-A57F-6EF4DB6B4447} - System32\Tasks\JavaUpdateSched => C:\Windows\System32\jusched.exe Task: {B96F4CCE-CE64-4CAD-B9AE-269275568224} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe Task: {D5B4032B-7340-4B43-893C-B753E7A189F5} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe Task: {EF3D195A-B55E-4A5B-8E41-E27B949690AC} - System32\Tasks\{49C7F31D-7E66-4DDB-A4B5-F1BF4327AFC7} => C:\Program Files\Skype\\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.) Task: {F988FF61-E194-44DA-BA0D-DBF8A3833ECD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-09] (AVAST Software) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe ==================== Loaded Modules (whitelisted) ============= 2009-09-01 00:32 - 2009-09-01 00:32 - 00098304 ____N () C:\Windows\system32\DTS.exe 2014-07-09 09:11 - 2014-07-09 09:11 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-10-07 20:15 - 2014-10-07 20:15 - 02859008 _____ () C:\Program Files\AVAST Software\Avast\defs\14100702\algo.dll 2014-06-01 22:08 - 2012-06-21 07:25 - 00094208 _____ () C:\Windows\System32\redmon32.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2014-07-09 09:11 - 2014-07-09 09:11 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-03-31 21:35 - 2014-03-31 21:35 - 00282304 _____ () C:\Program Files\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RCIMGDIR.exe.lnk => C:\Windows\pss\RCIMGDIR.exe.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TeamSIP 2go.lnk => C:\Windows\pss\TeamSIP 2go.lnk.CommonStartup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^6120.lnk => C:\Windows\pss\6120.lnk.Startup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^aj7zfy.lnk => C:\Windows\pss\aj7zfy.lnk.Startup MSCONFIG\startupreg: FingerPrintSoftware => "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s MSCONFIG\startupreg: Message Center Plus => C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start ========================= Accounts: ========================== Administrator (S-1-5-21-1732376492-3782921457-3814634441-500 - Administrator - Disabled) Gast (S-1-5-21-1732376492-3782921457-3814634441-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1732376492-3782921457-3814634441-1003 - Limited - Enabled) Markus ****** (S-1-5-21-1732376492-3782921457-3814634441-1000 - Administrator - Enabled) => C:\Users\Markus ****** ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= Error: (12/10/2013 10:04:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 283 seconds with 180 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:35:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 138 seconds with 120 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:32:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 34 seconds with 0 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:30:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 21691 seconds with 2880 seconds of active time. This session ended with a crash. Error: (02/11/2013 11:50:41 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4233 seconds with 2520 seconds of active time. This session ended with a crash. Error: (05/24/2012 06:13:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1365 seconds with 420 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz Percentage of memory in use: 48% Total physical RAM: 2520.03 MB Available physical RAM: 1306.15 MB Total Pagefile: 6298.32 MB Available Pagefile: 4837.42 MB Total Virtual: 2047.88 MB Available Virtual: 1909.92 MB ==================== Drives ================================ Drive c: (Windows7_OS) (Fixed) (Total:286.66 GB) (Free:96.7 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive q: (Lenovo_Recovery) (Fixed) (Total:10.25 GB) (Free:4.99 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298.1 GB) (Disk ID: 504A2363) Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=286.7 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=10.3 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
08.10.2014, 12:54 | #8 |
/// the machine /// TB-Ausbilder | Deutlicher LeistungsabfallESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
08.10.2014, 16:18 | #9 |
| Deutlicher Leistungsabfall ESET hat eine Bedrohung gefunden! Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=5ded5c7bc6138348bac09b5f878c0699 # engine=20499 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2014-10-08 02:57:25 # local_time=2014-10-08 04:57:25 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='avast! Antivirus' # compatibility_mode=783 16777213 100 91 333251 12008086 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 29681 164411436 0 0 # scanned=234743 # found=1 # cleaned=0 # scan_time=6205 sh=39FA43B48884C81CA37A836169EB5828FF8CD47D ft=0 fh=0000000000000000 vn="LNK/Agent.AZ Trojaner" ac=I fn="C:\Windows\pss\aj7zfy.lnk.Startup" Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.87 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Wise Registry Cleaner 8.11 Java 7 Update 60 Java 8 Update 20 Java SE Development Kit 7 Update 55 Java version out of Date! Adobe Flash Player 15.0.0.152 Mozilla Firefox (for.) Google Chrome 37.0.2062.120 Google Chrome 37.0.2062.124 ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast avastui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 01 Ran by Markus ****** (administrator) on MARKUS****** on 08-10-2014 17:12:03 Running from C:\Users\Markus ******\Desktop Loaded Profile: Markus ****** (Available profiles: Markus ******) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) () C:\Windows\System32\DTS.exe (Lenovo) C:\Windows\System32\ibmpmsvc.exe (AuthenTec, Inc.) C:\Windows\System32\AtService.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Lenovo) C:\Program Files\Lenovo\Access Connections\AcSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe (Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Lenovo Group Limited) C:\Program Files\Lenovo\System Update\SUService.exe (Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpfnf6r.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Lenovo.) C:\Windows\System32\TpShocks.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\password_manager.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Lenovo) C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1541416 2009-07-14] (Synaptics Incorporated) HKLM\...\Run: [TPHOTKEY] => C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [68976 2009-03-13] (Lenovo Group Limited) HKLM\...\Run: [LENOVO.TPFNF6R] => C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe [62752 2009-08-20] (Lenovo Group Limited) HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [358424 2009-08-04] (Intel Corporation) HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [337184 2009-07-08] (Lenovo.) HKLM\...\Run: [PWMTRV] => rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor HKLM\...\Run: [cssauth] => C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [3089720 2009-08-26] (Lenovo Group Limited) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [980368 2010-11-04] (The Eraser Project) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-01] (AVAST Software) HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKU\S-1-5-21-1732376492-3782921457-3814634441-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01 SearchScopes: HKLM - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = SearchScopes: HKCU - {A95222CF-BCDF-49E9-8CA6-B58BF7C0BD80} URL = BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: IePasswordManagerHelper Class -> {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} -> C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {439B6D3C-A359-4D73-8515-2AFE8CF90C08} hxxp://www.tradesignalonline.com/charts/bin/axts5we.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default FF SearchEngineOrder.1: Microsoft (Bing) FF Homepage: https://www.google.de/ FF Keyword.URL: hxxp://www.bing.com/search FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\searchplugins\bing-avast.xml FF Extension: Tradesignal Online Chart - C:\Users\Markus ******\AppData\Roaming\Mozilla\Firefox\Profiles\ru8zppbh.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f} [2014-09-09] FF HKLM\...\Firefox\Extensions: [{3112ca9c-de6d-4884-a869-9855de68056c}] - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} FF Extension: Google Toolbar for Firefox - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010-12-24] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-22] FF HKCU\...\Firefox\Extensions: [{FCF36B88-1BBA-487f-B64B-D2E8980A9293}] - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension FF Extension: ThinkVantage Password Manager - C:\Program Files\Lenovo\Client Security Solution\PWM Firefox Extension [2010-12-22] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR HomePage: Default -> CHR CustomProfile: C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-17] CHR Extension: (Google Docs) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-17] CHR Extension: (Google Drive) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-17] CHR Extension: (YouTube) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-17] CHR Extension: (Google-Suche) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-17] CHR Extension: (Google Tabellen) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-17] CHR Extension: (avast! Online Security) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-17] CHR Extension: (Google Wallet) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-17] CHR Extension: (Google Mail) - C:\Users\Markus ******\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-17] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-09] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AcPrfMgrSvc; C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe [124192 2009-09-04] (Lenovo) R2 AcSvc; C:\Program Files\Lenovo\Access Connections\AcSvc.exe [242976 2009-09-04] (Lenovo) S3 ADMonitor; C:\Windows\system32\ADMonitor.exe [106496 2009-09-01] () [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-09] (AVAST Software) R2 dtsvc; C:\Windows\system32\DTS.exe [98304 2009-09-01] () [File not signed] S2 LENOVO.MICMUTE; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [45424 2009-07-03] (Lenovo Group Limited) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed] R2 SUService; C:\Program Files\Lenovo\System Update\SUService.exe [28672 2011-02-18] (Lenovo Group Limited) [File not signed] R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2009-08-04] (Intel Corporation) S2 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 5U875UVC; C:\Windows\System32\DRIVERS\5U875.sys [72320 2009-07-08] (Ricoh co.,Ltd.) R3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [5073920 2009-08-24] (ATI Technologies Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-07-09] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-07-09] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-07-09] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-07-09] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-07-09] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-07-09] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-07-09] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-07-09] () R3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd32.sys [5924864 2009-08-24] (Intel Corporation) S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] S3 catchme; \??\C:\Users\MARKUS~1\AppData\Local\Temp\catchme.sys [X] S3 PCDSRVC{C4B36920-79E24793-06000000}_0; \??\c:\progra~1\pc-doc~1\pcdsrvc.pkms [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-08 17:12 - 2014-10-08 17:12 - 00017542 _____ () C:\Users\Markus ******\Desktop\FRST.txt 2014-10-08 17:11 - 2014-10-08 17:11 - 00000934 _____ () C:\Users\Markus ******\Desktop\checkup.txt 2014-10-08 17:04 - 2014-10-08 17:04 - 00854417 _____ () C:\Users\Markus ******\Desktop\SecurityCheck.exe 2014-10-08 15:06 - 2014-10-08 15:06 - 02347384 _____ (ESET) C:\Users\Markus ******\Desktop\esetsmartinstaller_deu.exe 2014-10-08 08:43 - 2014-10-08 08:43 - 00001024 _____ () C:\.rnd 2014-10-07 20:27 - 2014-10-07 20:45 - 00000721 _____ () C:\Users\Markus ******\Desktop\JRT.txt 2014-10-07 20:24 - 2014-10-07 20:24 - 01705141 _____ (Thisisu) C:\Users\Markus ******\Desktop\JRT.exe 2014-10-07 20:18 - 2014-10-07 20:44 - 00001049 _____ () C:\Users\Markus ******\Desktop\AdwCleaner[S0].txt 2014-10-07 20:10 - 2014-10-07 20:13 - 00000000 ____D () C:\AdwCleaner 2014-10-07 20:09 - 2014-10-07 20:43 - 00001166 _____ () C:\Users\Markus ******\Desktop\MBAM.txt 2014-10-07 19:40 - 2014-10-07 19:40 - 01375089 _____ () C:\Users\Markus ******\Desktop\AdwCleaner_3.311.exe 2014-10-06 19:29 - 2014-10-06 19:29 - 00018314 _____ () C:\ComboFix.txt 2014-10-06 19:13 - 2014-10-06 19:29 - 00000000 ____D () C:\Qoobox 2014-10-06 19:13 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-10-06 19:13 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-10-06 19:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-10-06 19:13 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-10-06 09:57 - 2014-10-06 09:57 - 05582481 ____R (Swearware) C:\Users\Markus ******\Desktop\ComboFix.exe 2014-10-05 11:43 - 2014-10-08 17:12 - 00000000 ____D () C:\FRST 2014-10-05 11:42 - 2014-10-07 19:30 - 01101312 _____ (Farbar) C:\Users\Markus ******\Desktop\FRST.exe 2014-10-04 20:26 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2014-09-24 17:57 - 2014-09-24 18:21 - 00002022 ____H () C:\Users\Markus ******\Documents\Default.rdp 2014-09-24 16:28 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-17 09:21 - 2014-09-17 09:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-09-16 11:12 - 2014-09-16 11:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iTunes 2014-09-16 11:11 - 2014-09-16 11:11 - 00000000 ____D () C:\Program Files\iPod 2014-09-15 13:02 - 2014-09-16 12:16 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-11 20:13 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-11 20:13 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-11 20:13 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-11 20:13 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-11 20:13 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-11 20:13 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-11 20:13 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-11 20:13 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-11 20:13 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-11 20:13 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-11 20:13 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-11 20:13 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-11 20:13 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-11 20:13 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-11 20:13 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-11 20:13 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-11 20:13 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-11 20:13 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-11 20:13 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-11 20:13 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-11 20:13 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-11 20:13 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-11 20:13 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-11 20:13 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-11 20:13 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-11 20:13 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-11 20:13 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-11 20:12 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-11 18:30 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-11 18:30 - 2012-02-11 07:37 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe 2014-09-11 18:28 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-11 18:28 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-11 18:28 - 2011-02-25 07:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe 2014-09-09 18:33 - 2014-09-09 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2014-09-09 18:18 - 2014-09-09 18:18 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-09-09 18:14 - 2012-07-26 04:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys 2014-09-09 18:14 - 2012-07-26 04:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys 2014-09-09 18:13 - 2012-07-26 05:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe 2014-09-09 18:13 - 2012-07-26 05:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll 2014-09-09 18:13 - 2012-07-26 05:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll 2014-09-09 18:13 - 2012-06-02 16:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2014-09-09 18:08 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2014-09-09 18:08 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2014-09-09 17:49 - 2013-10-04 03:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2014-09-09 17:49 - 2013-10-04 03:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2014-09-09 17:49 - 2012-08-22 19:16 - 00712048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys 2014-09-09 17:49 - 2012-07-04 21:45 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-09-09 17:48 - 2014-02-04 04:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-09-09 17:48 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-09-09 17:48 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-09-09 17:48 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-09-09 17:48 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-09-09 17:48 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2014-09-09 17:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2014-09-09 17:48 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2014-09-09 17:48 - 2013-03-19 05:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll 2014-09-09 17:48 - 2013-01-24 06:47 - 00196328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2014-09-09 17:48 - 2012-10-03 18:42 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2014-09-09 17:48 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll 2014-09-09 17:48 - 2012-10-03 18:40 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-09-09 17:48 - 2012-10-03 17:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys 2014-09-09 17:48 - 2012-08-21 22:12 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe 2014-09-09 17:48 - 2012-07-06 21:23 - 00393728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys 2014-09-09 17:48 - 2011-12-30 07:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl 2014-09-09 17:48 - 2011-06-16 06:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll 2014-09-09 17:48 - 2011-03-11 07:39 - 00143744 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys 2014-09-09 17:48 - 2011-03-11 07:39 - 00117120 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00332160 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00080256 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys 2014-09-09 17:48 - 2011-03-11 07:38 - 00022400 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys 2014-09-09 17:48 - 2011-03-11 07:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll 2014-09-09 17:48 - 2011-03-11 07:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe 2014-09-09 17:48 - 2011-03-11 06:01 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-09-09 17:48 - 2011-02-18 07:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe 2014-09-09 17:47 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-09-09 17:47 - 2014-01-24 04:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-09-09 17:47 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll 2014-09-09 17:47 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll 2014-09-09 17:47 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs 2014-09-09 17:47 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs 2014-09-09 17:47 - 2012-05-05 09:46 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2014-09-09 17:47 - 2011-05-04 06:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll 2014-09-09 17:47 - 2011-05-04 06:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll 2014-09-09 17:47 - 2011-05-04 06:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe 2014-09-09 17:47 - 2011-05-04 06:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe 2014-09-09 17:46 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-09-09 17:46 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-09-09 17:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-09-09 17:46 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-09-09 17:46 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-09-09 17:46 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-09-09 17:46 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2014-09-09 17:46 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2014-09-09 17:46 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2014-09-09 17:46 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2014-09-09 17:46 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll 2014-09-09 17:46 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll 2014-09-09 17:46 - 2012-05-01 06:44 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2014-09-09 17:46 - 2012-01-04 10:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll 2014-09-09 17:00 - 2014-09-09 17:56 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Windows Live Writer 2014-09-09 17:00 - 2014-09-09 17:00 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live Writer 2014-09-09 15:30 - 2014-09-09 15:30 - 00001291 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00001222 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2014-09-09 15:30 - 2014-09-09 15:30 - 00000000 ____D () C:\Windows\de 2014-09-09 15:29 - 2014-09-09 15:29 - 00001375 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2014-09-09 15:29 - 2014-09-09 15:29 - 00000020 _____ () C:\Windows\ÀøÉ 2014-09-09 15:29 - 2014-09-09 15:29 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition 2014-09-09 15:27 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2014-09-09 15:27 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2014-09-09 15:27 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2014-09-09 15:26 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2014-09-09 15:24 - 2014-09-22 11:58 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Windows Live 2014-09-09 15:18 - 2014-09-09 15:18 - 01245384 _____ (Microsoft Corporation) C:\Users\Markus ******\Downloads\wlsetup-web.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-08 16:47 - 2010-12-24 17:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-08 16:31 - 2012-04-07 20:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-08 16:26 - 2013-07-23 20:41 - 00001156 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job 2014-10-08 10:15 - 2010-12-22 18:47 - 01673601 _____ () C:\Windows\WindowsUpdate.log 2014-10-08 08:44 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-08 08:44 - 2009-07-14 06:34 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-08 08:43 - 2014-06-01 22:09 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\FreePDF_XP 2014-10-08 08:43 - 2014-05-22 14:17 - 00001024 _____ () C:\Users\Markus ******\.rnd 2014-10-08 08:42 - 2010-12-24 17:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-08 08:37 - 2013-09-17 12:49 - 00029780 _____ () C:\Windows\setupact.log 2014-10-08 08:37 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-07 21:07 - 2010-12-23 13:32 - 00000000 ____D () C:\Users\Markus ****** 2014-10-07 20:14 - 2010-12-22 18:42 - 00115498 _____ () C:\Windows\PFRO.log 2014-10-07 19:42 - 2014-05-19 21:29 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-07 19:26 - 2013-07-23 20:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job 2014-10-06 19:27 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini 2014-10-06 19:12 - 2014-05-21 08:20 - 00000000 ____D () C:\Windows\erdnt 2014-10-06 17:47 - 2009-07-21 07:30 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-10-05 08:03 - 2012-08-04 15:24 - 00000000 ____D () C:\Users\Markus ******\AppData\Roaming\Dropbox 2014-09-24 21:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-24 17:57 - 2012-04-07 20:18 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-24 17:57 - 2011-05-16 07:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-24 17:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Google 2014-09-17 09:21 - 2010-12-24 17:51 - 00000000 ____D () C:\Program Files\Google 2014-09-17 09:19 - 2010-12-24 17:51 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Deployment 2014-09-17 09:19 - 2010-12-23 14:19 - 00000000 ____D () C:\Users\Markus ******\AppData\Local\Apps\2.0 2014-09-16 11:11 - 2012-05-05 16:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-09-15 09:06 - 2010-12-23 21:25 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 10:59 - 2011-11-17 19:58 - 00000000 ____D () C:\Users\Markus ******\Desktop\temp 2014-09-12 09:23 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-11 20:15 - 2011-06-05 14:56 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-11 20:11 - 2013-07-11 23:30 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-11 20:07 - 2010-12-24 12:20 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-11 09:12 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-09 18:42 - 2010-12-23 13:39 - 00124728 _____ () C:\Users\Markus ******\AppData\Local\GDIPFONTCACHEV1.DAT 2014-09-09 18:39 - 2009-07-14 06:33 - 03802808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-09 18:37 - 2012-07-13 16:08 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-09 18:35 - 2010-12-23 03:30 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-09-09 18:20 - 2011-06-05 14:56 - 00000000 ____D () C:\Program Files\Microsoft Office 2014-09-09 18:09 - 2012-07-13 16:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-09-09 18:07 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-09-09 18:05 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Common Files\System 2014-09-09 18:05 - 2009-07-14 04:04 - 00000478 _____ () C:\Windows\win.ini 2014-09-09 15:29 - 2010-12-22 18:57 - 00000000 ____D () C:\Program Files\Windows Live Some content of TEMP: ==================== C:\Users\Markus ******\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 09:18 ==================== End Of Log ============================ Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06-10-2014 01 Ran by Markus ****** at 2014-10-08 17:13:11 Running from C:\Users\Markus ******\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Registry Patch to arrange icons in Device and Printers folder of Windows 7 (HKLM\...\W7DevOR) (Version: 1.00 - ) 2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) 2007 Microsoft Office Suite Service Pack 3 (SP3) (Version: - Microsoft) Hidden 7-Zip 9.22beta (HKLM\...\7-Zip) (Version: - ) Access Help (HKLM\...\{C6FA39A7-26B1-480A-BC74-6D17531AC222}) (Version: 3.00 - Lenovo) ActiveTrader Deutschland (HKLM\...\{0DE75F32-3E22-42F7-B6CD-5A6644581F4E}) (Version: 6.1.1 - Cortal Consors) Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 5.32.00 - ) Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{C0CC75CD-F5B7-46AD-B016-17C0F5171718}) (Version: 8.0.0.23 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AT&T Service Activation (HKLM\...\{D81486A1-2371-4059-AC70-1AB894AC96E6}) (Version: 1.8.7.0 - AT&T) ATI Catalyst Install Manager (HKLM\...\{10EBB6AD-673B-EE60-7D3D-7C438E5F9BE5}) (Version: 3.0.736.0 - ATI Technologies, Inc.) ATI Uninstaller (HKLM\...\ATI Uninstaller) (Version: 8.641.1-090825m-087782C-Lenovo - ATI Technologies, Inc.) avast! Free Antivirus (HKLM\...\Avast) (Version: 9.0.2021 - AVAST Software) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Core Implementation (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full Existing (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Full New (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Light (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center Graphics Previews Vista (Version: 2009.0825.2146.37269 - ATI) Hidden Catalyst Control Center InstallProxy (Version: 2009.0825.2146.37269 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (Version: 2009.0825.2146.37269 - ATI) Hidden CCC Help Chinese Standard (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Chinese Traditional (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Dutch (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help English (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help French (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help German (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Italian (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Japanese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Korean (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Portuguese (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Spanish (Version: 2009.0825.2145.37269 - ATI) Hidden CCC Help Swedish (Version: 2009.0825.2145.37269 - ATI) Hidden ccc-core-static (Version: 2009.0825.2146.37269 - Ihr Firmenname) Hidden ccc-utility (Version: 2009.0825.2146.37269 - ATI) Hidden CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP) Client Security - Password Manager (HKLM\...\{18554B3F-46EA-40A9-B4EA-7EEE83C0559D}) (Version: 8.30.0023.00 - Lenovo Group Limited) Conexant 20561 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.92.10.0 - Conexant) Create Recovery Media (HKLM\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden Dienstprogramm "ThinkPad UltraNav" (HKLM\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.11 - Lenovo) DirectX 9 Runtime (Version: 1.00.0000 - Sonic Solutions) Hidden ElsterFormular-Upgrade (HKLM\...\ElsterFormular für Privatanwender 12.2.2.6665p) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen) Eraser 6.0.8.2273 (HKLM\...\{392A74D0-4DFE-49F7-87C3-8A61708F8856}) (Version: 6.0.2273 - The Eraser Project) Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Free Fire Screensaver (HKLM\...\Free Fire Screensaver) (Version: - Laconic Software) FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version: - ) Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.) Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Toolbar for Firefox (HKLM\...\{2CCBABCB-6427-4A55-B091-49864623C43F}) (Version: 7.1.20101113 - Google Inc.) Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.) Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.) Integrated Camera Driver Installer Package Ver.1.27.500.0 (HKLM\...\{82EB6CEA-749A-410F-8AD2-372A286BA3BE}) (Version: 1.27.500.0 - RICOH) Integrated Camera TWAIN (HKLM\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.7.331 - Chicony Electronics Co.,Ltd.) Intel(R) Management Engine Interface (HKLM\...\HECI) (Version: - Intel Corporation) Intel® Active-Management-Technologie (HKLM\...\MESOL) (Version: - Intel Corporation) InterVideo WinDVD 8 (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0.20.112 - InterVideo Inc.) InterVideo WinDVD 8 (Version: 8.0.20.112 - InterVideo Inc.) Hidden iTunes (HKLM\...\{F32DC846-4457-40A8-BECA-BCC0E960BC53}) (Version: 11.4.0.18 - Apple Inc.) Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle) Java 8 Update 20 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218020F0}) (Version: 8.0.200 - Oracle Corporation) Java Auto Updater (Version: 2.8.20.26 - Oracle Corporation) Hidden Java SE Development Kit 7 Update 55 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170550}) (Version: 1.7.0.550 - Oracle) Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Lenovo Fingerprint Software (HKLM\...\{2D440AF4-7330-43F0-A085-35DE1A90E703}) (Version: 3.3.0.50 - AuthenTec, Inc.) Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.01 - ) Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5387.13 - PC-Doctor, Inc.) Lenovo Welcome (HKLM\...\Lenovo Welcome_is1) (Version: 2.0.018.0 - Lenovo) Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Message Center Plus (HKLM\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited) Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Research AutoCollage Touch 2009 (HKLM\...\{1F8DA253-3C27-4B01-A63A-BA3533120833}) (Version: 2.00.2009 - Microsoft Research) Microsoft Search Enhancement Pack (Version: 1.2.121.0 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50701 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.50706 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.50701 - Microsoft Corporation) Hidden Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50701 - Microsoft Corporation) Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000 - Adobe) Hidden Mobile Broadband Connect (HKLM\...\{5C111F14-D9BE-459D-B0B6-B4D082F03749}) (Version: 3.5.0006 - Lenovo) Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd) Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.) PX Profile Update (Version: 1.00.1. - AMD) Hidden RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd) Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - ) Rescue and Recovery (HKLM\...\{B383F243-0ABC-4E56-AA30-923B8D85076E}) (Version: 4.30.0025.00 - Lenovo Group Limited) Roxio Activation Module (Version: 1.0 - Roxio) Hidden Roxio Central Audio (Version: 3.8.0 - Roxio) Hidden Roxio Central Copy (Version: 3.8.0 - Roxio) Hidden Roxio Central Core (Version: 3.8.0 - Roxio) Hidden Roxio Central Data (Version: 3.8.0 - Roxio) Hidden Roxio Central Tools (Version: 3.8.0 - Roxio) Hidden Roxio Creator Business Edition (HKLM\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio) Roxio Creator Business Edition (Version: 10.3.081 - Roxio) Hidden Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) Sonic CinePlayer Decoder Pack (Version: 4.3.0 - Sonic Solutions) Hidden Sonic Icons for Lenovo (HKLM\...\{B334D9AE-1393-423E-97C0-3BDC3360E692}) (Version: 2.0.0 - Lenovo) System Update (HKLM\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 4.00.0046 - Lenovo) TeamSIP 2go (HKLM\...\{B303639A-2CDF-42A1-8532-0E3338CE5A6D}) (Version: 2.5.14 - TeamFON GmbH) TeamSIP 2go (Version: 2.5.14 - TeamFON GmbH) Hidden ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.0.9600 - Broadcom Corporation) ThinkPad Energie-Manager (HKLM\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.04 - ) ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.06 - ) ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems) ThinkPad Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.55 - ) ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.4.12 - ) ThinkVantage Access Connections (HKLM\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.40 - Lenovo) ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.70 - Lenovo) Tradesignal Online Chart (HKLM\...\{3FB043FD-4C4C-4E99-8678-BA00A465C3F8}) (Version: 7.3.0.15 - Tradesignal GmbH) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2889914) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F3F83933-75FC-4B60-84F2-3F8FA63D042E}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) Verizon Wireless Mobile Broadband Self Activation (HKLM\...\{7A408D56-A9CF-4219-9F78-23E6B48A1C0D}) (Version: 3.1.1 - Smith Micro Software, Inc.) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - ) Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation) Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (07/07/2009 8.1.2.56) (HKLM\...\8E6CE26AD682E6D46DCCDD39CD93277A2EAF2449) (Version: 07/07/2009 8.1.2.56 - AuthenTec Inc.) Windows-Treiberpaket - Intel System (06/04/2009 1.0.0.0002) (HKLM\...\E7B58217635B8F723D4744A328A4B3237DB35FA9) (Version: 06/04/2009 1.0.0.0002 - Intel) Windows-Treiberpaket - Lenovo 1.55 (08/18/2009 1.55) (HKLM\...\112AA64E0C8CC704E307FE914F7DEC1C0035598E) (Version: 08/18/2009 1.55 - Lenovo) Windows-Treiberpaket - Ricoh (5U875UVC) Image (07/08/2009 1.27.500.0) (HKLM\...\E59560E2F5B162D40255FCD327ACA5E989D995D2) (Version: 07/08/2009 1.27.500.0 - Ricoh) Windows-Treiberpaket - Ricoh Company (rimsptsk) hdc (06/25/2009 6.10.01.03) (HKLM\...\D91056A9B3130B90EC1BB37F232FA5C4D61DF66F) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Windows-Treiberpaket - Ricoh Company (rismxdp) hdc (06/25/2009 6.10.01.04) (HKLM\...\414685941AB074B2478B18498E0CCA85F81CCBE6) (Version: 06/25/2009 6.10.01.04 - Ricoh Company) Windows-Treiberpaket - Ricoh Company MMC Host Controller (06/25/2009 6.10.01.03) (HKLM\...\6F84AC23718E31DE66E2EBEDAE047257F4E785D0) (Version: 06/25/2009 6.10.01.03 - Ricoh Company) Wise Registry Cleaner 8.11 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.11 - WiseCleaner.com, Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Chrome\Application\34.0.1847.137\delegate_execute.exe" (the data entry has 8 more characters). CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe" No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File CustomCLSID: HKU\S-1-5-21-1732376492-3782921457-3814634441-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Markus ******\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File ==================== Restore Points ========================= 08-10-2014 06:42:12 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:04 - 2014-05-21 08:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0DEE7595-F069-449D-B9C9-FC3C78F2B6DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {36991A1E-6A6C-487A-8A5D-8B38DB72BB0D} - System32\Tasks\PMTask => C:\Program Files\ThinkPad\Utilities\PWMIDTSV.EXE [2009-08-23] (Lenovo Group Limited) Task: {3CFBA15D-48A7-4242-8658-D2779DA6F044} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {5245162F-8F9D-42AD-A58A-C31EE8FEE18E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated) Task: {6AF8D474-2932-4846-9749-69375C8508E5} - \PCDoctorBackgroundMonitorTask No Task File <==== ATTENTION Task: {6B4630C1-04C0-40E6-A068-29B93D900C94} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-24] (Google Inc.) Task: {96BA89CD-37E1-4951-8F32-BA6A465FE18F} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe Task: {97901924-BA6B-4546-894C-D4FBDE36A724} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.) Task: {97AC3792-9BD1-45B3-A57F-6EF4DB6B4447} - System32\Tasks\JavaUpdateSched => C:\Windows\System32\jusched.exe Task: {B96F4CCE-CE64-4CAD-B9AE-269275568224} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe Task: {D5B4032B-7340-4B43-893C-B753E7A189F5} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe Task: {EF3D195A-B55E-4A5B-8E41-E27B949690AC} - System32\Tasks\{49C7F31D-7E66-4DDB-A4B5-F1BF4327AFC7} => C:\Program Files\Skype\\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.) Task: {F988FF61-E194-44DA-BA0D-DBF8A3833ECD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-09] (AVAST Software) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000Core.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732376492-3782921457-3814634441-1000UA.job => C:\Users\Markus ******\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe ==================== Loaded Modules (whitelisted) ============= 2009-09-01 00:32 - 2009-09-01 00:32 - 00098304 ____N () C:\Windows\system32\DTS.exe 2014-07-09 09:11 - 2014-07-09 09:11 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-10-08 12:37 - 2014-10-08 12:37 - 02859008 _____ () C:\Program Files\AVAST Software\Avast\defs\14100800\algo.dll 2014-06-01 22:08 - 2012-06-21 07:25 - 00094208 _____ () C:\Windows\System32\redmon32.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2010-12-22 18:42 - 2009-08-23 20:04 - 00037888 ____N () C:\Program Files\ThinkPad\Utilities\GR\PWMRT32V.DLL 2014-07-09 09:11 - 2014-07-09 09:11 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RCIMGDIR.exe.lnk => C:\Windows\pss\RCIMGDIR.exe.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TeamSIP 2go.lnk => C:\Windows\pss\TeamSIP 2go.lnk.CommonStartup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^6120.lnk => C:\Windows\pss\6120.lnk.Startup MSCONFIG\startupfolder: C:^Users^Markus ******^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^aj7zfy.lnk => C:\Windows\pss\aj7zfy.lnk.Startup MSCONFIG\startupreg: FingerPrintSoftware => "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s MSCONFIG\startupreg: Message Center Plus => C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start ========================= Accounts: ========================== Administrator (S-1-5-21-1732376492-3782921457-3814634441-500 - Administrator - Disabled) Gast (S-1-5-21-1732376492-3782921457-3814634441-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1732376492-3782921457-3814634441-1003 - Limited - Enabled) Markus ****** (S-1-5-21-1732376492-3782921457-3814634441-1000 - Administrator - Enabled) => C:\Users\Markus ****** ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/08/2014 09:16:39 AM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. Error: (10/08/2014 09:13:17 AM) (Source: SideBySide) (EventID: 59) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Ungültige XML-Syntax. System errors: ============= Error: (10/08/2014 01:16:29 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/08/2014 01:15:33 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/08/2014 01:15:33 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/08/2014 08:47:02 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/08/2014 08:47:02 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (10/08/2014 08:37:06 AM) (Source: Service Control Manager) (EventID: 7003) (User: ) Description: Der Dienst "Avira Browser-Schutz" ist von folgendem Dienst abhängig: AntiVirService. Dieser Dienst ist eventuell nicht installiert. Error: (10/08/2014 08:37:01 AM) (Source: amdkmdag) (EventID: 10261) (User: ) Description: Display is not active Error: (10/08/2014 08:37:01 AM) (Source: amdkmdag) (EventID: 19468) (User: ) Description: CPLIB :: General - Invalid Parameter Error: (10/07/2014 09:58:39 PM) (Source: Service Control Manager) (EventID: 7016) (User: ) Description: Der Dienst "Data Transfer Service" hat einen ungültigen aktuellen Status gemeldet: 0 Microsoft Office Sessions: ========================= Error: (12/10/2013 10:04:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 283 seconds with 180 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:35:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 138 seconds with 120 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:32:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 34 seconds with 0 seconds of active time. This session ended with a crash. Error: (10/30/2013 03:30:32 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 21691 seconds with 2880 seconds of active time. This session ended with a crash. Error: (02/11/2013 11:50:41 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4233 seconds with 2520 seconds of active time. This session ended with a crash. Error: (05/24/2012 06:13:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1365 seconds with 420 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz Percentage of memory in use: 62% Total physical RAM: 2520.03 MB Available physical RAM: 932.61 MB Total Pagefile: 6298.32 MB Available Pagefile: 4425.31 MB Total Virtual: 2047.88 MB Available Virtual: 1915.93 MB ==================== Drives ================================ Drive c: (Windows7_OS) (Fixed) (Total:286.66 GB) (Free:97.52 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive q: (Lenovo_Recovery) (Fixed) (Total:10.25 GB) (Free:4.99 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298.1 GB) (Disk ID: 504A2363) Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=286.7 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=10.3 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
09.10.2014, 10:51 | #10 |
/// the machine /// TB-Ausbilder | Deutlicher Leistungsabfall Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\pss\aj7zfy.lnk.Startup Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
09.10.2014, 22:16 | #11 |
| Deutlicher Leistungsabfall Läuft eigentlich schon alles wieder wie geschmiert, Du / Ihr seid einfach super Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 06-10-2014 01 Ran by Markus ****** at 2014-10-09 22:57:47 Run:1 Running from C:\Users\Markus ******\Desktop Loaded Profile: Markus ****** (Available profiles: Markus ******) Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Windows\pss\aj7zfy.lnk.Startup ***************** C:\Windows\pss\aj7zfy.lnk.Startup => Moved successfully. ==== End of Fixlog ==== 2 Fragen noch: 1) Die Java Update-Überprüfung sagt, dass ich die aktuelle Version hab (für Java 7 und 8). Ich vermute dass das "Java SE Development Kit 7 Update 55" nicht aktuell ist, aber weiß nicht wie ich es updaten soll?! Unter Start/Programme/Java Development Kit gibt es keinen Update-Button wie unter Start/Programme/Java. Brauche ich das Development Kit überhaupt? 2) Was hatte ich mir eingefangen? Da ich den Laptop vornehmlich zum Arbeiten benutze, passe ich eigentlich schon peinlich genau auf ... dachte ich |
10.10.2014, 19:06 | #12 |
/// the machine /// TB-Ausbilder | Deutlicher Leistungsabfall Alte Java-Sachen einfach deinstallieren. Das Meiste war nur Adware
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Deutlicher Leistungsabfall |
aktuell, antimalware, avast, browser, dateien, deinstallation, eingabe, fenster, firefox, google, hintergrund, kommts, langsamer, langsames, melde, meldet, nichts, programme, programmen, schneller, stern, super, systems, tipps, woche, wochen |