|
Plagegeister aller Art und deren Bekämpfung: Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins StartmenüWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
20.10.2014, 14:04 | #1 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Hallo liebe Forenmitglieder, ich habe mir vor einigen Wochen einen neuen Laptop gekauft und bin noch immer dabei, ihn nach meinen Bedürfnissen und meinem Geschmack einzurichten. Vorweg ein paar allgemeine Infos zum Gerät: - Acer Aspire V3-772G - Win 8.1 64bit - i7-4702MQ 2.2GHz - 32 GB RAM - NVIDIA GeForce GT 750M - 17,3" FHD Acer ComfyView LCD - 100 GB SSD Systemplatte - 500 GB HDD Datenplatte - DVD-Super Multi DL drive - Acer Nplify 802.11a/b/g/n + BT 4.0 Die Anpassung des Gerätes ist noch nicht komplett abgeschlossen, da bei Auslieferung sehr viel teils unnütze und unsinnige Software (hauptsächlich von Acer) vorinstalliert war. Unter Windows 8.1 habe ich mir die verbreitete Freeware "Classic Start Menu" installiert, um wieder mit einem richtigen Startmenü arbeiten zu können. Dieses habe ich mir - wie auf meinen früheren Rechnern auch - pingelig zurechtsortiert. Ich möchte es nun mal übersichtlich haben und mag auf meinem Rechner kein Chaos. Leider gibt es einen Startmenü-Eintrag, der sich äußerst nervig verhält. Es ist ein orangebraunfarbener Lautsprecher mit dem Text "RtkGUI". Ich kann ihn aus dem Menü entfernen (in Kopie habe ich ihn schon woanders einsortiert), nach einem Systemneustart erscheint er aber immer wieder dort. Es handelt sich um den "Realtek HD Audio-Manager", der mit Klick auf die Verknüpfung gestartet werden kann. Hier ein Link zu einem Screenshot, auf dem man das besagte Symbol ganz oben im Startmenü und rechts daneben das damit geöffnete Programm sehen kann: hxxp://schiefer-abc.de/temp/screenshot.jpg Ich habe keine Möglichkeit gefunden, diese Verknüpfung irgendwo im Programm oder in der Systemsteuerung zu deaktivieren und auch Google hat eher kurzzeitig Panik als Hilfe gebracht, denn zunächst stieß ich auf viele Einträge, dass es sich um ein "RootKit" (wegen der Abkürzung "RtkGUI") handeln müsse. Checks mit diversen Programmen, die hier im Forum empfohlen werden, haben aber keinerlei Bedrohung oder verdächtige Dateien auf meinem Gerät gefunden. Ich bin langsam echt verzweifelt und komme mir schon ein wenig blöde vor, weil ich selbst IT'ler bin, bei einer scheinbar einfachen Geschichte wie hier aber keine Lösung finde. Danke schon mal für jeglichen Tipp! Ach ja: Sollten irgendwelche Logfiles benötigt werden, kann ich die natürlich gerne nachreichen. Ich habe sie nicht gleich beigefügt, weil ich mir (zu 99%) sicher bin, dass es sich hierbei nicht um ein Schadprogramm, sondern "nur" um ein nerviges Verhalten eines bekannten Programmes handelt. |
20.10.2014, 14:18 | #2 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Hi,
__________________in Classic Shell ansich hast Du alle Einstellungen gecheckt? Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
23.10.2014, 08:57 | #3 |
| Logfiles Hallo schrauber,
__________________ich habe in den Einstellungen des Classic-Menüs keinen Punkt bezüglich dieses Icons gefunden. Anbei die beiden gewünschten Logfiles. Bin gespannt, ob Du daraus etwas ableiten kannst. Ich habe sie mir mal genauer angeschaut, aber zur Lösung meines Problems nichts gefunden. Danke schon mal für Deine Mühen! |
24.10.2014, 07:34 | #4 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Hi, Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
24.10.2014, 09:02 | #5 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Pardon, hier noch mal eingefügt: FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014 Ran by User (administrator) on MCFLY on 23-10-2014 09:41:11 Running from E:\Dokumente\User\Desktop Loaded Profiles: UpdatusUser & User (Available profiles: UpdatusUser & User) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe (aborange.de - Mathias Gerlach) C:\Program Files (x86)\Synchronizer\aboScheduler.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe () C:\Program Files\Rainmeter\Rainmeter.exe (Stardock) C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock) C:\Program Files (x86)\Stardock\ObjectDock\Dock64.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QuickAccess.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13647576 2013-08-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2778352 2013-10-01] (Synaptics Incorporated) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft) HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [281312 2014-05-19] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-04] (AVAST Software) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH) HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD) HKLM-x32\...\Run: [BCSSync] => E:\Programme\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-4157436333-2088108305-2255346966-1002\...\Run: [aborange Scheduler] => C:\Program Files (x86)\Synchronizer\aboScheduler.exe [244736 2005-01-14] (aborange.de - Mathias Gerlach) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [184048 2013-10-31] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-10-31] (NVIDIA Corporation) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe () Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB SearchScopes: HKLM - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB SearchScopes: HKLM-x32 - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB SearchScopes: HKCU - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft) BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Tcpip\Parameters: [DhcpNameServer] 192.168.4.1 FireFox: ======== FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default FF DefaultSearchUrl: hxxp://www.bing.com/search FF SearchEngineOrder.1: Microsoft (Bing) FF Homepage: https://www.google.de/ FF Keyword.URL: hxxp://www.bing.com/search FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\Programme\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\Programme\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\searchplugins\bing-avast.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: YouTube Unblocker - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\youtubeunblocker@unblocker.yt [2014-10-17] FF Extension: TV-Fox - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2014-09-08] FF Extension: DownloadHelper - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-08] FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\client@anonymox.net.xpi [2014-08-30] FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\firefox@ghostery.com.xpi [2014-08-30] FF Extension: Download Manager (S3) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\s3download@statusbar.xpi [2014-08-08] FF Extension: PDF Download - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.xpi [2012-01-05] FF Extension: {4b3f8014-9079-45b0-9895-2cb2efe9b582} - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{4b3f8014-9079-45b0-9895-2cb2efe9b582}.xpi [2013-11-02] FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-23] Chrome: ======= CHR StartupUrls: Default -> "https://www.daa-mws-virtuell.de/" CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-09] CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-09] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-09] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-09] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-09] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-09] CHR Extension: (Google Tabellen) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-09] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-09] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-09] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-04] (AVAST Software) S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-14] (Broadcom Corporation.) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573544 2014-03-21] (Acer Incorporated) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation) S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation) S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation) R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [459496 2014-03-17] (Acer Incorporate) S3 Microsoft SharePoint Workspace Audit Service; E:\Programme\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation) S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation) R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [457960 2014-04-28] (Acer Incorporate) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] () R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-04-28] (Acer Incorporate) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27872 2014-05-19] (Samsung Electronics Co., Ltd.) S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation) S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-04] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-04] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-04] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-04] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-09-04] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-04] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-04] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-04] () R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-14] (Broadcom Corporation.) R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7549616 2014-02-25] (Broadcom Corporation) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [265952 2014-05-19] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2014-05-19] (Samsung Electronics Co., Ltd.) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated) S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.) S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [116296 2014-09-09] (Oracle Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-23 09:40 - 2014-10-23 09:41 - 00000000 ____D () C:\FRST 2014-10-23 09:28 - 2014-10-23 09:28 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-10-23 09:28 - 2014-10-23 09:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2014-10-23 09:28 - 2014-10-23 09:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-10-23 09:28 - 2014-10-23 09:28 - 00000000 ____D () C:\Program Files (x86)\Java 2014-10-23 09:17 - 2014-10-23 09:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virtualisierung 2014-10-22 17:16 - 2014-10-22 17:16 - 00001282 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RtkGUI.lnk 2014-10-22 14:49 - 2014-10-22 14:49 - 00000000 ____D () C:\Users\User\AppData\Roaming\vlc 2014-10-22 14:48 - 2014-10-22 14:48 - 00000000 ____D () C:\Program Files\VideoLAN 2014-10-22 14:39 - 2014-10-22 14:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype 2014-10-22 14:39 - 2014-10-22 14:39 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-10-22 14:39 - 2014-10-22 14:39 - 00000000 ____D () C:\Users\User\AppData\Local\Skype 2014-10-22 14:39 - 2014-10-22 14:39 - 00000000 ____D () C:\ProgramData\Skype 2014-10-22 12:11 - 2014-10-22 12:12 - 00000000 ____D () C:\Program Files (x86)\UltraISO 2014-10-22 11:50 - 2014-10-22 11:50 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack x64 2014-10-22 11:50 - 2012-06-09 19:21 - 00206336 _____ () C:\Windows\system32\unrar64.dll 2014-10-22 11:50 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll 2014-10-22 11:19 - 2014-10-22 11:19 - 00001156 _____ () C:\Users\User\Desktop\Mantronic´s Kaiser II.lnk 2014-10-22 11:19 - 2014-10-22 11:19 - 00001156 _____ () C:\Users\UpdatusUser\Desktop\Mantronic´s Kaiser II.lnk 2014-10-22 11:19 - 2014-10-22 11:19 - 00000000 ____D () C:\Program Files (x86)\Mantronic 2014-10-21 13:57 - 2014-10-22 09:46 - 00000000 ____D () C:\Users\User\AppData\Roaming\Synchronizer 2014-10-21 13:57 - 2014-10-21 14:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\aborange 2014-10-21 13:57 - 2014-10-21 13:57 - 00001033 _____ () C:\Users\UpdatusUser\Desktop\Synchronizer.lnk 2014-10-21 13:57 - 2014-10-21 13:57 - 00000000 ____D () C:\Program Files (x86)\Synchronizer 2014-10-21 13:08 - 2014-10-21 13:20 - 00000000 ____D () C:\Users\User\AppData\Roaming\FileZilla 2014-10-21 10:54 - 2014-10-21 12:43 - 00000000 ____D () C:\Users\User\AppData\Roaming\Trillian 2014-10-21 10:53 - 2014-10-21 10:54 - 00000000 ____D () C:\Program Files (x86)\Trillian 2014-10-20 13:23 - 2014-10-20 13:23 - 00000000 ____D () C:\Program Files\Bulk Rename Utility 2014-10-15 13:41 - 2014-10-15 13:42 - 00000000 ____D () C:\Program Files (x86)\lame3.99.5 2014-10-15 11:26 - 2014-10-15 11:26 - 00000034 _____ () C:\Windows\cdplayer.ini 2014-10-15 11:24 - 2014-10-15 11:24 - 00000000 ____D () C:\Users\User\AppData\Roaming\dlg 2014-10-15 11:24 - 2014-10-15 11:24 - 00000000 ____D () C:\Program Files (x86)\Audiograbber 2014-10-15 09:37 - 2014-10-15 09:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-15 09:37 - 2014-10-15 09:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-15 09:37 - 2014-10-15 09:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-10-15 09:37 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-10-15 09:37 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-10-15 09:37 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-10-15 09:26 - 2014-10-15 09:26 - 00000000 ____D () C:\Windows\ERUNT 2014-10-15 08:54 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-10-15 08:54 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-10-15 08:54 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-10-15 08:54 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-10-15 08:54 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-10-15 08:54 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-10-15 08:54 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-10-15 08:54 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-10-15 08:54 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-10-15 08:54 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-10-15 08:54 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-10-15 08:54 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-10-15 08:54 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-10-15 08:54 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-10-15 08:54 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-10-15 08:54 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-10-15 08:54 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-10-15 08:54 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-10-15 08:54 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-10-15 08:54 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-10-15 08:54 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-10-15 08:54 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-10-15 08:54 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-10-15 08:54 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-10-15 08:54 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-10-15 08:54 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-10-15 08:54 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-10-15 08:54 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-10-15 08:54 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-10-15 08:54 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-10-15 08:54 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-10-15 08:54 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-10-15 08:54 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-10-15 08:54 - 2014-09-10 08:25 - 00474432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-10-15 08:54 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-10-15 08:54 - 2014-09-08 05:07 - 02497344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-10-15 08:54 - 2014-09-08 05:07 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-10-15 08:54 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-10-15 08:54 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-10-15 08:54 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-10-15 08:54 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-10-15 08:54 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-10-15 08:54 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-10-15 08:54 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-10-15 08:54 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-10-15 08:54 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-10-15 08:54 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-10-15 08:54 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-10-15 08:54 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-10-15 08:54 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-10-15 08:54 - 2014-09-08 00:08 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml 2014-10-15 08:54 - 2014-09-05 00:30 - 00822272 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-10-15 08:54 - 2014-09-05 00:21 - 01053184 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2014-10-15 08:54 - 2014-09-04 05:15 - 00561416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-10-15 08:54 - 2014-09-04 05:14 - 00177472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-10-15 08:54 - 2014-09-04 05:05 - 00836176 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll 2014-10-15 08:54 - 2014-09-04 04:22 - 00670384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll 2014-10-15 08:54 - 2014-09-04 03:19 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2014-10-15 08:54 - 2014-09-04 03:01 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll 2014-10-15 08:54 - 2014-09-04 02:45 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2014-10-15 08:54 - 2014-09-04 02:41 - 01420288 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-10-15 08:54 - 2014-09-04 02:36 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-10-15 08:54 - 2014-09-04 02:32 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll 2014-10-15 08:54 - 2014-09-04 02:15 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-10-15 08:54 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll 2014-10-15 08:54 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll 2014-10-15 08:54 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll 2014-10-15 08:54 - 2014-08-31 02:17 - 00148800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-10-15 08:54 - 2014-08-31 02:15 - 21197152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-10-15 08:54 - 2014-08-31 00:59 - 18723112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-10-15 08:54 - 2014-08-31 00:05 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll 2014-10-15 08:54 - 2014-08-30 23:58 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll 2014-10-15 08:54 - 2014-08-30 23:04 - 00941568 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll 2014-10-15 08:54 - 2014-08-30 22:53 - 00239104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll 2014-10-15 08:54 - 2014-08-30 22:17 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll 2014-10-15 08:54 - 2014-08-28 04:55 - 07484224 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-10-15 08:54 - 2014-08-28 02:21 - 02480128 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-10-15 08:54 - 2014-08-28 02:06 - 02030592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-10-15 08:54 - 2014-08-23 07:14 - 13424128 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-10-15 08:54 - 2014-08-23 07:04 - 11820544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2014-10-15 08:54 - 2014-08-23 06:50 - 02714112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll 2014-10-15 08:54 - 2014-08-02 02:51 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll 2014-10-15 08:54 - 2014-08-02 02:35 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll 2014-10-15 08:53 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-10-15 08:53 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-10-15 08:53 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-10-15 08:53 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-10-15 08:53 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-10-15 08:53 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-10-15 08:53 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-10-14 09:48 - 2014-10-14 09:48 - 00000000 ____D () C:\usr 2014-10-11 14:35 - 2014-10-23 09:36 - 00000000 ____D () C:\Users\User\AppData\Roaming\KeePass 2014-10-11 14:21 - 2014-10-11 14:36 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2 2014-10-11 13:57 - 2014-10-11 13:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\NetBeans 2014-10-11 13:57 - 2014-10-11 13:57 - 00000000 ____D () C:\Users\User\AppData\Local\NetBeans 2014-10-09 23:17 - 2014-10-09 23:17 - 00000000 ____D () C:\Users\User\AppData\Roaming\SpaceEngineers 2014-10-08 15:32 - 2014-10-08 15:32 - 00000000 ____D () C:\Users\User\AppData\Local\Stardock 2014-10-08 15:29 - 2014-10-08 15:29 - 00000000 ____D () C:\Program Files (x86)\Stardock 2014-10-03 09:52 - 2014-10-03 09:56 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-10-03 09:51 - 2014-10-03 09:59 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft 2014-09-30 12:50 - 2014-09-30 12:50 - 00000000 ____D () C:\Users\Public\OEM 2014-09-30 12:48 - 2014-10-03 09:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Multimedia 2014-09-30 12:47 - 2014-09-30 13:01 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System 2014-09-30 12:31 - 2014-09-30 12:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spiele 2014-09-25 09:30 - 2014-09-25 09:30 - 00000000 __RHD () C:\MSOCache 2014-09-24 16:24 - 2014-09-24 16:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-09-24 10:18 - 2014-09-24 10:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\ImgBurn 2014-09-24 10:15 - 2014-09-24 10:15 - 00000000 ____D () C:\Program Files (x86)\ImgBurn 2014-09-24 08:42 - 2014-09-24 08:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\Xerox 2014-09-24 08:34 - 2014-09-24 08:34 - 00000000 ____D () C:\ProgramData\Xerox 2014-09-23 23:06 - 2014-09-23 23:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services 2014-09-23 23:05 - 2014-09-23 23:05 - 00000000 ____D () C:\Windows\PCHEALTH 2014-09-23 23:05 - 2014-09-23 23:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework 2014-09-23 23:05 - 2014-09-23 23:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2014-09-23 23:04 - 2014-09-23 23:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8 2014-09-23 23:03 - 2014-09-23 23:03 - 00000000 ____D () C:\Program Files\Microsoft Office 2014-09-23 23:03 - 2014-09-23 23:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services 2014-09-23 14:00 - 2014-09-23 14:00 - 00000000 ____D () C:\Windows\Minidump 2014-09-23 09:35 - 2014-10-22 13:58 - 00000000 ____D () C:\Users\User\.VirtualBox 2014-09-23 09:34 - 2014-09-09 17:29 - 00910920 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys 2014-09-23 09:34 - 2014-09-09 17:27 - 00129168 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-23 09:35 - 2014-09-04 12:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\ClassicShell 2014-10-23 09:34 - 2014-09-03 19:34 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4157436333-2088108305-2255346966-1002 2014-10-23 09:32 - 2014-09-05 09:49 - 00000000 ____D () C:\ProgramData\Oracle 2014-10-23 09:25 - 2014-09-09 13:48 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-23 09:18 - 2014-09-17 13:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Entwicklung 2014-10-23 09:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru 2014-10-23 08:56 - 2014-09-22 12:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-23 08:44 - 2014-08-16 17:49 - 01919491 _____ () C:\Windows\WindowsUpdate.log 2014-10-23 08:32 - 2014-08-17 03:02 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2014-10-23 08:32 - 2014-08-17 03:02 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2014-10-23 08:32 - 2014-03-18 12:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-10-23 08:28 - 2014-09-09 13:48 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-23 08:28 - 2014-09-04 11:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox 2014-10-23 08:27 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-22 22:44 - 2014-09-16 23:57 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-10-22 20:05 - 2014-09-18 11:51 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mp3tag 2014-10-22 17:15 - 2013-08-22 16:44 - 00554400 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-10-22 11:20 - 2014-09-04 22:02 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft 2014-10-22 09:58 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-10-21 14:18 - 2014-09-03 14:28 - 00000000 ____D () C:\Users\User\System 2014-10-21 10:55 - 2014-09-17 13:11 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet 2014-10-20 22:51 - 2014-09-03 14:36 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps 2014-10-20 22:51 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF 2014-10-20 13:20 - 2013-08-22 16:46 - 00032384 _____ () C:\Windows\setupact.log 2014-10-20 09:34 - 2014-09-17 14:46 - 00000000 ____D () C:\Program Files (x86)\Mp3tag 2014-10-17 08:40 - 2014-09-18 14:10 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-10-17 08:40 - 2014-09-18 14:10 - 00000000 ____D () C:\Program Files\Java 2014-10-17 05:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache 2014-10-15 23:01 - 2014-03-18 11:54 - 00082616 _____ () C:\Windows\PFRO.log 2014-10-15 22:59 - 2014-09-17 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astronomie 2014-10-15 22:54 - 2014-09-15 12:47 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-10-15 21:21 - 2014-09-09 13:48 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-10-15 21:21 - 2014-09-09 13:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-10-15 21:20 - 2014-09-09 13:48 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-10-15 21:20 - 2014-09-09 13:48 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-10-15 16:41 - 2014-09-09 13:47 - 00003846 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1410263262 2014-10-15 16:41 - 2014-09-09 13:47 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-10-15 13:25 - 2014-09-02 00:16 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-10-15 09:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData 2014-10-15 09:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2014-10-15 09:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\MediaViewer 2014-10-15 09:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager 2014-10-15 09:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Camera 2014-10-15 09:00 - 2014-09-04 08:46 - 00000000 ____D () C:\Windows\system32\MRT 2014-10-15 09:00 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-10-15 08:55 - 2014-09-04 08:46 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-10-15 08:55 - 2014-09-04 08:45 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-10-15 08:13 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-10-13 08:18 - 2014-09-17 12:58 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Büro 2014-10-09 22:15 - 2014-09-04 13:39 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-09-30 17:50 - 2014-09-05 09:36 - 00000000 ____D () C:\Users\User\AppData\Roaming\TeamViewer 2014-09-30 13:04 - 2014-09-17 13:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System 2014-09-30 12:51 - 2014-06-11 10:17 - 00000000 ____D () C:\Program Files (x86)\Acer 2014-09-30 12:34 - 2014-09-17 13:12 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spiele 2014-09-30 00:45 - 2014-06-11 10:10 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-09-30 00:45 - 2014-06-11 10:10 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-09-26 17:00 - 2014-09-04 10:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-09-26 09:53 - 2014-09-04 10:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-09-25 09:09 - 2013-08-22 15:25 - 00000199 _____ () C:\Windows\win.ini 2014-09-23 23:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-09-23 23:03 - 2014-03-18 11:45 - 00000000 ____D () C:\Windows\ShellNew 2014-09-23 17:57 - 2014-06-11 10:07 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2014-09-23 17:56 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System 2014-09-23 14:00 - 2014-08-17 03:10 - 00319658 ____N () C:\Windows\Minidump\092314-5203-01.dmp Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\AcerDocsSetup.exe C:\Users\User\AppData\Local\Temp\AcerPortalSetup.exe C:\Users\User\AppData\Local\Temp\drm_dyndata_7370014.dll C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfxdewb.dll C:\Users\User\AppData\Local\Temp\jre-8u25-windows-au.exe C:\Users\User\AppData\Local\Temp\oct3BAE.tmp.exe C:\Users\User\AppData\Local\Temp\ose00000.exe C:\Users\User\AppData\Local\Temp\ose00001.exe C:\Users\User\AppData\Local\Temp\ose00002.exe C:\Users\User\AppData\Local\Temp\ose00003.exe C:\Users\User\AppData\Local\Temp\Quarantine.exe C:\Users\User\AppData\Local\Temp\sqlite3.dll C:\Users\User\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-18 21:06 ==================== End Of Log ============================ Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014 Ran by User at 2014-10-23 09:41:36 Running from E:\Dokumente\User\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) @icon sushi 1.21 (HKLM-x32\...\@icon sushi_is1) (Version: - towofu's SOFT) Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated) Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8105 - Acer Incorporated) Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8104 - Acer Incorporated) Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3014.0 - Acer Incorporated) Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8106 - Acer Incorporated) Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2001.4 - Acer Incorporated) Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Reader XI (11.0.09) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated) Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team) Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber) avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software) Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.234 - Broadcom Corporation) Broadcom NetLink Controller (HKLM\...\{7FBA83D7-D58E-4B70-9B9B-12E95B183B22}) (Version: 16.6.1.3 - Broadcom Corporation) Bulk Rename Utility 2.7.1.3 (HKLM\...\Bulk Rename Utility_is1) (Version: - TGRMN Software) Celestia 1.6.1 (HKLM-x32\...\Celestia_is1) (Version: - Shatters Software) Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft) Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.) CyberLink PhotoDirector 3 (x32 Version: 3.0.1.4917 - CyberLink Corp.) Hidden CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.3721 - CyberLink Corp.) CyberLink PowerDirector 10 (x32 Version: 10.0.0.3721 - CyberLink Corp.) Hidden CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3914.57 - CyberLink Corp.) CyberLink PowerDVD 12 (x32 Version: 12.0.3914.57 - CyberLink Corp.) Hidden Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc) DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.50.000 - Runtime Software) Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.) Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD) FileZilla Client 3.9.0.6 (HKCU\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse) Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.3.10.923 - DVDVideoSoft Ltd.) GlassFish Server Open Source Edition 4.1 (HKLM\...\nbi-glassfish-mod-4.1.0.13.0) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.8101 - Acer Incorporated) ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) Intel(R) Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan) Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) Java Auto Updater (x32 Version: 2.8.25.18 - Oracle Corporation) Hidden Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation) KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl) K-Lite Codec Pack 9.9.9 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.9.9 - ) LibreOffice 4.3 Help Pack (German) (HKLM-x32\...\{1560A369-7C63-4D4E-AA09-494C4BD47256}) (Version: 4.3.1.2 - The Document Foundation) LibreOffice 4.3.1.2 (HKLM-x32\...\{303C2B0D-03AF-4C25-A443-E62DE8AA36A8}) (Version: 4.3.1.2 - The Document Foundation) Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Acer Incorporated) Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation) Manga maker ComiPo! (HKLM-x32\...\Steam App 262490) (Version: - ComiPo! LLP) Mantronic´s KaiserII (Version 2.2) (HKLM-x32\...\Mantronic´s Kaiser II_is1) (Version: 2.2.0 - Mantronic Software) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Moonbase Alpha (HKLM-x32\...\Steam App 39000) (Version: - Virtual Heroes) Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla) Mp3tag v2.65 (HKLM-x32\...\Mp3tag) (Version: v2.65 - Florian Heidenreich) Nero BackItUp (x32 Version: 12.5.11000 - Nero AG) Hidden Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{551AC8F2-FEA2-4B45-ACF7-C98681233CC9}) (Version: 12.5.01200 - Nero AG) Nero BackItUp Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden Nero ControlCenter (x32 Version: 11.0.15900 - Nero AG) Hidden Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden Nero Core Components (x32 Version: 11.0.20900 - Nero AG) Hidden Nero Launcher (x32 Version: 12.2.7000 - Nero AG) Hidden Nero RescueAgent (x32 Version: 12.0.3001 - Nero AG) Hidden Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden NetBeans IDE 8.0.1 (HKLM\...\nbi-nb-base-8.0.1.0.201409082112) (Version: 8.0.1 - NetBeans.org) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team) NVIDIA Grafiktreiber 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.141.953 - NVIDIA Corporation) Hidden NVIDIA Optimus 1.14.17 (Version: 1.14.17 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation) NVIDIA Systemsteuerung 327.62 (Version: 327.62 - NVIDIA Corporation) Hidden NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation) NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden ObjectDock Plus (HKLM-x32\...\ObjectDock Plus) (Version: - ) OpenAL (HKLM-x32\...\OpenAL) (Version: - ) Opera Stable 25.0.1614.50 (HKLM-x32\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA) Oracle VM VirtualBox 4.3.16 (HKLM\...\{D7FAEA32-7CE3-4D9F-9139-F7B87BCC50AF}) (Version: 4.3.16 - Oracle Corporation) Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.) PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.4 - Andrea Vacondio) PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden PSPad editor (HKLM-x32\...\PSPad editor_is1) (Version: 4.5.8.2500 - Jan Fiala) Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.1 r2290 - ) RAPID Mode (Version: 1.0.1.68 - Samsung Electronics Co., Ltd.) Hidden Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.28148 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7027 - Realtek Semiconductor Corp.) Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.) Spielkanäle (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 9.2.0.11 - WildTangent, Inc.) Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) Stellarium 0.13.0 (HKLM-x32\...\Stellarium_is1) (Version: 0.13.0 - Stellarium team) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.6.17 - Synaptics Incorporated) Synchronizer - Deinstallation (HKLM-x32\...\Synchronizer_is1) (Version: 5.00 - Mathias Gerlach [aborange.de]) TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer) The Babylon Project (HKLM-x32\...\InstallShield_{B9883E2B-775E-4FF0-B664-94C95C313938}) (Version: 3.4.2 - The Babylon Project) The Babylon Project (x32 Version: 3.4.2 - The Babylon Project) Hidden The Chronicles of Emerland Solitaire (x32 Version: 3.0.2.32 - WildTangent) Hidden Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden Tunatic (HKLM-x32\...\Tunatic) (Version: - ) UltraISO Premium V9.62 (HKLM-x32\...\UltraISO_is1) (Version: - ) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.9590 - Broadcom Corporation) WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent) WildTangent Games App (x32 Version: 4.0.10.20 - WildTangent) Hidden WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-5 - Bitnami) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ==================== Restore Points ========================= ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0044BF0D-0447-4379-BE6C-E6B109F1AD8F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-04] (AVAST Software) Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {16495137-2DAC-41A3-AF52-5256241BFE11} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-04-28] (Acer Incorporate) Task: {165DB82E-2EF0-44AD-8AB3-5D5FBBE858BB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-22] (Adobe Systems Incorporated) Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {3EDC32EB-07F5-4CAC-9DC7-9768627FC3FA} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-03-18] (Acer Incorporated) Task: {4384C4B9-98C6-4F4D-BB55-A000B6CFA100} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {4E4ED96B-6A14-4C9A-AB58-46B85557D475} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation) Task: {55C1CF8E-C314-4F7A-AD82-87941F1B315C} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] () Task: {59644A02-912E-4A06-9BBC-968E9844B147} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-04-28] (Acer Incorporate) Task: {650CF53D-23BC-43D3-B1FD-1BCCB5BD41BE} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.) Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {93D37670-CEF6-4E54-A2BA-8D70DDB2BF3C} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv Task: {9CD982AB-B20C-40F8-AA4C-FF288CEA7A8E} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-03-21] (Acer Incorporated) Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {A34FFD40-0EAC-4278-9DF6-183F38ECD61D} - System32\Tasks\Opera scheduled Autoupdate 1410263262 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-15] (Opera Software) Task: {A6BFAC2B-0921-419C-A06A-75DC7AF11861} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.) Task: {BF58E14B-1069-43E0-80DD-BB525A2FD9CD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics Task: {C759A239-7E3E-40A6-967D-B39A229F073C} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D08F1AB1-8F5E-4779-937E-7A750E734C77} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation) Task: {D4D063A0-3851-4686-85DB-CDCD17547ECA} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-07-08] () Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {DEB03988-4BAD-4250-9194-838D75B82AC2} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-07-08] (Dolby Laboratories Inc.) Task: {E2ACF668-4308-4463-9ECA-B3DD4467FB01} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation Task: {E3BDCA69-0278-4D27-AE94-D673C4802877} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {ECE0E9C4-34CD-4041-BEE4-E2903800183B} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-03-17] (Acer Incorporate) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-08-16 17:49 - 2013-10-31 22:43 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll 2014-09-05 09:36 - 2014-09-11 08:06 - 00020240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll 2014-04-14 16:27 - 2014-04-14 16:27 - 00049368 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll 2014-08-16 18:04 - 2012-04-24 12:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe 2014-10-08 15:29 - 2007-04-23 16:53 - 00020752 _____ () C:\Program Files (x86)\Stardock\ObjectDock\Dock64.dll 2014-08-16 18:11 - 2014-01-03 14:13 - 00111872 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext_x64.dll 2014-05-01 21:29 - 2014-05-01 21:29 - 00098304 _____ () E:\Programme\FileZilla FTP Client\fzshellext_64.dll 2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll 2013-07-08 18:53 - 2013-07-08 18:53 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll 2014-05-25 16:18 - 2014-05-25 16:18 - 00036536 _____ () C:\Program Files\Rainmeter\Rainmeter.exe 2014-05-25 16:18 - 2014-05-25 16:18 - 00747192 _____ () C:\Program Files\Rainmeter\Rainmeter.dll 2014-05-25 16:17 - 2014-05-25 16:17 - 00012800 _____ () C:\Program Files\Rainmeter\Plugins\Perfmon.dll 2014-05-25 16:17 - 2014-05-25 16:17 - 00056832 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll 2014-05-25 16:17 - 2014-05-25 16:17 - 00019968 _____ () C:\Program Files\Rainmeter\Plugins\SysInfo.dll 2014-05-25 16:17 - 2014-05-25 16:17 - 00023040 _____ () C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.dll 2014-09-04 13:39 - 2014-09-04 13:39 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-10-22 09:58 - 2014-10-22 09:58 - 02896896 _____ () C:\Program Files\AVAST Software\Avast\defs\14102200\algo.dll 2014-10-23 08:28 - 2014-10-23 08:28 - 02896896 _____ () C:\Program Files\AVAST Software\Avast\defs\14102201\algo.dll 2014-10-08 15:29 - 2007-04-24 15:22 - 00112400 _____ () C:\Program Files (x86)\Stardock\ObjectDock\DockShellHook.dll 2014-09-05 09:12 - 2014-05-06 11:24 - 00013824 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll 2014-09-05 09:12 - 2014-05-19 20:20 - 00103424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\PAL.dll 2014-09-05 09:12 - 2014-05-19 20:20 - 00039424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SATA.dll 2014-09-05 09:12 - 2014-05-19 20:19 - 00038400 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAT.dll 2014-09-05 09:12 - 2014-05-19 20:20 - 00031232 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SMINI.dll 2014-09-05 09:12 - 2014-05-19 20:19 - 00029696 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAS.dll 2014-09-04 13:39 - 2014-09-04 13:39 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-10-23 08:28 - 2014-10-23 08:28 - 00043008 _____ () c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfxdewb.dll 2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll 2014-10-08 15:29 - 2007-04-19 14:23 - 00095944 _____ () C:\Program Files (x86)\Stardock\ObjectDock\CrashRpt.dll 2014-10-08 15:29 - 2007-04-21 13:47 - 00059592 _____ () C:\Program Files (x86)\Stardock\ObjectDock\zlib.dll 2014-10-08 15:29 - 2002-11-19 14:11 - 00139264 _____ () C:\Program Files (x86)\Common Files\Stardock\ODImg.dll 2014-08-16 17:42 - 2013-09-04 01:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2014-09-04 10:30 - 2014-09-26 09:53 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run32: => "BCSSync" HKCU\...\StartupApproved\Run: => "InetStat" ========================= Accounts: ========================== Administrator (S-1-5-21-4157436333-2088108305-2255346966-500 - Administrator - Disabled) Gast (S-1-5-21-4157436333-2088108305-2255346966-501 - Limited - Disabled) UpdatusUser (S-1-5-21-4157436333-2088108305-2255346966-1001 - Limited - Enabled) => C:\Users\UpdatusUser User (S-1-5-21-4157436333-2088108305-2255346966-1002 - Administrator - Enabled) => C:\Users\User ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/22/2014 03:38:20 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "Recovery" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (10/20/2014 10:51:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: rundll32.exe_winethc.dll, Version: 6.3.9600.16384, Zeitstempel: 0x5215f00d Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebd22 Ausnahmecode: 0xc0000142 Fehleroffset: 0x00000000000ec0b4 ID des fehlerhaften Prozesses: 0x15e4 Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_winethc.dll0 Pfad der fehlerhaften Anwendung: rundll32.exe_winethc.dll1 Pfad des fehlerhaften Moduls: rundll32.exe_winethc.dll2 Berichtskennung: rundll32.exe_winethc.dll3 Vollständiger Name des fehlerhaften Pakets: rundll32.exe_winethc.dll4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: rundll32.exe_winethc.dll5 Error: (10/18/2014 11:06:27 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Name des fehlerhaften Moduls: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0015828c ID des fehlerhaften Prozesses: 0x1704 Startzeit der fehlerhaften Anwendung: 0xComiPo.exe0 Pfad der fehlerhaften Anwendung: ComiPo.exe1 Pfad des fehlerhaften Moduls: ComiPo.exe2 Berichtskennung: ComiPo.exe3 Vollständiger Name des fehlerhaften Pakets: ComiPo.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ComiPo.exe5 Error: (10/18/2014 11:06:16 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Name des fehlerhaften Moduls: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0015828c ID des fehlerhaften Prozesses: 0x1b4 Startzeit der fehlerhaften Anwendung: 0xComiPo.exe0 Pfad der fehlerhaften Anwendung: ComiPo.exe1 Pfad des fehlerhaften Moduls: ComiPo.exe2 Berichtskennung: ComiPo.exe3 Vollständiger Name des fehlerhaften Pakets: ComiPo.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ComiPo.exe5 Error: (10/18/2014 10:41:30 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Name des fehlerhaften Moduls: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0015828c ID des fehlerhaften Prozesses: 0x149c Startzeit der fehlerhaften Anwendung: 0xComiPo.exe0 Pfad der fehlerhaften Anwendung: ComiPo.exe1 Pfad des fehlerhaften Moduls: ComiPo.exe2 Berichtskennung: ComiPo.exe3 Vollständiger Name des fehlerhaften Pakets: ComiPo.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ComiPo.exe5 Error: (10/18/2014 10:41:05 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Name des fehlerhaften Moduls: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0015828c ID des fehlerhaften Prozesses: 0x1b64 Startzeit der fehlerhaften Anwendung: 0xComiPo.exe0 Pfad der fehlerhaften Anwendung: ComiPo.exe1 Pfad des fehlerhaften Moduls: ComiPo.exe2 Berichtskennung: ComiPo.exe3 Vollständiger Name des fehlerhaften Pakets: ComiPo.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ComiPo.exe5 Error: (10/18/2014 10:40:42 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Name des fehlerhaften Moduls: ComiPo.exe, Version: 2.30.1.0, Zeitstempel: 0x54253a12 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0015828c ID des fehlerhaften Prozesses: 0xc6c Startzeit der fehlerhaften Anwendung: 0xComiPo.exe0 Pfad der fehlerhaften Anwendung: ComiPo.exe1 Pfad des fehlerhaften Moduls: ComiPo.exe2 Berichtskennung: ComiPo.exe3 Vollständiger Name des fehlerhaften Pakets: ComiPo.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ComiPo.exe5 Error: (10/17/2014 05:27:48 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "Recovery" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (10/15/2014 02:31:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 14.0.7113.5000, Zeitstempel: 0x527d636c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eeb4a3 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000debd8 ID des fehlerhaften Prozesses: 0xe8c Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0 Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1 Pfad des fehlerhaften Moduls: OUTLOOK.EXE2 Berichtskennung: OUTLOOK.EXE3 Vollständiger Name des fehlerhaften Pakets: OUTLOOK.EXE4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OUTLOOK.EXE5 System errors: ============= Error: (10/22/2014 09:28:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (10/22/2014 09:28:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error: (10/22/2014 03:32:00 AM) (Source: volsnap) (EventID: 36) (User: ) Description: Die Schattenkopien von Volume "E:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (10/22/2014 03:14:33 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/22/2014 03:14:03 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/21/2014 09:10:06 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/21/2014 09:09:36 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/20/2014 01:52:15 PM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/20/2014 01:51:45 PM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/20/2014 01:42:38 PM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Microsoft Office Sessions: ========================= Error: (10/22/2014 03:38:20 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: RecoveryFalscher Parameter. (0x80070057) Error: (10/20/2014 10:51:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: rundll32.exe_winethc.dll6.3.9600.163845215f00dUSER32.dll6.3.9600.1727853eebd22c000014200000000000ec0b415e401cfeca79a1c041dC:\Windows\System32\rundll32.exeUSER32.dlld7cc263d-589a-11e4-82d3-6002926db33a Error: (10/17/2014 05:27:48 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: RecoveryFalscher Parameter. (0x80070057) Error: (10/15/2014 02:31:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: OUTLOOK.EXE14.0.7113.5000527d636cntdll.dll6.3.9600.1727853eeb4a3c0000374000debd8e8c01cfe861f267f3b2E:\Programme\Microsoft Office\Office14\OUTLOOK.EXEC:\Windows\SYSTEM32\ntdll.dll40856ea3-5467-11e4-82c8-6002926db33a ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7-4702MQ CPU @ 2.20GHz Percentage of memory in use: 10% Total physical RAM: 32648.27 MB Available physical RAM: 29246.4 MB Total Pagefile: 32848.27 MB Available Pagefile: 29485.11 MB Total Virtual: 131072 MB Available Virtual: 131071.78 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:93.78 GB) (Free:34.71 GB) NTFS Drive e: (Daten) (Fixed) (Total:447.76 GB) (Free:292.61 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: A260283A) Partition: GPT Partition Type. ======================================================== Disk: 1 (Size: 111.8 GB) (Disk ID: 5BED8B5A) Partition: GPT Partition Type. ==================== End Of Log ============================ |
24.10.2014, 18:10 | #6 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RtkGUI.lnk Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ --> Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü |
27.10.2014, 15:02 | #7 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Hier ist die Datei: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-10-2014 Ran by User at 2014-10-27 14:58:49 Run:1 Running from E:\Dokumente\User\Desktop Loaded Profiles: UpdatusUser & User (Available profiles: UpdatusUser & User) Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RtkGUI.lnk ***************** C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RtkGUI.lnk => Moved successfully. ==== End of Fixlog ==== Die Verknüpfung war danach weg, kam jedoch nach einem Neustart des Rechners wieder. |
28.10.2014, 10:11 | #8 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Is ja strange FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
28.10.2014, 11:11 | #9 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Langsam wird es frustrierend. Ich leiste hier einen digitalen Offenbarungseid und es kommt keine Lösung in Sicht, obwohl es "nur" um diese eine blöde Verknüpfung geht. Bin ich denn wirklich der einzige, dem das bis jetzt passiert ist? Es ist doch eine verbreitete Software (Realtek High Definition Audio Driver), die bereits vorinstalliert war. In anderen Foren bin ich leider auch noch nicht fündig geworden. Hier noch mal die beiden kompletten Logs: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-10-2014 01 Ran by User (administrator) on MCFLY on 28-10-2014 10:25:39 Running from E:\Dokumente\User\Desktop Loaded Profiles: UpdatusUser & User (Available profiles: UpdatusUser & User) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe (aborange.de - Mathias Gerlach) C:\Program Files (x86)\Synchronizer\aboScheduler.exe (Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe () C:\Program Files\Rainmeter\Rainmeter.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Stardock) C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock) C:\Program Files (x86)\Stardock\ObjectDock\Dock64.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QuickAccess.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Xerox Corporation) C:\Windows\System32\spool\drivers\x64\3\x2jobtHM.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13647576 2013-08-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2778352 2013-10-01] (Synaptics Incorporated) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft) HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [281312 2014-05-19] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-04] (AVAST Software) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH) HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD) HKLM-x32\...\Run: [BCSSync] => E:\Programme\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-4157436333-2088108305-2255346966-1002\...\Run: [aborange Scheduler] => C:\Program Files (x86)\Synchronizer\aboScheduler.exe [244736 2005-01-14] (aborange.de - Mathias Gerlach) HKU\S-1-5-21-4157436333-2088108305-2255346966-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-09-18] (Garmin Ltd or its subsidiaries) AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [184048 2013-10-31] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-10-31] (NVIDIA Corporation) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe () Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDock\ObjectDock.exe (Stardock) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB SearchScopes: HKLM - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB SearchScopes: HKLM-x32 - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB SearchScopes: HKCU - {12457955-94DD-43CF-AA18-2C964F46A4D6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB BHO: Shareaza Web Download Hook -> {0EEDB912-C5FA-486F-8334-57288578C627} -> E:\Programme\Shareaza\RazaWebHook64.dll (Shareaza Development Team) BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft) BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> E:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Tcpip\Parameters: [DhcpNameServer] 192.168.16.2 192.168.16.1 FireFox: ======== FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default FF DefaultSearchUrl: hxxp://www.bing.com/search FF SearchEngineOrder.1: Microsoft (Bing) FF Homepage: https://www.google.de/ FF Keyword.URL: hxxp://www.bing.com/search FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\Programme\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\Programme\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\searchplugins\bing-avast.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: YouTube Unblocker - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\youtubeunblocker@unblocker.yt [2014-10-17] FF Extension: TV-Fox - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2014-09-08] FF Extension: DownloadHelper - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-08] FF Extension: anonymoX - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\client@anonymox.net.xpi [2014-08-30] FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\firefox@ghostery.com.xpi [2014-08-30] FF Extension: Download Manager (S3) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\s3download@statusbar.xpi [2014-08-08] FF Extension: PDF Download - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.xpi [2012-01-05] FF Extension: {4b3f8014-9079-45b0-9895-2cb2efe9b582} - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{4b3f8014-9079-45b0-9895-2cb2efe9b582}.xpi [2013-11-02] FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hdstdv6q.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-23] Chrome: ======= CHR StartupUrls: Default -> "https://www.daa-mws-virtuell.de/" CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-09] CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-09] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-09] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-09] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-09] CHR Extension: (Google-Suche) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-09] CHR Extension: (Google Tabellen) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-09] CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-09] CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-09] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-04] (AVAST Software) S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2251992 2013-11-14] (Broadcom Corporation.) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573544 2014-03-21] (Acer Incorporated) S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [450904 2014-09-18] (Garmin Ltd or its subsidiaries) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed] R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation) S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation) S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation) R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [459496 2014-03-17] (Acer Incorporate) S3 Microsoft SharePoint Workspace Audit Service; E:\Programme\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-18] (Microsoft Corporation) S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation) R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [457960 2014-04-28] (Acer Incorporate) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] () R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-04-28] (Acer Incorporate) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27872 2014-05-19] (Samsung Electronics Co., Ltd.) S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation) S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-04] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-04] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-04] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-04] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-09-04] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-04] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-04] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-04] () R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-11-14] (Broadcom Corporation.) R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7549616 2014-02-25] (Broadcom Corporation) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [265952 2014-05-19] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2014-05-19] (Samsung Electronics Co., Ltd.) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated) S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.) R4 truecrypt; E:\Programme\Dropbox\Dropbox\Privat\TrueCrypt\truecrypt-x64.sys [231376 2012-02-08] (TrueCrypt Foundation) S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [116296 2014-09-09] (Oracle Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-27 15:05 - 2014-10-27 15:05 - 00001282 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RtkGUI.lnk 2014-10-27 13:01 - 2014-10-27 13:01 - 00000000 ____D () C:\Users\User\AppData\Local\Garmin 2014-10-27 13:00 - 2014-10-27 13:01 - 00000000 ____D () C:\Users\User\AppData\Roaming\Garmin 2014-10-27 13:00 - 2014-10-27 13:01 - 00000000 ____D () C:\ProgramData\Garmin 2014-10-27 13:00 - 2014-10-27 13:00 - 00003554 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask 2014-10-27 13:00 - 2014-10-27 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GPS 2014-10-27 13:00 - 2014-10-27 13:00 - 00000000 ____D () C:\Program Files\DIFX 2014-10-27 13:00 - 2014-10-27 13:00 - 00000000 ____D () C:\Program Files (x86)\Garmin 2014-10-24 09:13 - 2014-10-27 13:00 - 00000000 ____D () C:\ProgramData\Package Cache 2014-10-24 09:13 - 2014-10-24 09:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\Shareaza 2014-10-24 09:13 - 2014-10-24 09:13 - 00000000 ____D () C:\Users\User\AppData\Local\Shareaza 2014-10-23 08:40 - 2014-10-28 10:25 - 00000000 ____D () C:\FRST 2014-10-23 08:28 - 2014-10-23 08:28 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-10-23 08:28 - 2014-10-23 08:28 - 00000000 ____D () C:\Program Files (x86)\Java 2014-10-23 08:17 - 2014-10-23 08:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Virtualisierung 2014-10-22 13:49 - 2014-10-22 13:49 - 00000000 ____D () C:\Users\User\AppData\Roaming\vlc 2014-10-22 13:48 - 2014-10-22 13:48 - 00000000 ____D () C:\Program Files\VideoLAN 2014-10-22 13:39 - 2014-10-22 13:42 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype 2014-10-22 13:39 - 2014-10-22 13:39 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-10-22 13:39 - 2014-10-22 13:39 - 00000000 ____D () C:\Users\User\AppData\Local\Skype 2014-10-22 13:39 - 2014-10-22 13:39 - 00000000 ____D () C:\ProgramData\Skype 2014-10-22 11:11 - 2014-10-22 11:12 - 00000000 ____D () C:\Program Files (x86)\UltraISO 2014-10-22 10:50 - 2014-10-22 10:50 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack x64 2014-10-22 10:50 - 2012-06-09 18:21 - 00206336 _____ () C:\Windows\system32\unrar64.dll 2014-10-22 10:50 - 2011-12-07 18:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll 2014-10-22 10:19 - 2014-10-22 10:19 - 00001156 _____ () C:\Users\User\Desktop\Mantronic´s Kaiser II.lnk 2014-10-22 10:19 - 2014-10-22 10:19 - 00001156 _____ () C:\Users\UpdatusUser\Desktop\Mantronic´s Kaiser II.lnk 2014-10-22 10:19 - 2014-10-22 10:19 - 00000000 ____D () C:\Program Files (x86)\Mantronic 2014-10-21 12:57 - 2014-10-22 08:46 - 00000000 ____D () C:\Users\User\AppData\Roaming\Synchronizer 2014-10-21 12:57 - 2014-10-21 13:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\aborange 2014-10-21 12:57 - 2014-10-21 12:57 - 00001033 _____ () C:\Users\UpdatusUser\Desktop\Synchronizer.lnk 2014-10-21 12:57 - 2014-10-21 12:57 - 00000000 ____D () C:\Program Files (x86)\Synchronizer 2014-10-21 12:08 - 2014-10-28 10:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\FileZilla 2014-10-21 09:54 - 2014-10-21 11:43 - 00000000 ____D () C:\Users\User\AppData\Roaming\Trillian 2014-10-21 09:53 - 2014-10-21 09:54 - 00000000 ____D () C:\Program Files (x86)\Trillian 2014-10-20 12:23 - 2014-10-20 12:23 - 00000000 ____D () C:\Program Files\Bulk Rename Utility 2014-10-15 12:41 - 2014-10-15 12:42 - 00000000 ____D () C:\Program Files (x86)\lame3.99.5 2014-10-15 10:26 - 2014-10-15 10:26 - 00000034 _____ () C:\Windows\cdplayer.ini 2014-10-15 10:24 - 2014-10-15 10:24 - 00000000 ____D () C:\Users\User\AppData\Roaming\dlg 2014-10-15 10:24 - 2014-10-15 10:24 - 00000000 ____D () C:\Program Files (x86)\Audiograbber 2014-10-15 08:37 - 2014-10-15 08:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-15 08:37 - 2014-10-15 08:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-15 08:37 - 2014-10-15 08:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-10-15 08:37 - 2014-10-01 10:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-10-15 08:37 - 2014-10-01 10:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-10-15 08:37 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-10-15 08:26 - 2014-10-15 08:26 - 00000000 ____D () C:\Windows\ERUNT 2014-10-15 07:54 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-10-15 07:54 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-10-15 07:54 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-10-15 07:54 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-10-15 07:54 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-10-15 07:54 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-10-15 07:54 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-10-15 07:54 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-10-15 07:54 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-10-15 07:54 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-10-15 07:54 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-10-15 07:54 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-10-15 07:54 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-10-15 07:54 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-10-15 07:54 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-10-15 07:54 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-10-15 07:54 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-10-15 07:54 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-10-15 07:54 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-10-15 07:54 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-10-15 07:54 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-10-15 07:54 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-10-15 07:54 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-10-15 07:54 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-10-15 07:54 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-10-15 07:54 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-10-15 07:54 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-10-15 07:54 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-10-15 07:54 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-10-15 07:54 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-10-15 07:54 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-10-15 07:54 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-10-15 07:54 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-10-15 07:54 - 2014-09-10 07:25 - 00474432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-10-15 07:54 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-10-15 07:54 - 2014-09-08 04:07 - 02497344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-10-15 07:54 - 2014-09-08 04:07 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-10-15 07:54 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-10-15 07:54 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-10-15 07:54 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-10-15 07:54 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-10-15 07:54 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-10-15 07:54 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-10-15 07:54 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-10-15 07:54 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-10-15 07:54 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-10-15 07:54 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-10-15 07:54 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-10-15 07:54 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-10-15 07:54 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-10-15 07:54 - 2014-09-07 23:08 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml 2014-10-15 07:54 - 2014-09-04 23:30 - 00822272 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-10-15 07:54 - 2014-09-04 23:21 - 01053184 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2014-10-15 07:54 - 2014-09-04 04:15 - 00561416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-10-15 07:54 - 2014-09-04 04:14 - 00177472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-10-15 07:54 - 2014-09-04 04:05 - 00836176 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll 2014-10-15 07:54 - 2014-09-04 03:22 - 00670384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll 2014-10-15 07:54 - 2014-09-04 02:19 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2014-10-15 07:54 - 2014-09-04 02:01 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll 2014-10-15 07:54 - 2014-09-04 01:45 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2014-10-15 07:54 - 2014-09-04 01:41 - 01420288 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-10-15 07:54 - 2014-09-04 01:36 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-10-15 07:54 - 2014-09-04 01:32 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll 2014-10-15 07:54 - 2014-09-04 01:15 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-10-15 07:54 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll 2014-10-15 07:54 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll 2014-10-15 07:54 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll 2014-10-15 07:54 - 2014-08-31 01:17 - 00148800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-10-15 07:54 - 2014-08-31 01:15 - 21197152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-10-15 07:54 - 2014-08-30 23:59 - 18723112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-10-15 07:54 - 2014-08-30 23:05 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll 2014-10-15 07:54 - 2014-08-30 22:58 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll 2014-10-15 07:54 - 2014-08-30 22:04 - 00941568 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll 2014-10-15 07:54 - 2014-08-30 21:53 - 00239104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll 2014-10-15 07:54 - 2014-08-30 21:17 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll 2014-10-15 07:54 - 2014-08-28 03:55 - 07484224 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-10-15 07:54 - 2014-08-28 01:21 - 02480128 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-10-15 07:54 - 2014-08-28 01:06 - 02030592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-10-15 07:54 - 2014-08-23 06:14 - 13424128 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-10-15 07:54 - 2014-08-23 06:04 - 11820544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2014-10-15 07:54 - 2014-08-23 05:50 - 02714112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll 2014-10-15 07:54 - 2014-08-02 01:51 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll 2014-10-15 07:54 - 2014-08-02 01:35 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll 2014-10-15 07:53 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-10-15 07:53 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-10-15 07:53 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-10-15 07:53 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-10-15 07:53 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-10-15 07:53 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-10-15 07:53 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-10-14 08:48 - 2014-10-14 08:48 - 00000000 ____D () C:\usr 2014-10-11 13:35 - 2014-10-28 10:22 - 00000000 ____D () C:\Users\User\AppData\Roaming\KeePass 2014-10-11 13:21 - 2014-10-11 13:36 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2 2014-10-11 12:57 - 2014-10-11 12:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\NetBeans 2014-10-11 12:57 - 2014-10-11 12:57 - 00000000 ____D () C:\Users\User\AppData\Local\NetBeans 2014-10-09 22:17 - 2014-10-09 22:17 - 00000000 ____D () C:\Users\User\AppData\Roaming\SpaceEngineers 2014-10-08 14:32 - 2014-10-08 14:32 - 00000000 ____D () C:\Users\User\AppData\Local\Stardock 2014-10-08 14:29 - 2014-10-08 14:29 - 00000000 ____D () C:\Program Files (x86)\Stardock 2014-10-03 08:52 - 2014-10-03 08:56 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-10-03 08:51 - 2014-10-03 08:59 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft 2014-09-30 11:50 - 2014-09-30 11:50 - 00000000 ____D () C:\Users\Public\OEM 2014-09-30 11:48 - 2014-10-03 08:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Multimedia 2014-09-30 11:47 - 2014-09-30 12:01 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System 2014-09-30 11:31 - 2014-09-30 11:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spiele ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-28 10:25 - 2014-09-09 12:48 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-28 10:23 - 2014-09-04 11:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\ClassicShell 2014-10-28 10:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2014-10-28 09:56 - 2014-09-22 11:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-28 09:51 - 2014-09-03 18:34 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4157436333-2088108305-2255346966-1002 2014-10-28 09:45 - 2014-08-16 16:49 - 01095101 _____ () C:\Windows\WindowsUpdate.log 2014-10-28 09:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-10-28 07:57 - 2014-08-17 02:02 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2014-10-28 07:57 - 2014-08-17 02:02 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2014-10-28 07:57 - 2014-03-18 11:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-10-28 07:53 - 2014-09-09 12:48 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-28 07:53 - 2014-09-04 10:33 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox 2014-10-28 07:53 - 2013-08-22 15:46 - 00038837 _____ () C:\Windows\setupact.log 2014-10-28 07:53 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-27 21:51 - 2014-09-09 12:47 - 00003846 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1410263262 2014-10-27 21:51 - 2014-09-09 12:47 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-10-27 11:26 - 2014-09-10 10:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Notepad++ 2014-10-26 15:56 - 2014-09-05 12:32 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts 2014-10-26 15:56 - 2014-08-16 16:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-10-25 21:37 - 2014-09-18 10:51 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mp3tag 2014-10-25 18:28 - 2014-09-16 22:57 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-10-24 13:06 - 2014-09-23 08:35 - 00000000 ____D () C:\Users\User\.VirtualBox 2014-10-24 09:15 - 2014-09-17 12:11 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet 2014-10-23 09:06 - 2014-09-03 13:28 - 00000000 ____D () C:\Users\User\System 2014-10-23 08:32 - 2014-09-05 08:49 - 00000000 ____D () C:\ProgramData\Oracle 2014-10-23 08:18 - 2014-09-17 12:00 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Entwicklung 2014-10-22 16:15 - 2013-08-22 15:44 - 00554400 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-10-22 10:20 - 2014-09-04 21:02 - 00000000 ____D () C:\Users\User\AppData\Roaming\.minecraft 2014-10-22 08:58 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-10-20 21:51 - 2014-09-03 13:36 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps 2014-10-20 21:51 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF 2014-10-20 08:34 - 2014-09-17 13:46 - 00000000 ____D () C:\Program Files (x86)\Mp3tag 2014-10-17 07:40 - 2014-09-18 13:10 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-10-17 07:40 - 2014-09-18 13:10 - 00000000 ____D () C:\Program Files\Java 2014-10-17 04:34 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-10-15 22:01 - 2014-03-18 10:54 - 00082616 _____ () C:\Windows\PFRO.log 2014-10-15 21:59 - 2014-09-17 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astronomie 2014-10-15 21:54 - 2014-09-15 11:47 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-10-15 20:21 - 2014-09-09 12:48 - 00000000 ____D () C:\Users\User\AppData\Local\Google 2014-10-15 20:21 - 2014-09-09 12:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-10-15 20:20 - 2014-09-09 12:48 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-10-15 20:20 - 2014-09-09 12:48 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-10-15 12:25 - 2014-09-01 23:16 - 00000000 ____D () C:\Users\User\AppData\Local\VirtualStore 2014-10-15 08:03 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData 2014-10-15 08:03 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2014-10-15 08:03 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer 2014-10-15 08:03 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager 2014-10-15 08:03 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera 2014-10-15 08:00 - 2014-09-04 07:46 - 00000000 ____D () C:\Windows\system32\MRT 2014-10-15 08:00 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-10-15 07:55 - 2014-09-04 07:46 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-10-15 07:55 - 2014-09-04 07:45 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-10-13 07:18 - 2014-09-17 11:58 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Büro 2014-10-09 21:15 - 2014-09-04 12:39 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-09-30 16:50 - 2014-09-05 08:36 - 00000000 ____D () C:\Users\User\AppData\Roaming\TeamViewer 2014-09-30 12:04 - 2014-09-17 12:04 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System 2014-09-30 11:51 - 2014-06-11 09:17 - 00000000 ____D () C:\Program Files (x86)\Acer 2014-09-30 11:34 - 2014-09-17 12:12 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spiele 2014-09-29 23:45 - 2014-06-11 09:10 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-09-29 23:45 - 2014-06-11 09:10 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\AcerDocsSetup.exe C:\Users\User\AppData\Local\Temp\AcerPortalSetup.exe C:\Users\User\AppData\Local\Temp\drm_dyndata_7370014.dll C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyjdkhj.dll C:\Users\User\AppData\Local\Temp\jre-8u25-windows-au.exe C:\Users\User\AppData\Local\Temp\oct3BAE.tmp.exe C:\Users\User\AppData\Local\Temp\ose00000.exe C:\Users\User\AppData\Local\Temp\ose00001.exe C:\Users\User\AppData\Local\Temp\ose00002.exe C:\Users\User\AppData\Local\Temp\ose00003.exe C:\Users\User\AppData\Local\Temp\Quarantine.exe C:\Users\User\AppData\Local\Temp\sqlite3.dll C:\Users\User\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-28 08:03 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-10-2014 01 Ran by User at 2014-10-28 10:26:05 Running from E:\Dokumente\User\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) @icon sushi 1.21 (HKLM-x32\...\@icon sushi_is1) (Version: - towofu's SOFT) Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated) Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8105 - Acer Incorporated) Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8104 - Acer Incorporated) Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3014.0 - Acer Incorporated) Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8106 - Acer Incorporated) Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2001.4 - Acer Incorporated) Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Reader XI (11.0.09) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated) Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team) Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber) avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software) Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.234 - Broadcom Corporation) Broadcom NetLink Controller (HKLM\...\{7FBA83D7-D58E-4B70-9B9B-12E95B183B22}) (Version: 16.6.1.3 - Broadcom Corporation) Bulk Rename Utility 2.7.1.3 (HKLM\...\Bulk Rename Utility_is1) (Version: - TGRMN Software) Celestia 1.6.1 (HKLM-x32\...\Celestia_is1) (Version: - Shatters Software) Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft) Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.) CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.3721 - CyberLink Corp.) CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3914.57 - CyberLink Corp.) Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc) DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.50.000 - Runtime Software) Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.) Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD) Elevated Installer (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden FileZilla Client 3.9.0.6 (HKCU\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse) Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.3.10.923 - DVDVideoSoft Ltd.) Garmin Express (HKLM-x32\...\{447c27b7-3a63-4cb2-a49c-864050f9a50f}) (Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Garmin Express (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden Garmin Express Tray (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden GlassFish Server Open Source Edition 4.1 (HKLM\...\nbi-glassfish-mod-4.1.0.13.0) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.8101 - Acer Incorporated) ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) Intel(R) Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan) Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) Java Auto Updater (x32 Version: 2.8.25.18 - Oracle Corporation) Hidden Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation) KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl) K-Lite Codec Pack 9.9.9 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.9.9 - ) LibreOffice 4.3 Help Pack (German) (HKLM-x32\...\{1560A369-7C63-4D4E-AA09-494C4BD47256}) (Version: 4.3.1.2 - The Document Foundation) LibreOffice 4.3.1.2 (HKLM-x32\...\{303C2B0D-03AF-4C25-A443-E62DE8AA36A8}) (Version: 4.3.1.2 - The Document Foundation) Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Acer Incorporated) Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation) Mantronic´s KaiserII (Version 2.2) (HKLM-x32\...\Mantronic´s Kaiser II_is1) (Version: 2.2.0 - Mantronic Software) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Moonbase Alpha (HKLM-x32\...\Steam App 39000) (Version: - Virtual Heroes) Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla) Mp3tag v2.65 (HKLM-x32\...\Mp3tag) (Version: v2.65 - Florian Heidenreich) Nero BackItUp (x32 Version: 12.5.11000 - Nero AG) Hidden Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{551AC8F2-FEA2-4B45-ACF7-C98681233CC9}) (Version: 12.5.01200 - Nero AG) Nero BackItUp Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden Nero ControlCenter (x32 Version: 11.0.15900 - Nero AG) Hidden Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden Nero Core Components (x32 Version: 11.0.20900 - Nero AG) Hidden Nero Launcher (x32 Version: 12.2.7000 - Nero AG) Hidden Nero RescueAgent (x32 Version: 12.0.3001 - Nero AG) Hidden Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden NetBeans IDE 8.0.1 (HKLM\...\nbi-nb-base-8.0.1.0.201409082112) (Version: 8.0.1 - NetBeans.org) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team) NVIDIA Grafiktreiber 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.141.953 - NVIDIA Corporation) Hidden NVIDIA Optimus 1.14.17 (Version: 1.14.17 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation) NVIDIA Systemsteuerung 327.62 (Version: 327.62 - NVIDIA Corporation) Hidden NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation) NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden ObjectDock Plus (HKLM-x32\...\ObjectDock Plus) (Version: - ) OpenAL (HKLM-x32\...\OpenAL) (Version: - ) Opera Stable 25.0.1614.63 (HKLM-x32\...\Opera 25.0.1614.63) (Version: 25.0.1614.63 - Opera Software ASA) Oracle VM VirtualBox 4.3.16 (HKLM\...\{D7FAEA32-7CE3-4D9F-9139-F7B87BCC50AF}) (Version: 4.3.16 - Oracle Corporation) Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.) PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.4 - Andrea Vacondio) PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden PSPad editor (HKLM-x32\...\PSPad editor_is1) (Version: 4.5.8.2500 - Jan Fiala) Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.1 r2290 - ) RAPID Mode (Version: 1.0.1.68 - Samsung Electronics Co., Ltd.) Hidden Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.28148 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7027 - Realtek Semiconductor Corp.) Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Shareaza 2.7.7.0 (HKLM\...\Shareaza_is1) (Version: 2.7.7.0 - Shareaza Development Team) Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.) Spielkanäle (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 9.2.0.11 - WildTangent, Inc.) SPORE™ (HKLM-x32\...\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}) (Version: 1.05.0001 - Electronic Arts) SPORE™ Galaktische Abenteuer (HKLM-x32\...\{63CEA2E4-4FE7-4F2C-B388-C1313D24157C}) (Version: 1.00.0000 - Electronic Arts) Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) Stellarium 0.13.0 (HKLM-x32\...\Stellarium_is1) (Version: 0.13.0 - Stellarium team) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.6.17 - Synaptics Incorporated) Synchronizer - Deinstallation (HKLM-x32\...\Synchronizer_is1) (Version: 5.00 - Mathias Gerlach [aborange.de]) TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer) The Babylon Project (HKLM-x32\...\InstallShield_{B9883E2B-775E-4FF0-B664-94C95C313938}) (Version: 3.4.2 - The Babylon Project) The Babylon Project (x32 Version: 3.4.2 - The Babylon Project) Hidden The Chronicles of Emerland Solitaire (x32 Version: 3.0.2.32 - WildTangent) Hidden Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden Tunatic (HKLM-x32\...\Tunatic) (Version: - ) UltraISO Premium V9.62 (HKLM-x32\...\UltraISO_is1) (Version: - ) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.9590 - Broadcom Corporation) WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent) WildTangent Games App (x32 Version: 4.0.10.20 - WildTangent) Hidden Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.) Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software) WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-5 - Bitnami) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-4157436333-2088108305-2255346966-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ==================== Restore Points ========================= ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0044BF0D-0447-4379-BE6C-E6B109F1AD8F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-09-04] (AVAST Software) Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {123663B8-653B-411E-B231-2220491AD4EA} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-09-18] () Task: {16495137-2DAC-41A3-AF52-5256241BFE11} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-04-28] (Acer Incorporate) Task: {165DB82E-2EF0-44AD-8AB3-5D5FBBE858BB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-22] (Adobe Systems Incorporated) Task: {1CBFBCEC-5507-4D0C-85FD-97B49D7D867F} - System32\Tasks\Opera scheduled Autoupdate 1410263262 => C:\Program Files (x86)\Opera\launcher.exe [2014-10-23] (Opera Software) Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {3EDC32EB-07F5-4CAC-9DC7-9768627FC3FA} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-03-18] (Acer Incorporated) Task: {4384C4B9-98C6-4F4D-BB55-A000B6CFA100} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {55C1CF8E-C314-4F7A-AD82-87941F1B315C} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] () Task: {59644A02-912E-4A06-9BBC-968E9844B147} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-04-28] (Acer Incorporate) Task: {650CF53D-23BC-43D3-B1FD-1BCCB5BD41BE} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.) Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {93D37670-CEF6-4E54-A2BA-8D70DDB2BF3C} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv Task: {9CD982AB-B20C-40F8-AA4C-FF288CEA7A8E} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-03-21] (Acer Incorporated) Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {A6BFAC2B-0921-419C-A06A-75DC7AF11861} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-09] (Google Inc.) Task: {BF58E14B-1069-43E0-80DD-BB525A2FD9CD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics Task: {C759A239-7E3E-40A6-967D-B39A229F073C} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D08F1AB1-8F5E-4779-937E-7A750E734C77} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation) Task: {D4D063A0-3851-4686-85DB-CDCD17547ECA} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-07-08] () Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {DEB03988-4BAD-4250-9194-838D75B82AC2} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-07-08] (Dolby Laboratories Inc.) Task: {E2ACF668-4308-4463-9ECA-B3DD4467FB01} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation Task: {E3BDCA69-0278-4D27-AE94-D673C4802877} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {ECE0E9C4-34CD-4041-BEE4-E2903800183B} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-03-17] (Acer Incorporate) Task: {FAE995A3-B69D-4CDB-84E3-096941D75629} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-15] (Microsoft Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-08-16 16:49 - 2013-10-31 21:43 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll 2014-09-05 08:36 - 2014-09-11 07:06 - 00020240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll 2014-04-14 15:27 - 2014-04-14 15:27 - 00049368 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll 2014-10-08 14:29 - 2007-04-23 15:53 - 00020752 _____ () C:\Program Files (x86)\Stardock\ObjectDock\Dock64.dll 2014-08-16 17:11 - 2014-01-03 13:13 - 00111872 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext_x64.dll 2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () E:\Programme\FileZilla FTP Client\fzshellext_64.dll 2014-08-16 17:04 - 2012-04-24 11:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe 2013-07-08 17:53 - 2013-07-08 17:53 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll 2014-05-25 15:18 - 2014-05-25 15:18 - 00036536 _____ () C:\Program Files\Rainmeter\Rainmeter.exe 2014-05-25 15:18 - 2014-05-25 15:18 - 00747192 _____ () C:\Program Files\Rainmeter\Rainmeter.dll 2014-05-25 15:17 - 2014-05-25 15:17 - 00012800 _____ () C:\Program Files\Rainmeter\Plugins\Perfmon.dll 2014-05-25 15:17 - 2014-05-25 15:17 - 00056832 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll 2014-05-25 15:17 - 2014-05-25 15:17 - 00019968 _____ () C:\Program Files\Rainmeter\Plugins\SysInfo.dll 2014-05-25 15:17 - 2014-05-25 15:17 - 00023040 _____ () C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.dll 2014-09-04 12:39 - 2014-09-04 12:39 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll 2014-10-27 21:46 - 2014-10-27 21:46 - 02898432 _____ () C:\Program Files\AVAST Software\Avast\defs\14102702\algo.dll 2014-09-05 08:12 - 2014-05-06 10:24 - 00013824 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll 2014-09-05 08:12 - 2014-05-19 19:20 - 00103424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\PAL.dll 2014-09-05 08:12 - 2014-05-19 19:20 - 00039424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SATA.dll 2014-09-05 08:12 - 2014-05-19 19:19 - 00038400 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAT.dll 2014-09-05 08:12 - 2014-05-19 19:20 - 00031232 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SMINI.dll 2014-09-05 08:12 - 2014-05-19 19:19 - 00029696 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAS.dll 2014-10-08 14:29 - 2007-04-24 14:22 - 00112400 _____ () C:\Program Files (x86)\Stardock\ObjectDock\DockShellHook.dll 2014-09-04 09:30 - 2014-09-26 08:53 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2014-10-28 07:53 - 2014-10-28 07:53 - 00043008 _____ () c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyjdkhj.dll 2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll 2014-09-04 12:39 - 2014-09-04 12:39 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-10-08 14:29 - 2007-04-19 13:23 - 00095944 _____ () C:\Program Files (x86)\Stardock\ObjectDock\CrashRpt.dll 2014-10-08 14:29 - 2007-04-21 12:47 - 00059592 _____ () C:\Program Files (x86)\Stardock\ObjectDock\zlib.dll 2014-10-08 14:29 - 2002-11-19 13:11 - 00139264 _____ () C:\Program Files (x86)\Common Files\Stardock\ODImg.dll 2014-08-16 16:42 - 2013-09-04 00:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run32: => "BCSSync" HKCU\...\StartupApproved\Run: => "InetStat" ========================= Accounts: ========================== Administrator (S-1-5-21-4157436333-2088108305-2255346966-500 - Administrator - Disabled) Gast (S-1-5-21-4157436333-2088108305-2255346966-501 - Limited - Disabled) UpdatusUser (S-1-5-21-4157436333-2088108305-2255346966-1001 - Limited - Enabled) => C:\Users\UpdatusUser User (S-1-5-21-4157436333-2088108305-2255346966-1002 - Administrator - Enabled) => C:\Users\User ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/23/2014 10:17:27 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "Recovery" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (10/22/2014 02:38:20 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "Recovery" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (10/20/2014 09:51:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: rundll32.exe_winethc.dll, Version: 6.3.9600.16384, Zeitstempel: 0x5215f00d Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebd22 Ausnahmecode: 0xc0000142 Fehleroffset: 0x00000000000ec0b4 ID des fehlerhaften Prozesses: 0x15e4 Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_winethc.dll0 Pfad der fehlerhaften Anwendung: rundll32.exe_winethc.dll1 Pfad des fehlerhaften Moduls: rundll32.exe_winethc.dll2 Berichtskennung: rundll32.exe_winethc.dll3 Vollständiger Name des fehlerhaften Pakets: rundll32.exe_winethc.dll4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: rundll32.exe_winethc.dll5 Error: (10/17/2014 04:27:48 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "Recovery" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (10/15/2014 01:31:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 14.0.7113.5000, Zeitstempel: 0x527d636c Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eeb4a3 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000debd8 ID des fehlerhaften Prozesses: 0xe8c Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0 Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1 Pfad des fehlerhaften Moduls: OUTLOOK.EXE2 Berichtskennung: OUTLOOK.EXE3 Vollständiger Name des fehlerhaften Pakets: OUTLOOK.EXE4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OUTLOOK.EXE5 System errors: ============= Error: (10/28/2014 09:52:18 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/28/2014 09:51:48 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/28/2014 09:27:20 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/28/2014 09:26:50 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/28/2014 08:04:22 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/28/2014 08:03:52 AM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Error: (10/28/2014 07:53:38 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (10/28/2014 07:53:38 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht. Error: (10/27/2014 09:57:15 PM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (10/27/2014 09:56:45 PM) (Source: DCOM) (EventID: 10010) (User: MCFLY) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Microsoft Office Sessions: ========================= Error: (10/23/2014 10:17:27 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: RecoveryFalscher Parameter. (0x80070057) Error: (10/22/2014 02:38:20 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: RecoveryFalscher Parameter. (0x80070057) Error: (10/20/2014 09:51:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: rundll32.exe_winethc.dll6.3.9600.163845215f00dUSER32.dll6.3.9600.1727853eebd22c000014200000000000ec0b415e401cfeca79a1c041dC:\Windows\System32\rundll32.exeUSER32.dlld7cc263d-589a-11e4-82d3-6002926db33a Error: (10/17/2014 04:27:48 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: RecoveryFalscher Parameter. (0x80070057) Error: (10/15/2014 01:31:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: OUTLOOK.EXE14.0.7113.5000527d636cntdll.dll6.3.9600.1727853eeb4a3c0000374000debd8e8c01cfe861f267f3b2E:\Programme\Microsoft Office\Office14\OUTLOOK.EXEC:\Windows\SYSTEM32\ntdll.dll40856ea3-5467-11e4-82c8-6002926db33a ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7-4702MQ CPU @ 2.20GHz Percentage of memory in use: 16% Total physical RAM: 32648.27 MB Available physical RAM: 27134.93 MB Total Pagefile: 33184.27 MB Available Pagefile: 27242.95 MB Total Virtual: 131072 MB Available Virtual: 131071.83 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:93.78 GB) (Free:36.36 GB) NTFS Drive e: (Daten) (Fixed) (Total:447.76 GB) (Free:290.8 GB) NTFS Drive h: () (Removable) (Total:3.87 GB) (Free:3.8 GB) FAT32 Drive i: () (Removable) (Total:14.83 GB) (Free:7.74 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: A260283A) Partition: GPT Partition Type. ======================================================== Disk: 1 (Size: 111.8 GB) (Disk ID: 5BED8B5A) Partition: GPT Partition Type. Attempted reading MBR returned 0 bytes. Could not read MBR for disk 2. ======================================================== Disk: 3 (Size: 14.8 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ |
28.10.2014, 19:34 | #10 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Das Problem an der Sache ist, dass die super leicht ersichtliche Autostarteintrag auch super leicht zu fixen ist, wie du ja gesehen hast. Problem ist das irgendwer den immer wiederherstellt. Ich DAS sieht man nicht im log. Ich tippe ja auf Classic Shell. Aber da kann ich auch nicht mehr raten als Classic Shell mal komplett zu deinstallieren und neu zu installieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
30.10.2014, 11:12 | #11 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Okay, werde ich nachher machen und morgen berichten. Danke trotzdem erstmal für die Mühe! So, hier die Rückmeldung: Ich habe das Classic-Menü komplett deinstalliert und nach einem Neustart des Rechners neu heruntergeladen und installiert. Dabei habe ich keinerlei Einstellungen aus meiner vorherigen Installation per Import übernommen, sondern lediglich meine Einstellungswünsche von Hand konfiguriert. Egebnis: Das Menü sah wie gewünscht aus (also ohne das Realtek-Icon). Nach einem Rechner-Neustart war es jedoch wieder da. Wieder im Menü oben an erster Stelle. Ich gehe davon aus, dass mein Problem nichts mit dem Classic Menü zu tun hat, sondern dass dieser blödes Realtek-Soundtreiber dafür verantwortlich ist. Ich habe aber keinerlei Einstellungsmögllichkeiten beim Treiber gefunden. Gibt es jetzt noch irgend eine Möglichkeit, außer dieses blöde Ding komplett zu deinstallieren (wobei ich die Auswirkungen auf die Funktion meiner Soundkarte dann nicht vorhersagen kann)? |
31.10.2014, 08:43 | #12 | |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins StartmenüZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
31.10.2014, 11:31 | #13 |
| Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Dann werde ich wohl damit leben müssen. *#$%!!! Ich hasse es, auf meinem eigenen Rechner bevormundet zu werden! Trotzdem vielen Dank für Deine Mühen! |
31.10.2014, 20:00 | #14 |
/// the machine /// TB-Ausbilder | Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Verknüpfung zum Realtek HD Audio-Manager kommt immer wieder ins Startmenü |
acer aspire, fehlercode 0x80070057, fehlercode 0xc0000005, fehlercode 0xc0000142, fehlercode 0xc0000374, kommt immer wieder, penetrant, programm, programme, realtek, realtek hd audio-manager, rechner, rootkit, rtkgui, screenshot, software, start, startmenü, systemsteuerung, windows |