| |
| |||||||
Log-Analyse und Auswertung: Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein GrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
19.12.2014, 18:46
| #1 |
| |  Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr Hallo, kurz vorab: Ich gehöre zu einer kleinen Software Firma, haben genau 0-Mann als IT Abteilung, den Rechner neu aufsetzen wäre der Horror, wenn Ihr mir helfen würdet wäre super!! Problem Beschreibung: Seit ein paar Wochen geht plötzlich der Explorer beim Klicken auf einen Link wo ganz anders auf als erwartet (in der URL steht kurz Redirect und manchmal findall....) Dadurch wurde ich stutzig, habe den Virenscanner (Kaspersky 2014 AntiVir) neu installiert, dann noch das Programm Malewarebytes laufen lassen, beides ohne Befund. Selbst ein Scan mit Bootmedium von Avira hat nur bekannte Files im Spanfolder gezeigt. Seit ca. 1 Woche werden nun einige Programme blockiert. Das tritt vorallem immer auf wenn ich etwas als Admin ausführen will. Der hinweis der dann in einer Windows Infobox kommt ist "Dieses Programm wurde durch eine Gruppenrichtlinie blockiert. Weitere Informationen erhalten Sie vom Systemadministrator.! Ich habe versucht eure Anweisung durchzuarbeiten dabei ist das Programm: esetsmartinstaller_deu nicht Ausgeführt worden (Bin als Admin eingeloggt), es hing bei der Bestätigung, der Start Button funktionierte nicht (obwohl ich den Hacken gesetzt habe). Defogger wird blockiert (er ging einmal, beim zweiten mal wurde er geblockt... komisch, oder) der Scan mit FRST funktionierte, Logs: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-12-2014 Ran by stcadmin (ATTENTION: The logged in user is not administrator) on SERVICETRACE01 on 19-12-2014 18:08:01 Running from C:\Users\stcadmin\Desktop Loaded Profiles: UpdatusUser & stcadmin (Available profiles: mduus & UpdatusUser & Markus & stcadmin & Administrator) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avpui.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Sage Software, Inc.) C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\offlagent10\offlagent.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_15_0_0_167_ActiveX.exe (ESET) C:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6469736 2012-03-29] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2870032 2012-03-07] (Synaptics Incorporated) HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5727392 2012-01-19] (Dell Inc.) HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [Act.Outlook.Service] => C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe [17920 2010-01-06] (Sage Software, Inc.) HKLM-x32\...\Run: [Act! Preloader] => C:\Program Files (x86)\ACT\Act for Windows\ActSage.exe [331776 2010-01-04] (Sage Software, Inc.) HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [144616 2011-03-01] (CyberLink Corp.) HKLM-x32\...\Run: [PowerDVD12DMREngine] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-10-19] (CyberLink) HKLM-x32\...\Run: [PowerDVD12Agent] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe [374560 2012-10-19] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.) HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-11-12] (cyberlink) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [SMB60StarMoneyRunEntry] => C:\Program Files (x86)\StarMoney Business 6.0\app\oflagent.exe [51856 2014-12-18] (Star Finanz-Software Entwicklung und Vertriebs GmbH) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH) HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll [X] HKLM\...\Policies\Explorer: [NoCDBurning] 1 AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-11-21] (NVIDIA Corporation) AppInit_DLLs: , C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\kloehk.dll [15448 2010-12-09] (Kaspersky Lab) AppInit_DLLs: , C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\sbhook64.dll [69720 2010-12-09] (Kaspersky Lab) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-11-21] (NVIDIA Corporation) AppInit_DLLs-x32: , C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\mzvkbd3.dll [109144 2010-12-09] (Kaspersky Lab) AppInit_DLLs-x32: , C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\sbhook.dll [72280 2010-12-09] (Kaspersky Lab) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => No File ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => No File ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => No File ShellIconOverlayIdentifiers: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\shellex.dll (Kaspersky Lab ZAO) ShellIconOverlayIdentifiers-x32: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\shellex.dll (Kaspersky Lab ZAO) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1484493839-596051297-3328508428-1019\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp URLSearchHook: [S-1-5-21-1484493839-596051297-3328508428-1001] ATTENTION ==> Default URLSearchHook is missing. BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\ievkbd.dll (Kaspersky Lab) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\ievkbd.dll (Kaspersky Lab) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile -> {D5233FCD-D258-4903-89B8-FB1568E7413D} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.99.1 Tcpip\..\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: [NameServer] 8.8.8.8,8.8.8.8 Tcpip\..\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: [NameServer] 8.8.8.8,8.8.8.8 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2014-09-26] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com [2014-12-18] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-18] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com [2014-12-18] FF HKLM-x32\...\Thunderbird\Extensions: [{eea12ec4-729d-4703-bc37-106ce9879ce2}] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt FF Extension: Kaspersky Anti-Spam Extension - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt [2014-07-18] Chrome: ======= CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found] CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\urladvisor.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 ACT! Scheduler; C:\Program Files (x86)\ACT\Act for Windows\Act.Scheduler.exe [81920 2010-01-04] (Sage Software, Inc.) [File not signed] R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin) R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO) R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-13] (brother Industries Ltd) [File not signed] R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT) R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-10-19] (CyberLink Corp.) S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2010-11-12] (CyberLink) R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-10-19] (CyberLink) R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-10-19] (CyberLink) R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [8498608 2012-03-15] (DisplayLink Corp.) R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-01] (Intel Corporation) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R2 MSSQL$ACT7; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] () S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed] R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed] R2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed] R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [199272 2011-05-18] (Realtek Semiconductor) R2 ServiceTracer Agent; C:\Program Files\ServiceTracer\Agent\ServiceTracerAgent.exe [877568 2014-01-13] (ServiceTrace e.K.) [File not signed] R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 StarMoney Business 6.0 OnlineUpdate; C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] () [File not signed] R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation) S2 CLKMSVC10_1628BCEA; "C:\Program Files (x86)\CyberLink\PowerDVD DX\Kernel\BD\NavFilter\kmsvc.exe" /svc [X] S2 CSObjectsSrv; "C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 Capsax64Drv0; C:\Windows\System32\Drivers\Capsax64Drv0.sys [35976 2014-08-15] (Colasoft Co., Ltd.) R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT) U5 CSCrySec; C:\Windows\System32\Drivers\CSCrySec.sys [85048 2009-12-14] (Infowatch) R1 CSN5PDTS82x64; C:\Windows\System32\Drivers\CSN5PDTS82x64.sys [34840 2012-10-24] (Colasoft Co., Ltd.) S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_6.2.37054.0.sys [17408 2012-03-15] (hxxp://libusb-win32.sourceforge.net) S3 dlcdcecm; C:\Windows\System32\DRIVERS\dlcdcecm.sys [38400 2012-03-15] (DisplayLink Corp.) S3 dlusbaudio; C:\Windows\System32\DRIVERS\dlusbaudio_x64.sys [192120 2012-03-15] (DisplayLink Corp.) R3 hswpan; C:\Windows\System32\DRIVERS\hswpan.sys [109056 2012-01-27] (Ozmo Inc) R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] () S3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] () R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] () R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-12-18] (Kaspersky Lab ZAO) R0 KLBG; C:\Windows\System32\DRIVERS\klbg.sys [40464 2009-10-14] (Kaspersky Lab) S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-12-18] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-12-18] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-12-18] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-12-18] (Kaspersky Lab ZAO) R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-18] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.) R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-11-21] (NVIDIA Corporation) R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R3 SmbDrvIntel; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [24848 2012-03-07] (Synaptics Incorporated) R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-10-24] (Acronis International GmbH) R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-10-24] (Acronis International GmbH) R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-10-24] (Acronis International GmbH) R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-12-19] () R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-10-19] (CyberLink Corp.) S1 awtocttz; \??\C:\Windows\system32\drivers\awtocttz.sys [X] S1 cmelsjaq; \??\C:\Windows\system32\drivers\cmelsjaq.sys [X] S1 CSN5PDTS82; System32\Drivers\CSN5PDTS82.sys [X] S1 CsNdisLWF; System32\Drivers\CsNdisLWF.sys [X] S1 dcstxbht; \??\C:\Windows\system32\drivers\dcstxbht.sys [X] S1 ipwuabum; \??\C:\Windows\system32\drivers\ipwuabum.sys [X] S1 putybsdl; \??\C:\Windows\system32\drivers\putybsdl.sys [X] S1 qawzvpin; \??\C:\Windows\system32\drivers\qawzvpin.sys [X] S1 sedgtwrs; \??\C:\Windows\system32\drivers\sedgtwrs.sys [X] S0 vmci; system32\DRIVERS\vmci.sys [X] S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X] S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-19 18:08 - 2014-12-19 18:08 - 00031630 _____ () C:\Users\stcadmin\Desktop\FRST.txt 2014-12-19 18:07 - 2014-12-19 18:08 - 00000000 ____D () C:\FRST 2014-12-19 18:07 - 2014-12-19 18:07 - 02121216 _____ (Farbar) C:\Users\stcadmin\Desktop\FRST64.exe 2014-12-19 18:04 - 2014-12-19 18:05 - 00050477 _____ () C:\Users\stcadmin\Desktop\Defogger.exe 2014-12-19 17:56 - 2014-12-16 10:11 - 02347384 _____ (ESET) C:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe 2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieUserList 2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieSiteList 2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieBrowserModeList 2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Macromedia 2014-12-19 11:31 - 2014-12-19 11:31 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp 2014-12-18 13:16 - 2014-12-18 13:18 - 00000000 ____D () C:\ProgramData\WebEx 2014-12-18 09:46 - 2014-12-18 09:46 - 00001089 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk 2014-12-18 09:46 - 2014-12-18 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus 2014-12-18 09:46 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll 2014-12-18 09:45 - 2014-12-18 10:22 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys 2014-12-18 09:45 - 2014-12-18 10:22 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys 2014-12-18 09:45 - 2014-12-18 09:45 - 00000000 ____D () C:\Windows\ELAMBKUP 2014-12-18 09:44 - 2014-12-18 09:44 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Foxit Software 2014-12-18 07:10 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 07:10 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-17 08:49 - 2014-12-19 17:54 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CrashDumps 2014-12-17 08:49 - 2014-12-17 08:49 - 00111672 _____ () C:\Users\stcadmin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-17 08:49 - 2014-12-17 08:49 - 00001421 _____ () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\IsolatedStorage 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel Corporation 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\CyberLink 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Adobe 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\ACT 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\MediaServer 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\IsolatedStorage 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Google 2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CyberLink 2014-12-17 08:48 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin 2014-12-17 08:48 - 2014-12-17 08:48 - 00000020 ___SH () C:\Users\stcadmin\ntuser.ini 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Vorlagen 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Startmenü 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Netzwerkumgebung 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Lokale Einstellungen 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Eigene Dateien 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Druckumgebung 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Musik 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Bilder 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Verlauf 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Anwendungsdaten 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Anwendungsdaten 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel 2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\VirtualStore 2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Apple Computer 2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Apple Computer 2014-12-17 08:48 - 2012-08-24 23:24 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Microsoft Help 2014-12-17 08:48 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-12-17 08:48 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-12-16 09:48 - 2014-12-16 09:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis 2014-12-16 09:48 - 2014-12-16 09:48 - 00000000 ____D () C:\Program Files (x86)\Acronis 2014-12-10 09:38 - 2014-12-10 09:38 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-10 09:04 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-10 09:04 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-10 09:04 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-10 09:04 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-10 09:04 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-10 09:04 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-10 09:04 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-10 09:04 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-10 09:04 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-10 09:04 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-10 07:25 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 07:25 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 07:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 07:25 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 07:25 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-10 07:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 07:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-10 07:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 07:25 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-10 07:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 07:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 07:25 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-10 07:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 07:25 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-10 07:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 07:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-10 07:25 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-10 07:25 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 07:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 07:25 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-10 07:25 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-10 07:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-10 07:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 07:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 07:25 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-10 07:25 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-10 07:25 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 07:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 07:25 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 07:25 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-10 07:25 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-10 07:25 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-10 07:25 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-10 07:25 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 07:25 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 07:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-10 07:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 07:25 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-10 07:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 07:25 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-10 07:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-10 07:25 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 07:25 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 07:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 07:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 07:25 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 07:25 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 07:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-10 07:25 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 07:25 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 07:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 07:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 07:25 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 07:25 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 07:18 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 07:18 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 07:18 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-10 07:18 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 07:18 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 07:18 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-10 07:17 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 07:17 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-10 07:17 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-10 07:17 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-10 07:17 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-10 07:17 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-10 07:17 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-10 07:17 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-10 07:17 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-10 07:17 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-10 07:17 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-10 07:17 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-10 07:17 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-10 07:17 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-11-19 09:10 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-19 09:10 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-19 09:10 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-19 09:10 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-11-19 04:31 - 2014-11-19 04:31 - 01217192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-19 18:06 - 2012-08-27 14:14 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-19 17:58 - 2013-01-15 10:10 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-12-19 17:54 - 2012-09-06 14:49 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype 2014-12-19 17:54 - 2012-08-27 14:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-19 17:54 - 2012-08-25 12:48 - 00000952 ___SH () C:\ProgramData\KGyGaAvL.sys 2014-12-19 17:53 - 2012-08-25 10:14 - 00000000 ____D () C:\ServiceTrace 2014-12-19 17:29 - 2012-08-24 19:26 - 01288284 _____ () C:\Windows\WindowsUpdate.log 2014-12-19 17:14 - 2014-02-12 16:46 - 00000568 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job 2014-12-19 17:07 - 2014-09-29 20:33 - 00000000 ____D () C:\Program Files (x86)\StarMoney Business 6.0 2014-12-19 16:43 - 2009-07-14 05:51 - 00515381 _____ () C:\Windows\setupact.log 2014-12-19 11:38 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-19 11:38 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-19 11:37 - 2012-08-25 05:20 - 00749922 _____ () C:\Windows\system32\perfh007.dat 2014-12-19 11:37 - 2012-08-25 05:20 - 00168104 _____ () C:\Windows\system32\perfc007.dat 2014-12-19 11:37 - 2009-07-14 06:13 - 01760122 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-19 11:31 - 2014-02-13 14:41 - 00000000 ____D () C:\Users\Markus\.VirtualBox 2014-12-19 11:31 - 2012-08-24 19:48 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys 2014-12-19 11:31 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-19 11:30 - 2012-08-24 19:59 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-19 11:30 - 2010-11-21 04:47 - 00486074 _____ () C:\Windows\PFRO.log 2014-12-18 10:22 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys 2014-12-18 10:22 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys 2014-12-18 10:22 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys 2014-12-18 10:19 - 2014-10-06 09:20 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-12-18 10:19 - 2012-08-24 22:35 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Skype 2014-12-18 10:19 - 2012-08-24 22:34 - 00000000 ____D () C:\ProgramData\Skype 2014-12-18 10:03 - 2014-10-17 14:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-18 09:45 - 2014-07-18 15:42 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab 2014-12-16 22:19 - 2014-09-19 10:57 - 00000000 ___RD () C:\Users\Markus\Dropbox 2014-12-16 22:19 - 2014-09-19 10:53 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Dropbox 2014-12-16 12:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-16 11:52 - 2012-08-24 19:26 - 00000000 ____D () C:\Users\mduus 2014-12-13 22:17 - 2012-11-18 17:31 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc 2014-12-10 16:31 - 2012-09-13 10:14 - 00000000 ____D () C:\Users\Markus\Tracing 2014-12-10 13:37 - 2013-11-28 10:54 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0 2014-12-10 12:07 - 2014-09-23 15:30 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-10 09:38 - 2014-05-07 06:53 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-10 09:09 - 2012-08-24 22:18 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-10 09:08 - 2013-08-14 12:06 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-10 09:05 - 2012-08-24 20:22 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-07 15:39 - 2014-10-17 14:47 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-04 14:42 - 2012-09-11 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ServiceTracerClient 2014-12-04 14:41 - 2014-02-18 17:06 - 00001509 _____ () C:\Users\Public\Desktop\STC Workflow Editor.lnk 2014-12-04 14:41 - 2012-08-25 17:41 - 00000000 ____D () C:\Program Files (x86)\ServiceTracerClient 2014-11-28 09:14 - 2013-04-25 18:15 - 3346800030 ____N () C:\Windows\MEMORY.DMP 2014-11-28 09:14 - 2013-04-25 18:15 - 00000000 ____D () C:\Windows\Minidump 2014-11-27 14:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-21 06:14 - 2014-10-17 14:47 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-21 06:14 - 2014-10-17 14:47 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-21 06:14 - 2014-10-17 14:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2014
Ran by stcadmin at 2014-12-19 18:08:31
Running from C:\Users\stcadmin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden
8500A909_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909a (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Aastra 800 TAPI (HKLM\...\Aastra 800 TAPI) (Version: 3.15.25 - Aastra Telecom Schweiz AG)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
ACT! by Sage Premium 2010 (HKLM-x32\...\InstallShield_{565BA335-F3D6-466F-9AF8-B4A69A7F1300}) (Version: 12.0.0.0 - Sage Software, Inc.)
ACT! by Sage Premium 2010 (x32 Version: 12.0.0.0 - Sage Software, Inc.) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BPD_DSWizards (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Chartist Version 4.10 (HKLM-x32\...\Chartist) (Version: - )
Chinese Simplified Fonts Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-2447-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Citrix Online Launcher (HKLM-x32\...\{77463C86-BB3A-426E-A6C2-06B4D28C250F}) (Version: 1.0.223 - Citrix)
Colasoft Capsa 7 Free (HKLM-x32\...\Colasoft Capsa 7 Free_is1) (Version: 7.8.1.4863 - Colasoft)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.0 - REINER SCT)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2425.52 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2219.57 - CyberLink Corp.)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 15.3.45.87 - Synaptics Incorporated)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
DisplayLink Core Software (HKLM\...\{89019C7F-1F8C-4F95-90AD-45E5B5D783A3}) (Version: 6.2.37054.0 - DisplayLink Corp.)
DJI driver version 1.0 (HKLM-x32\...\{9A2C30EE-6E35-4479-B0E6-B1B47A54E8CD}_is1) (Version: 1.0 - DJI)
DJI Phantom 2 Assistant version 1.08 (HKLM-x32\...\{CD2EF94A-5983-4C19-A72A-0B0DA4B32564}_is1) (Version: 1.08 - DJI)
DocMgr (x32 Version: 140.0.65.000 - Ihr Firmenname) Hidden
DocProc (x32 Version: 140.0.100.000 - Hewlett-Packard) Hidden
Fax (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Foxit Reader (HKLM-x32\...\{27E3028E-06C8-4C09-8C3E-07F7F508304E}) (Version: 5.3.1.606 - Foxit Corporation)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
FRITZ!Fernzugang (HKLM\...\{5001E5BC-C9BF-4598-AB89-E7318C76C5F4}) (Version: 1.2.6 - AVM Berlin)
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Gerätetreiber für Intel(R) Wireless Music (HKLM\...\{4169B8AC-D144-4E38-A9CA-637EA44129ED}) (Version: 1.5.5323.0 - Intel Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{7455D86F-5295-389C-AA29-18D2BDAF8DD8}) (Version: 65.169.102 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
GPL Ghostscript 8.70 (HKLM-x32\...\GPL Ghostscript 8.70) (Version: - )
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Officejet Pro 8500 A909 Series (HKLM\...\{F86D9734-D358-4C5B-BC2B-6D90557FF05B}) (Version: 14.0 - HP)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2897 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{3015F546-6C3E-4E6A-B564-BCDF88C0BA2A}) (Version: 2.1.1.0153 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Smart Connect Technology 2.0 x64 (HKLM\...\{54F8B6C7-9B25-4E85-A1E0-26CFB80DE787}) (Version: 2.0.1083.0 - Intel)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{4E4282C3-F66E-4852-837A-7675527178C2}) (Version: 3.1.26.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{54EB8041-1115-4406-AA4B-44D236E84B3B}) (Version: 15.01.1000.0927 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Kaspersky Small Office Security (HKLM-x32\...\InstallWIX_{1549B388-042B-4573-B0CE-A8FF0D7F8F2A}) (Version: 9.1.0.59 - Kaspersky Lab)
Lehre und Erkenntnis 1.0 (HKLM-x32\...\Lehre und Erkenntnis) (Version: 1.0 - Verlag Friedrich Bischoff GmbH)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Lync 2010 Attendee (HKLM-x32\...\{44228375-A198-489B-B90F-F88A1A78D5F5}) (Version: 4.0.7577.4391 - Microsoft Corporation)
Microsoft Office Live Meeting 2007 (HKLM-x32\...\{E30E7561-A466-4393-B8BF-FD93E733EF3C}) (Version: 8.0.6362.202 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
MPM (HKLM-x32\...\{8AEA6737-8AF3-47BB-95CE-AAB62BE68985}) (Version: 1.00.0000 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.11100.8.0 - Nero AG)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0604 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Oracle VM VirtualBox 4.3.8 (HKLM\...\{5D328A41-BFF8-4B78-B45E-5BEE1D133EF5}) (Version: 4.3.8 - Oracle Corporation)
Parallels runtime modules (x32 Version: 1.00.0000 - Parallels) Hidden
Parallels USB Driver (x32 Version: 6.00.18494 - Parallels) Hidden
PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.7501 - CyberLink Corp.)
ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.14.009 - Dell Inc.)
QuickShare (HKLM-x32\...\{F7D739D1-B597-4802-A4CB-E1FBF326C9B0}) (Version: 1.6.1.796 - Linkury Inc.) <==== ATTENTION
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6606 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.28094 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Scan (x32 Version: 140.0.167.000 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
ServiceTrace Idea Exchange 1.0 (HKLM\...\{765F1F65-0741-44FC-89D8-B464985D3959}_is1) (Version: - ServiceTrace e.K.)
ServiceTrace Service Check Package 3.0.3881.1 (HKLM-x32\...\{B3EE006A-94A9-457D-AB80-C1AC70102456}_is1) (Version: 1.0 - ServiceTrace GmbH)
ServiceTrace VoIP-Tracer Package 3.0.3881.1 (HKLM-x32\...\{9659E4E5-5B56-4AB1-9FC4-8EB15507DB91}_is1) (Version: 1.0 - ServiceTrace GmbH.)
ServiceTrace Web Automation Package 3.0.3881.1 (HKLM-x32\...\{9D1F1CBB-5EF2-4A5F-80D0-E9666DC5D913}_is1) (Version: 1.0 - ServiceTrace GmbH)
ServiceTracer Agent 4.0.2819.1 (HKLM\...\{EE86AED7-6E72-42E5-B64D-C05042141FDD}_is1) (Version: - ServiceTrace e.K.)
ServiceTracer Robot 4.6.3881.1 (HKLM-x32\...\ServiceTracer-Client_is1) (Version: 4.6.3881.1 - ServiceTrace e.K.)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
SnagIt 5 (HKLM-x32\...\SnagIt5) (Version: 5.0 - TechSmith Corporation)
SnapAPI (x32 Version: 3.0.306 - Acronis) Hidden
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.11.0018 - ST Microelectronics)
StarMoney (x32 Version: 3.0.5.8 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.2.34 - StarFinanz) Hidden
StarMoney 9.0 (HKLM-x32\...\{74E75332-22E4-47E7-8EF1-B152C49AFE76}) (Version: 9.0 - Star Finanz GmbH)
StarMoney Business 6.0 (HKLM-x32\...\{8B738273-2D3F-477A-8547-87190F4D96EE}) (Version: 6.0 - Star Finanz GmbH)
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version: - )
System Checkup 3.4 (HKLM-x32\...\{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1) (Version: 3.4.2.29 - iolo technologies, LLC)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
VLC media player 2.0.6 (HKLM-x32\...\VLC media player) (Version: 2.0.6 - VideoLAN)
VMware vSphere Client 4.1 (HKLM-x32\...\{A0B433B1-941D-46F5-AE59-286263534232}) (Version: 4.1.0.12319 - VMware, Inc.)
WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows-Treiberpaket - dji-innovations inc. (usbser) Ports (01/19/2011 5.1.2600.5512) (HKLM\...\2DC11E587B8BA912FF8FD5433B426EE46F8E22DD) (Version: 01/19/2011 5.1.2600.5512 - dji-innovations inc.)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )
WorkflowEditor 3.0.3881.1 (HKLM-x32\...\{E9CC12C6-3CB1-4E69-A713-CBFA780E02FD}_is1) (Version: - ServiceTrace GmbH)
XMind (HKLM-x32\...\XMind) (Version: 3.3.0 - XMind Ltd.)
XviD MPEG-4 Codec (HKLM-x32\...\XviD) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-07-16 14:05 - 00001391 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
212.47.195.162 www.google-analytics.com.
212.47.195.162 google-analytics.com.
212.47.195.162 connect.facebook.net.
146.0.75.221 www.google-analytics.com.
146.0.75.221 google-analytics.com.
146.0.75.221 connect.facebook.net.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-08-24 21:47 - 2005-06-07 11:26 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2012-08-24 19:55 - 2012-02-14 08:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\CLDShowX.ini:Update.CL
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1484493839-596051297-3328508428-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-1484493839-596051297-3328508428-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1484493839-596051297-3328508428-1008 - Limited - Enabled)
Markus (S-1-5-21-1484493839-596051297-3328508428-1015 - Limited - Enabled) => C:\Users\Markus
mduus (S-1-5-21-1484493839-596051297-3328508428-1000 - Administrator - Enabled) => C:\Users\mduus
stcadmin (S-1-5-21-1484493839-596051297-3328508428-1019 - Limited - Enabled) => C:\Users\stcadmin
UpdatusUser (S-1-5-21-1484493839-596051297-3328508428-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP Color LaserJet CM6040 MFP
Description: HP Color LaserJet CM6040 MFP
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP CM8050 MFP with Edgeline
Description: HP CM8050 MFP with Edgeline
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Power Control [2012/12/29 22:46:55]
Description: Power Control [2012/12/29 22:46:55]
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/19/2014 06:01:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:01:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (12/19/2014 04:23:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (12/19/2014 04:19:27 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (12/19/2014 04:19:27 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (12/19/2014 04:19:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (12/19/2014 04:19:02 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (12/19/2014 03:16:40 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (240000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst IPBusEnum erreicht.
Error: (12/19/2014 02:52:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (12/19/2014 01:38:30 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (12/19/2014 01:38:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (240000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst IPBusEnum erreicht.
Error: (12/19/2014 01:01:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (12/19/2014 06:01:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestD:\trojaner_scan\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:01:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestD:\trojaner_scan\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
Error: (12/19/2014 06:00:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
CodeIntegrity Errors:
===================================
Date: 2014-11-15 11:27:04.838
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.837
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.833
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.832
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.641
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.620
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.618
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.616
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.551
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-10-17 18:37:43.702
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3612QM CPU @ 2.10GHz
Percentage of memory in use: 26%
Total physical RAM: 16266.36 MB
Available physical RAM: 11927.41 MB
Total Pagefile: 32530.89 MB
Available Pagefile: 27699.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive b: (System_Reserve) (Fixed) (Total:18.25 GB) (Free:2.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive c: () (Fixed) (Total:458.65 GB) (Free:182.65 GB) NTFS
Drive d: (MSata256GB) (Fixed) (Total:238.47 GB) (Free:11.1 GB) NTFS
Drive e: (OCZ256GB) (Fixed) (Total:223.47 GB) (Free:40.75 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Funktioniert nicht, wird mit oben genannter Information blockiert Malewarebytes Log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 19.12.2014 08:26:15, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Starting, Protection, 19.12.2014 08:26:15, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Started, Protection, 19.12.2014 08:26:15, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 08:26:18, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 09:15:11, SYSTEM, SERVICETRACE01, Scheduler, Failed, Unable to access update server, Protection, 19.12.2014 09:20:30, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Starting, Protection, 19.12.2014 09:20:30, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Started, Protection, 19.12.2014 09:20:30, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 09:20:41, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Protection, 19.12.2014 09:41:30, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Starting, Protection, 19.12.2014 09:41:30, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Started, Protection, 19.12.2014 09:41:30, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 09:41:35, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 09:43:48, SYSTEM, SERVICETRACE01, Manual, Malware Database, 2014.12.18.4, 2014.12.19.2, Protection, 19.12.2014 09:43:48, SYSTEM, SERVICETRACE01, Protection, Refresh, Starting, Protection, 19.12.2014 09:43:48, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopping, Protection, 19.12.2014 09:43:48, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopped, Protection, 19.12.2014 09:43:53, SYSTEM, SERVICETRACE01, Protection, Refresh, Success, Protection, 19.12.2014 09:43:53, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 09:43:54, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Scan, 19.12.2014 09:52:01, SYSTEM, SERVICETRACE01, Manual, Start: % 1 "% 2", Dauer: % 1 min 8 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 0-Malwareerkennung, Protection, 19.12.2014 11:31:16, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Starting, Protection, 19.12.2014 11:31:16, SYSTEM, SERVICETRACE01, Protection, Malware Protection, Started, Protection, 19.12.2014 11:31:16, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 11:31:23, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 11:54:12, SYSTEM, SERVICETRACE01, Scheduler, Malware Database, 2014.12.19.2, 2014.12.19.3, Protection, 19.12.2014 11:54:12, SYSTEM, SERVICETRACE01, Protection, Refresh, Starting, Protection, 19.12.2014 11:54:12, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopping, Protection, 19.12.2014 11:54:12, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopped, Protection, 19.12.2014 11:54:17, SYSTEM, SERVICETRACE01, Protection, Refresh, Success, Protection, 19.12.2014 11:54:17, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 11:54:17, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 13:38:35, SYSTEM, SERVICETRACE01, Scheduler, Malware Database, 2014.12.19.3, 2014.12.19.4, Protection, 19.12.2014 13:38:36, SYSTEM, SERVICETRACE01, Protection, Refresh, Starting, Protection, 19.12.2014 13:38:36, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopping, Protection, 19.12.2014 13:38:36, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopped, Protection, 19.12.2014 13:38:43, SYSTEM, SERVICETRACE01, Protection, Refresh, Success, Protection, 19.12.2014 13:38:43, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 13:38:44, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 15:16:46, SYSTEM, SERVICETRACE01, Scheduler, Failed, Unable to access update server, Update, 19.12.2014 15:59:22, SYSTEM, SERVICETRACE01, Scheduler, Malware Database, 2014.12.19.4, 2014.12.19.5, Protection, 19.12.2014 15:59:22, SYSTEM, SERVICETRACE01, Protection, Refresh, Starting, Protection, 19.12.2014 15:59:22, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopping, Protection, 19.12.2014 15:59:22, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopped, Protection, 19.12.2014 15:59:28, SYSTEM, SERVICETRACE01, Protection, Refresh, Success, Protection, 19.12.2014 15:59:28, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 15:59:28, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, Update, 19.12.2014 18:14:41, SYSTEM, SERVICETRACE01, Scheduler, Malware Database, 2014.12.19.5, 2014.12.19.6, Protection, 19.12.2014 18:14:41, SYSTEM, SERVICETRACE01, Protection, Refresh, Starting, Protection, 19.12.2014 18:14:41, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopping, Protection, 19.12.2014 18:14:41, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Stopped, Protection, 19.12.2014 18:14:46, SYSTEM, SERVICETRACE01, Protection, Refresh, Success, Protection, 19.12.2014 18:14:46, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Starting, Protection, 19.12.2014 18:14:47, SYSTEM, SERVICETRACE01, Protection, Malicious Website Protection, Started, (end) |
|
19.12.2014, 19:10
| #2 |
| /// the machine /// TB-Ausbilder    | Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr Hi,
__________________unsere Tools brauchen immer Adminrechte!! Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
20.12.2014, 10:03
| #3 |
| | Logs von Combofix Hallo, das Entfernen von Quickshare hat nicht so 100%tig funktioniert, es soll angeblich eine Installationsdatei fehlen, das Programm hat dann aber doch die Reste entfernt.
__________________ComboFix hat sehr lange gebraucht, für den Scan. Ich mußte es in verschiedenen User Accounts runterladen und dann ausführen, der Download wurde blockiert im Admin Account, in einem anderen Administrator Account ging dann der Download aber die Ausführung nicht..., die funktionierte im ersten Account dann wieder, echt strange! Also hier nun das Log von Combofix: Code:
ATTFilter ComboFix 14-12-14.01 - mduus 20.12.2014 0:28.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.16266.11988 [GMT 1:00]
ausgeführt von:: c:\users\mduus\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
AV: Microsoft Security Essentials *Enabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Kaspersky Anti-Virus *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Microsoft Security Essentials *Enabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\497B7A7B22.sys
c:\programdata\50ADCC66CA.sys
c:\programdata\8717E926B5.sys
c:\programdata\9981085664.sys
c:\programdata\A03E8FF4B2.sys
c:\programdata\ADAB6810DE.sys
c:\programdata\D9A609DD66.sys
c:\programdata\FB91B6E4F6.sys
c:\programdata\Roaming
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-11-20 bis 2014-12-20 ))))))))))))))))))))))))))))))
.
.
2014-12-20 08:36 . 2014-12-20 08:36 -------- d-----w- c:\users\Markus\AppData\Local\temp
2014-12-20 08:36 . 2014-12-20 08:36 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-12-20 08:36 . 2014-12-20 08:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-12-20 08:36 . 2014-12-20 08:36 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-12-19 23:01 . 2014-12-19 23:01 -------- d-----w- c:\program files (x86)\Acronis
2014-12-19 22:58 . 2014-12-19 22:58 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-12-19 17:07 . 2014-12-19 17:08 -------- d-----w- C:\FRST
2014-12-19 08:16 . 2014-09-17 21:43 1188440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{319B2078-76C3-4B0C-BBB3-7B665E8F9C82}\gapaengine.dll
2014-12-19 08:16 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2930343C-F458-446A-9DFF-174DD20A222C}\mpengine.dll
2014-12-18 12:18 . 2014-12-18 12:18 -------- d-----w- c:\users\Markus\AppData\Local\WebEx
2014-12-18 12:16 . 2014-12-18 12:18 -------- d-----w- c:\programdata\WebEx
2014-12-18 08:46 . 2013-05-06 08:13 110176 ----a-w- c:\windows\system32\klfphc.dll
2014-12-18 08:45 . 2014-12-18 08:45 -------- d-----w- c:\windows\ELAMBKUP
2014-12-18 08:45 . 2014-12-18 09:22 625248 ----a-w- c:\windows\system32\drivers\klif.sys
2014-12-18 08:45 . 2014-12-18 09:22 115296 ----a-w- c:\windows\system32\drivers\klflt.sys
2014-12-18 08:44 . 2014-12-18 08:44 -------- d-----w- c:\users\mduus\AppData\Roaming\Foxit Software
2014-12-18 06:10 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-18 06:10 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-17 16:50 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-12-17 07:48 . 2014-12-17 07:49 -------- d-----w- c:\users\stcadmin
2014-12-16 14:29 . 2014-12-16 14:29 -------- d-----w- c:\users\Markus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-12-10 08:38 . 2014-12-10 08:38 -------- d-----w- c:\windows\system32\appraiser
2014-12-10 08:04 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2014-12-10 08:04 . 2014-07-07 02:06 206848 ----a-w- c:\windows\system32\mfps.dll
2014-12-10 08:04 . 2014-07-07 02:06 55808 ----a-w- c:\windows\system32\rrinstaller.exe
2014-12-10 08:04 . 2014-07-07 02:06 24576 ----a-w- c:\windows\system32\mfpmp.exe
2014-12-10 08:04 . 2014-07-07 02:02 2048 ----a-w- c:\windows\system32\mferror.dll
2014-12-10 08:04 . 2014-07-07 01:40 103424 ----a-w- c:\windows\SysWow64\mfps.dll
2014-12-10 08:04 . 2014-07-07 01:39 50176 ----a-w- c:\windows\SysWow64\rrinstaller.exe
2014-12-10 08:04 . 2014-07-07 01:39 23040 ----a-w- c:\windows\SysWow64\mfpmp.exe
2014-12-10 08:04 . 2014-07-07 01:37 2048 ----a-w- c:\windows\SysWow64\mferror.dll
2014-12-10 08:04 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll
2014-12-10 06:18 . 2014-12-04 02:50 741376 ----a-w- c:\windows\system32\invagent.dll
2014-12-10 06:18 . 2014-12-04 02:50 192000 ----a-w- c:\windows\system32\aepic.dll
2014-12-10 06:18 . 2014-12-04 02:44 1083392 ----a-w- c:\windows\system32\aeinv.dll
2014-12-10 06:18 . 2014-12-01 23:28 1232040 ----a-w- c:\windows\system32\aitstatic.exe
2014-12-10 06:18 . 2014-12-04 02:50 413184 ----a-w- c:\windows\system32\generaltel.dll
2014-12-10 06:18 . 2014-12-04 02:50 396800 ----a-w- c:\windows\system32\devinv.dll
2014-12-10 06:18 . 2014-12-04 02:50 227328 ----a-w- c:\windows\system32\aepdu.dll
2014-12-10 06:18 . 2014-11-11 03:09 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-12-10 06:18 . 2014-11-11 02:44 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-12-10 06:18 . 2014-11-11 01:46 119296 ----a-w- c:\windows\system32\drivers\tdx.sys
2014-12-04 13:45 . 2014-12-04 13:45 -------- d-----w- c:\users\mduus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-11-25 12:59 . 2014-11-25 12:59 18638520 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-19 22:55 . 2012-08-25 11:48 952 --sha-w- c:\programdata\KGyGaAvL.sys
2014-12-19 22:55 . 2014-10-17 13:47 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-19 10:31 . 2012-08-24 18:48 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
2014-12-18 09:22 . 2013-10-17 14:47 29280 ----a-w- c:\windows\system32\drivers\klkbdflt.sys
2014-12-18 09:22 . 2013-06-06 16:38 178272 ----a-w- c:\windows\system32\drivers\kneps.sys
2014-12-18 09:22 . 2013-10-17 14:47 458336 ----a-w- c:\windows\system32\drivers\kl1.sys
2014-12-10 08:05 . 2012-08-24 19:22 112710672 ----a-w- c:\windows\system32\MRT.exe
2014-11-21 05:14 . 2014-10-17 13:47 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-10-17 13:47 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-10-17 13:47 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-18 09:38 . 2012-08-29 08:03 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-18 09:38 . 2012-08-29 08:03 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-11 03:08 . 2014-11-19 08:10 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 08:10 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-11-19 08:10 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 08:10 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-10-30 11:25 . 2010-11-21 03:27 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-10-25 01:57 . 2014-11-13 18:37 77824 ----a-w- c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-13 18:37 67584 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-24 21:14 . 2014-10-24 21:14 1464096 ----a-w- c:\windows\system32\drivers\tdrpman.sys
2014-10-24 21:14 . 2014-10-24 21:14 198432 ----a-w- c:\windows\system32\drivers\tib_mounter.sys
2014-10-24 21:14 . 2014-10-24 21:14 1120032 ----a-w- c:\windows\system32\drivers\tib.sys
2014-10-24 21:14 . 2014-10-24 21:14 161568 ----a-w- c:\windows\system32\drivers\vididr.sys
2014-10-24 21:14 . 2014-10-24 21:14 117024 ----a-w- c:\windows\system32\drivers\vidsflt.sys
2014-10-24 21:14 . 2014-10-24 21:14 116000 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2014-10-24 21:14 . 2013-06-20 14:42 269600 ----a-w- c:\windows\system32\drivers\snapman.sys
2014-10-18 02:05 . 2014-11-13 18:38 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-10-18 01:33 . 2014-11-13 18:38 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-10-14 02:16 . 2014-11-13 18:38 155064 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 02:13 . 2014-11-13 18:38 683520 ----a-w- c:\windows\system32\termsrv.dll
2014-10-14 02:13 . 2014-11-13 18:37 3241984 ----a-w- c:\windows\system32\msi.dll
2014-10-14 02:12 . 2014-11-13 18:38 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-10-14 02:09 . 2014-11-13 18:38 146432 ----a-w- c:\windows\system32\msaudite.dll
2014-10-14 02:07 . 2014-11-13 18:38 681984 ----a-w- c:\windows\system32\adtschema.dll
2014-10-14 01:50 . 2014-11-13 18:38 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-10-14 01:50 . 2014-11-13 18:37 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-14 01:49 . 2014-11-13 18:38 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-10-14 01:47 . 2014-11-13 18:38 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2014-10-14 01:46 . 2014-11-13 18:38 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
2014-10-10 00:57 . 2014-11-13 18:37 3198976 ----a-w- c:\windows\system32\win32k.sys
2014-10-03 02:12 . 2014-11-13 18:37 500224 ----a-w- c:\windows\system32\AUDIOKSE.dll
2014-10-03 02:11 . 2014-11-13 18:37 284672 ----a-w- c:\windows\system32\EncDump.dll
2014-10-03 02:11 . 2014-11-13 18:37 680960 ----a-w- c:\windows\system32\audiosrv.dll
2014-10-03 02:11 . 2014-11-13 18:37 440832 ----a-w- c:\windows\system32\AudioEng.dll
2014-10-03 02:11 . 2014-11-13 18:37 296448 ----a-w- c:\windows\system32\AudioSes.dll
2014-10-03 01:44 . 2014-11-13 18:37 442880 ----a-w- c:\windows\SysWow64\AUDIOKSE.dll
2014-10-03 01:44 . 2014-11-13 18:37 374784 ----a-w- c:\windows\SysWow64\AudioEng.dll
2014-10-03 01:44 . 2014-11-13 18:37 195584 ----a-w- c:\windows\SysWow64\AudioSes.dll
2014-09-25 02:08 . 2014-10-01 06:27 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-09-25 01:40 . 2014-10-01 06:27 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2014-12-18 09:06 162600 ----a-w- c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\shellex.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30879328]
"DellSystemDetect"="c:\users\Markus\AppData\Local\Apps\2.0\EKQO9AYK.E5D\LZVYA245.DQ8\dell..tion_e30b47f5d4a30e9e_0005.000c_1df9a4898fae00de\DellSystemDetect.exe" [2014-11-12 264488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-27 291608]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"Act.Outlook.Service"="c:\program files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe" [2010-01-06 17920]
"Act! Preloader"="c:\program files (x86)\ACT\Act for Windows\ActSage.exe" [2010-01-04 331776]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2011-03-01 144616]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-10-19 505872]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe" [2012-10-19 374560]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-11-12 75048]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
"SMB60StarMoneyRunEntry"="c:\program files (x86)\StarMoney Business 6.0\app\oflagent.exe" [2014-12-18 51856]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
"AcronisTibMounterMonitor"="c:\program files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe" [2013-10-10 1104616]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2014-02-04 7843744]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableInstallerDetection"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"DelayedDesktopSwitchTimeout"= 5 (0x5)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll c:\progra~2\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~2\KASPER~1\KASPER~1\sbhook.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R1 awtocttz;awtocttz;c:\windows\system32\drivers\awtocttz.sys;c:\windows\SYSNATIVE\drivers\awtocttz.sys [x]
R1 cmelsjaq;cmelsjaq;c:\windows\system32\drivers\cmelsjaq.sys;c:\windows\SYSNATIVE\drivers\cmelsjaq.sys [x]
R1 CSN5PDTS82;CSN5PDTS82 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82.sys;c:\windows\SYSNATIVE\Drivers\CSN5PDTS82.sys [x]
R1 CsNdisLWF;CsNdisLWF NDIS Protocol Driver;c:\windows\system32\Drivers\CsNdisLWF.sys;c:\windows\SYSNATIVE\Drivers\CsNdisLWF.sys [x]
R1 dcstxbht;dcstxbht;c:\windows\system32\drivers\dcstxbht.sys;c:\windows\SYSNATIVE\drivers\dcstxbht.sys [x]
R1 ipwuabum;ipwuabum;c:\windows\system32\drivers\ipwuabum.sys;c:\windows\SYSNATIVE\drivers\ipwuabum.sys [x]
R1 putybsdl;putybsdl;c:\windows\system32\drivers\putybsdl.sys;c:\windows\SYSNATIVE\drivers\putybsdl.sys [x]
R1 qawzvpin;qawzvpin;c:\windows\system32\drivers\qawzvpin.sys;c:\windows\SYSNATIVE\drivers\qawzvpin.sys [x]
R1 sedgtwrs;sedgtwrs;c:\windows\system32\drivers\sedgtwrs.sys;c:\windows\SYSNATIVE\drivers\sedgtwrs.sys [x]
R2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2013/08/11 14:54];c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl;c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl [x]
R2 ACT! Scheduler;ACT! Scheduler;c:\program files (x86)\ACT\Act for Windows\Act.Scheduler.exe;c:\program files (x86)\ACT\Act for Windows\Act.Scheduler.exe [x]
R2 CLKMSVC10_1628BCEA;CyberLink Product - 2013/08/11 14:54;c:\program files (x86)\CyberLink\PowerDVD DX\Kernel\BD\NavFilter\kmsvc.exe;c:\program files (x86)\CyberLink\PowerDVD DX\Kernel\BD\NavFilter\kmsvc.exe [x]
R2 CLKMSVC10_38F51D56;CyberLink Product - 2013/09/09 16:18;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 CSObjectsSrv;Verwaltungsservice vom CryproStorage-System;c:\program files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe;c:\program files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protokoll;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 DisplayLinkUsbPort;DisplayLink USB Device;c:\windows\system32\DRIVERS\DisplayLinkUsbPort_6.2.37054.0.sys;c:\windows\SYSNATIVE\DRIVERS\DisplayLinkUsbPort_6.2.37054.0.sys [x]
R3 dlcdcecm;dlcdcecm;c:\windows\system32\DRIVERS\dlcdcecm.sys;c:\windows\SYSNATIVE\DRIVERS\dlcdcecm.sys [x]
R3 dlusbaudio;dlusbaudio;c:\windows\system32\DRIVERS\dlusbaudio_x64.sys;c:\windows\SYSNATIVE\DRIVERS\dlusbaudio_x64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys;c:\windows\SYSNATIVE\DRIVERS\silabenm.sys [x]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys;c:\windows\SYSNATIVE\DRIVERS\silabser.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
R4 syncagentsrv;Acronis Sync Agent Service;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [x]
S0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys;c:\windows\SYSNATIVE\drivers\dlkmdldr.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys;c:\windows\SYSNATIVE\DRIVERS\klbg.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x]
S0 tib;Acronis TIB Manager;c:\windows\system32\DRIVERS\tib.sys;c:\windows\SYSNATIVE\DRIVERS\tib.sys [x]
S0 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x]
S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys;c:\windows\SYSNATIVE\DRIVERS\vididr.sys [x]
S0 vidsflt;Acronis Disk Storage Filter;c:\windows\system32\DRIVERS\vidsflt.sys;c:\windows\SYSNATIVE\DRIVERS\vidsflt.sys [x]
S1 Capsax64Drv0;Capsax64Drv0 NDIS Protocol Driver;c:\windows\system32\Drivers\Capsax64Drv0.sys;c:\windows\SYSNATIVE\Drivers\Capsax64Drv0.sys [x]
S1 CSN5PDTS82x64;CSN5PDTS82x64 NDIS Protocol Driver;c:\windows\system32\Drivers\CSN5PDTS82x64.sys;c:\windows\SYSNATIVE\Drivers\CSN5PDTS82x64.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S1 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 {73526619-C24F-470B-9BED-53D455FBB5C6};Power Control [2013/08/11 15:21];c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\program files\FRITZ!Fernzugang\avmike.exe;c:\program files\FRITZ!Fernzugang\avmike.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\program files\FRITZ!Fernzugang\certsrv.exe;c:\program files\FRITZ!Fernzugang\certsrv.exe [x]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]
S2 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [x]
S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 ISCTAgent;ISCT Always Updated Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MSSQL$ACT7;SQL Server (ACT7);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys;c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [x]
S2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\program files\FRITZ!Fernzugang\nwtsrv.exe;c:\program files\FRITZ!Fernzugang\nwtsrv.exe [x]
S2 Realtek11nSU;Realtek11nSU;c:\program files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe;c:\program files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 ServiceTracer Agent;ServiceTracer Agent;c:\program files\ServiceTracer\Agent\ServiceTracerAgent.exe;c:\program files\ServiceTracer\Agent\ServiceTracerAgent.exe [x]
S2 StarMoney 9.0 OnlineUpdate;StarMoney 9.0 OnlineUpdate;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 StarMoney Business 6.0 OnlineUpdate;StarMoney Business 6.0 OnlineUpdate;c:\program files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys;c:\windows\SYSNATIVE\drivers\dlkmd.sys [x]
S3 hswpan;WPAN Driver;c:\windows\system32\DRIVERS\hswpan.sys;c:\windows\SYSNATIVE\DRIVERS\hswpan.sys [x]
S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 NWIM;AVM VPN Miniport;c:\windows\system32\DRIVERS\avmnwim.sys;c:\windows\SYSNATIVE\DRIVERS\avmnwim.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SmbDrvIntel;SmbDrvIntel;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 ST_ACCEL;STMicroelectronics Accelerometer Service;c:\windows\system32\DRIVERS\ST_ACCEL.sys;c:\windows\SYSNATIVE\DRIVERS\ST_ACCEL.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-10 11:07 1087816 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-12-20 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job
- c:\users\Markus\AppData\Local\Citrix\GoToMeeting\2033\g2mupdate.exe [2014-11-27 15:12]
.
2014-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-27 11:47]
.
2014-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-27 11:47]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2014-12-18 09:08 195368 ----a-w- c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\shellex.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-03-29 6469736]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-09 1158248]
"BLEServicesCtrl"="c:\program files (x86)\Intel\Bluetooth\BleServicesCtrl.exe" [2012-03-15 178960]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2012-03-27 11407120]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-11-30 171064]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-11-30 399416]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-11-30 441912]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2013-07-18 519408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll c:\progra~2\KASPER~1\KASPER~1\x64\kloehk.dll c:\progra~2\KASPER~1\KASPER~1\x64\sbhook64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000
Trusted Zone: dell.com
Trusted Zone: elsteronline.de\www
Trusted Zone: servicetrace01
TCP: DhcpNameServer = 192.168.99.1
TCP: Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}\143686476427167656A75696368656E6: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}\444314536323: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}\444364536323: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}\73A57756277656: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: NameServer = 8.8.8.8,8.8.8.8
TCP: Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: NameServer = 8.8.8.8,8.8.8.8
FF - ProfilePath - c:\users\mduus\AppData\Roaming\Mozilla\Firefox\Profiles\el66lcwh.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} - (no file)
ShellIconOverlayIdentifiers-{00F848DC-B1D4-4892-9C25-CAADC86A215D} - (no file)
ShellIconOverlayIdentifiers-{71573297-552E-46fc-BE3D-3DFAF88D47B7} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1 - c:\program files (x86)\iolo\System Checkup\uninstscu.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{73526619-C24F-470B-9BED-53D455FBB5C6}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-12-20 09:39:51
ComboFix-quarantined-files.txt 2014-12-20 08:39
.
Vor Suchlauf: 17 Verzeichnis(se), 209.770.422.272 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 213.385.252.864 Bytes frei
.
- - End Of File - - 1E623868D6210141F7CFC8D94E4F40AC
Übrigens DANKE für die schnelle Reaktion! Beste Grüße Markus |
|
21.12.2014, 08:09
| #4 |
| /// the machine /// TB-Ausbilder | Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.12.2014, 14:17
| #5 |
| | 3ter scan Hallo, hier die Logfiles der Scans: 1. Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 21.12.2014 Suchlauf-Zeit: 13:25:09 Logdatei: mbamLog.txt Administrator: Nein Version: 2.00.4.1028 Malware Datenbank: v2014.12.21.02 Rootkit Datenbank: v2014.12.14.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Aktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: stcadmin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 335458 Verstrichene Zeit: 5 Min, 41 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 21/12/2014 um 13:48:32
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-21.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : mduus - SERVICETRACE01
# Gestartet von : C:\Users\mduus\Desktop\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
[#] Ordner Gelöscht : C:\Program Files (x86)\common files\system
Ordner Gelöscht : C:\Program Files\common files\system
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Mozilla Firefox v33.1 (x86 de)
-\\ Google Chrome v39.0.2171.95
[C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=362&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2360919363154306&q={searchTerms}
*************************
AdwCleaner[R0].txt - [5326 octets] - [17/10/2014 14:14:05]
AdwCleaner[R1].txt - [969 octets] - [20/10/2014 17:07:40]
AdwCleaner[R2].txt - [3871 octets] - [23/10/2014 20:07:16]
AdwCleaner[R3].txt - [2652 octets] - [23/10/2014 20:15:20]
AdwCleaner[R4].txt - [2817 octets] - [23/10/2014 20:54:40]
AdwCleaner[R5].txt - [1420 octets] - [15/11/2014 11:12:44]
AdwCleaner[R6].txt - [1481 octets] - [15/11/2014 22:57:21]
AdwCleaner[R7].txt - [2161 octets] - [21/12/2014 13:44:41]
AdwCleaner[S0].txt - [5011 octets] - [17/10/2014 14:21:11]
AdwCleaner[S1].txt - [1021 octets] - [20/10/2014 17:11:31]
AdwCleaner[S2].txt - [3925 octets] - [23/10/2014 20:10:48]
AdwCleaner[S3].txt - [2707 octets] - [23/10/2014 20:17:29]
AdwCleaner[S4].txt - [2871 octets] - [23/10/2014 22:00:16]
AdwCleaner[S5].txt - [2078 octets] - [21/12/2014 13:48:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [2138 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Professional x64
Ran by mduus on 21.12.2014 at 13:53:13,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\mduus\AppData\Roaming\pcdr"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.12.2014 at 13:59:09,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by mduus (administrator) on SERVICETRACE01 on 21-12-2014 14:01:12
Running from C:\Users\mduus\Desktop
Loaded Profiles: mduus & UpdatusUser (Available profiles: mduus & UpdatusUser & Markus & stcadmin & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brsvc01a.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brss01a.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Realtek) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe
(ServiceTrace e.K.) C:\Program Files\ServiceTracer\Agent\ServiceTracerAgent.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sage Software, Inc.) C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\offlagent10\offlagent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6469736 2012-03-29] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2870032 2012-03-07] (Synaptics Incorporated)
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [Act.Outlook.Service] => C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe [17920 2010-01-06] (Sage Software, Inc.)
HKLM-x32\...\Run: [Act! Preloader] => C:\Program Files (x86)\ACT\Act for Windows\ActSage.exe [331776 2010-01-04] (Sage Software, Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [144616 2011-03-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PowerDVD12DMREngine] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-10-19] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe [374560 2012-10-19] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-11-12] (cyberlink)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [SMB60StarMoneyRunEntry] => C:\Program Files (x86)\StarMoney Business 6.0\app\oflagent.exe [51856 2014-12-18] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll [X]
HKLM\...\Policies\Explorer: [NoCDBurning] 1
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Run: [DellSystemDetect] => C:\Users\Markus\AppData\Local\Apps\2.0\EKQO9AYK.E5D\LZVYA245.DQ8\dell..tion_e30b47f5d4a30e9e_0005.000c_1df9a4898fae00de\DellSystemDetect.exe [264488 2014-11-12] (Dell)
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Run: [Installation Diagnostics] => "C:\Program Files (x86)\Brother\Brmfl04b\Brinstck.exe" /I MFC-5440CN LAN
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\MountPoints2: {a208c8d6-ee18-11e1-8f08-806e6f6e6963} - D:\autoRcd.exe
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [168616 2013-11-21] (NVIDIA Corporation)
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\kloehk.dll [15448 2010-12-09] (Kaspersky Lab)
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\sbhook64.dll [69720 2010-12-09] (Kaspersky Lab)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-11-21] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\mzvkbd3.dll [109144 2010-12-09] (Kaspersky Lab)
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\sbhook.dll [72280 2010-12-09] (Kaspersky Lab)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startvm.bat ()
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => No File
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => No File
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => No File
ShellIconOverlayIdentifiers: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\shellex.dll (Kaspersky Lab ZAO)
ShellIconOverlayIdentifiers-x32: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\shellex.dll (Kaspersky Lab ZAO)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1484493839-596051297-3328508428-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\ievkbd.dll (Kaspersky Lab)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\ievkbd.dll (Kaspersky Lab)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile -> {D5233FCD-D258-4903-89B8-FB1568E7413D} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.99.1
Tcpip\..\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: [NameServer] 8.8.8.8,8.8.8.8
FireFox:
========
FF ProfilePath: C:\Users\mduus\AppData\Roaming\Mozilla\Firefox\Profiles\el66lcwh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2014-09-26]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Thunderbird\Extensions: [{eea12ec4-729d-4703-bc37-106ce9879ce2}] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt
FF Extension: Kaspersky Anti-Spam Extension - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt [2014-07-18]
FF HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-08-24]
FF HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 ACT! Scheduler; C:\Program Files (x86)\ACT\Act for Windows\Act.Scheduler.exe [81920 2010-01-04] (Sage Software, Inc.) [File not signed]
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-13] (brother Industries Ltd) [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-10-19] (CyberLink Corp.)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2010-11-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-10-19] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-10-19] (CyberLink)
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [8498608 2012-03-15] (DisplayLink Corp.)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-01] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R2 MSSQL$ACT7; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [199272 2011-05-18] (Realtek Semiconductor)
R2 ServiceTracer Agent; C:\Program Files\ServiceTracer\Agent\ServiceTracerAgent.exe [877568 2014-01-13] (ServiceTrace e.K.) [File not signed]
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 StarMoney Business 6.0 OnlineUpdate; C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] () [File not signed]
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)
S2 CLKMSVC10_1628BCEA; "C:\Program Files (x86)\CyberLink\PowerDVD DX\Kernel\BD\NavFilter\kmsvc.exe" /svc [X]
S2 CSObjectsSrv; "C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 Capsax64Drv0; C:\Windows\System32\Drivers\Capsax64Drv0.sys [35976 2014-08-15] (Colasoft Co., Ltd.)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
U5 CSCrySec; C:\Windows\System32\Drivers\CSCrySec.sys [85048 2009-12-14] (Infowatch)
R1 CSN5PDTS82x64; C:\Windows\System32\Drivers\CSN5PDTS82x64.sys [34840 2012-10-24] (Colasoft Co., Ltd.)
S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_6.2.37054.0.sys [17408 2012-03-15] (hxxp://libusb-win32.sourceforge.net)
S3 dlcdcecm; C:\Windows\System32\DRIVERS\dlcdcecm.sys [38400 2012-03-15] (DisplayLink Corp.)
S3 dlusbaudio; C:\Windows\System32\DRIVERS\dlusbaudio_x64.sys [192120 2012-03-15] (DisplayLink Corp.)
R3 hswpan; C:\Windows\System32\DRIVERS\hswpan.sys [109056 2012-01-27] (Ozmo Inc)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
S3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-12-18] (Kaspersky Lab ZAO)
R0 KLBG; C:\Windows\System32\DRIVERS\klbg.sys [40464 2009-10-14] (Kaspersky Lab)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-12-18] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-12-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-12-18] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-12-18] (Kaspersky Lab ZAO)
R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-11-21] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 SmbDrvIntel; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [24848 2012-03-07] (Synaptics Incorporated)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-10-24] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-10-24] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-10-24] (Acronis International GmbH)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-12-21] ()
R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-10-19] (CyberLink Corp.)
S1 awtocttz; \??\C:\Windows\system32\drivers\awtocttz.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S1 cmelsjaq; \??\C:\Windows\system32\drivers\cmelsjaq.sys [X]
S1 CSN5PDTS82; System32\Drivers\CSN5PDTS82.sys [X]
S1 CsNdisLWF; System32\Drivers\CsNdisLWF.sys [X]
S1 dcstxbht; \??\C:\Windows\system32\drivers\dcstxbht.sys [X]
S1 ipwuabum; \??\C:\Windows\system32\drivers\ipwuabum.sys [X]
S1 putybsdl; \??\C:\Windows\system32\drivers\putybsdl.sys [X]
S1 qawzvpin; \??\C:\Windows\system32\drivers\qawzvpin.sys [X]
S1 sedgtwrs; \??\C:\Windows\system32\drivers\sedgtwrs.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-21 14:01 - 2014-12-21 14:01 - 00036968 _____ () C:\Users\mduus\Desktop\FRST.txt
2014-12-21 14:01 - 2014-12-21 14:01 - 00000000 ____D () C:\Users\mduus\Desktop\FRST-OlderVersion
2014-12-21 14:00 - 2014-12-21 14:01 - 02122240 _____ (Farbar) C:\Users\mduus\Desktop\FRST64.exe
2014-12-21 13:59 - 2014-12-21 13:59 - 00000860 _____ () C:\Users\mduus\Desktop\JRT.txt
2014-12-21 13:53 - 2014-12-21 13:53 - 00000000 ____D () C:\Windows\ERUNT
2014-12-21 13:52 - 2014-12-21 13:30 - 01707646 _____ (Thisisu) C:\Users\mduus\Desktop\JRT.exe
2014-12-21 13:49 - 2014-12-21 13:49 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-12-21 13:41 - 2014-12-21 13:26 - 02166272 _____ () C:\Users\mduus\Desktop\AdwCleaner_4.105.exe
2014-12-21 13:30 - 2014-12-21 13:30 - 01707646 _____ (Thisisu) C:\Users\stcadmin\Desktop\JRT.exe
2014-12-21 13:26 - 2014-12-21 13:26 - 02166272 _____ () C:\Users\stcadmin\Desktop\AdwCleaner_4.105.exe
2014-12-21 13:22 - 2014-12-21 13:21 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\stcadmin\Desktop\mbam-setup-2.0.4.1028.exe
2014-12-20 10:05 - 2014-12-20 10:05 - 00000008 __RSH () C:\ProgramData\D9A609DD66.sys
2014-12-20 09:39 - 2014-12-20 09:39 - 00047166 _____ () C:\ComboFix.txt
2014-12-20 00:24 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-20 00:24 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-20 00:24 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-20 00:16 - 2014-12-20 09:39 - 00000000 ____D () C:\Qoobox
2014-12-20 00:16 - 2014-12-20 09:38 - 00000000 ____D () C:\Windows\erdnt
2014-12-20 00:16 - 2014-12-20 00:12 - 05601641 ____R (Swearware) C:\Users\mduus\Desktop\ComboFix.exe
2014-12-20 00:12 - 2014-12-20 00:12 - 05601641 _____ (Swearware) C:\Users\stcadmin\Desktop\ComboFix.exe
2014-12-20 00:01 - 2014-12-20 00:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2014-12-20 00:01 - 2014-12-20 00:01 - 00000000 ____D () C:\Program Files (x86)\Acronis
2014-12-19 23:58 - 2014-12-19 23:58 - 00001264 _____ () C:\Users\mduus\Desktop\Revo Uninstaller.lnk
2014-12-19 23:58 - 2014-12-19 23:58 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-12-19 23:57 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\mduus\Desktop\revosetup95.exe
2014-12-19 23:53 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\stcadmin\Desktop\revosetup95.exe
2014-12-19 23:47 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Markus\Desktop\revosetup95.exe
2014-12-19 18:33 - 2014-12-19 18:33 - 00380416 _____ () C:\Users\stcadmin\Desktop\Gmer-19357.exe
2014-12-19 18:08 - 2014-12-19 18:09 - 00054482 _____ () C:\Users\stcadmin\Desktop\FRST.txt
2014-12-19 18:08 - 2014-12-19 18:08 - 00050359 _____ () C:\Users\stcadmin\Desktop\Addition.txt
2014-12-19 18:07 - 2014-12-21 14:01 - 00000000 ____D () C:\FRST
2014-12-19 18:07 - 2014-12-19 18:07 - 02121216 _____ (Farbar) C:\Users\stcadmin\Desktop\FRST64.exe
2014-12-19 18:04 - 2014-12-19 18:05 - 00050477 _____ () C:\Users\stcadmin\Desktop\Defogger.exe
2014-12-19 17:56 - 2014-12-16 10:11 - 02347384 _____ (ESET) C:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieUserList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieSiteList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieBrowserModeList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Macromedia
2014-12-18 13:18 - 2014-12-18 13:18 - 00000000 ____D () C:\Users\Markus\AppData\Local\WebEx
2014-12-18 13:17 - 2014-12-18 13:18 - 00631744 _____ (Cisco WebEx LLC) C:\Users\Markus\Downloads\Cisco_WebEx_Add-On.exe
2014-12-18 13:16 - 2014-12-18 13:18 - 00000000 ____D () C:\ProgramData\WebEx
2014-12-18 09:46 - 2014-12-18 09:46 - 00001089 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-12-18 09:46 - 2014-12-18 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-12-18 09:46 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-12-18 09:45 - 2014-12-18 10:22 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-12-18 09:45 - 2014-12-18 10:22 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-12-18 09:45 - 2014-12-18 09:45 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-12-18 09:44 - 2014-12-18 09:44 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Foxit Software
2014-12-18 07:10 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 07:10 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 08:49 - 2014-12-21 13:11 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CrashDumps
2014-12-17 08:49 - 2014-12-17 08:49 - 00111672 _____ () C:\Users\stcadmin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-17 08:49 - 2014-12-17 08:49 - 00001421 _____ () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\IsolatedStorage
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel Corporation
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\CyberLink
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Adobe
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\ACT
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\MediaServer
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\IsolatedStorage
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Google
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CyberLink
2014-12-17 08:48 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin
2014-12-17 08:48 - 2014-12-17 08:48 - 00000020 ___SH () C:\Users\stcadmin\ntuser.ini
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Vorlagen
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Startmenü
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Netzwerkumgebung
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Lokale Einstellungen
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Eigene Dateien
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Druckumgebung
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Musik
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Bilder
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Verlauf
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Anwendungsdaten
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Anwendungsdaten
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\VirtualStore
2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Apple Computer
2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Apple Computer
2014-12-17 08:48 - 2012-08-24 23:24 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Microsoft Help
2014-12-17 08:48 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-17 08:48 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-16 15:29 - 2014-12-16 15:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-12-16 15:11 - 2014-12-16 15:11 - 00071848 _____ () C:\Users\Markus\Desktop\123.xml
2014-12-16 10:11 - 2014-12-19 17:52 - 00000000 ____D () C:\Users\Markus\Desktop\trojaner_scan
2014-12-16 09:49 - 2014-12-16 09:48 - 16503606 _____ () C:\Users\mduus\Desktop\AcronisTrueImage.msi.txt
2014-12-15 21:55 - 2014-12-15 21:55 - 00111877 _____ () C:\Users\Markus\Downloads\33516_gr_rx16_3a99_f9.bin
2014-12-12 09:51 - 2014-12-12 09:55 - 00000000 ____D () C:\Users\Markus\Desktop\bilder
2014-12-12 00:05 - 2014-12-12 01:21 - 25027790 _____ () C:\Users\Markus\Desktop\weihnachtsfeier2014.pptx
2014-12-11 11:08 - 2014-12-11 12:54 - 00050515 _____ () C:\Users\Markus\Desktop\141204_CorporateAccount_List__.xlsx
2014-12-10 13:30 - 2014-12-10 13:30 - 00634563 _____ () C:\Users\Markus\Desktop\Portokasse Deutsche Post_do.mht
2014-12-10 09:38 - 2014-12-10 09:38 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-10 09:04 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 09:04 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 09:04 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-10 09:04 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-10 09:04 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-10 09:04 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-10 09:04 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-10 09:04 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-10 09:04 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-10 09:04 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-10 07:25 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 07:25 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 07:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 07:25 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 07:25 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 07:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 07:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 07:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 07:25 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 07:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 07:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 07:25 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 07:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 07:25 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 07:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 07:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 07:25 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 07:25 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 07:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 07:25 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 07:25 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 07:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 07:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 07:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 07:25 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 07:25 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 07:25 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 07:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 07:25 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 07:25 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 07:25 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 07:25 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 07:25 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 07:25 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 07:25 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 07:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 07:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 07:25 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 07:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 07:25 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 07:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 07:25 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 07:25 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 07:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 07:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 07:25 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 07:25 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 07:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 07:25 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 07:25 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 07:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 07:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 07:25 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 07:25 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 07:18 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 07:18 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 07:18 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 07:18 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 07:18 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 07:17 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 07:17 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 07:17 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 07:17 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 07:17 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 07:17 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 07:17 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 07:17 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-04 14:45 - 2014-12-04 14:45 - 00000000 ____D () C:\Users\mduus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-12-02 23:10 - 2014-12-02 23:10 - 00000000 ____D () C:\Users\Markus\Downloads\VPN
2014-12-01 14:58 - 2014-12-01 14:58 - 03271355 _____ () C:\Users\Markus\Desktop\PP WIN - Kopie.pptx
2014-11-28 09:14 - 2014-11-28 09:14 - 01383960 _____ () C:\Windows\Minidump\112814-31028-01.dmp
2014-11-23 22:58 - 2014-11-23 22:58 - 00002334 _____ () C:\Users\Markus\Desktop\Demo_Maschine.RDP
2014-11-21 20:52 - 2014-11-21 20:52 - 00044453 _____ () C:\Users\Markus\Desktop\Kopie von Top 500 Umsatzstärkste Unternehmen Deutschland.xlsx
2014-11-21 13:02 - 2014-11-21 14:24 - 51810623 _____ () C:\Users\Markus\Documents\2014-11-21 13.02 Neues Meeting.g2m
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-21 13:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 13:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 13:56 - 2012-08-25 05:20 - 00749922 _____ () C:\Windows\system32\perfh007.dat
2014-12-21 13:56 - 2012-08-25 05:20 - 00168104 _____ () C:\Windows\system32\perfc007.dat
2014-12-21 13:56 - 2009-07-14 06:13 - 01760122 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-21 13:53 - 2012-08-24 19:26 - 01425231 _____ () C:\Windows\WindowsUpdate.log
2014-12-21 13:51 - 2012-08-24 22:35 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Skype
2014-12-21 13:50 - 2014-10-17 14:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-21 13:50 - 2012-08-29 16:54 - 00000000 ____D () C:\Users\mduus\AppData\Local\CrashDumps
2014-12-21 13:50 - 2012-08-25 12:48 - 00000952 ___SH () C:\ProgramData\KGyGaAvL.sys
2014-12-21 13:49 - 2013-01-15 10:10 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-12-21 13:49 - 2012-08-27 14:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-21 13:49 - 2012-08-24 19:59 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-21 13:49 - 2012-08-24 19:48 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-12-21 13:49 - 2010-11-21 04:47 - 00488624 _____ () C:\Windows\PFRO.log
2014-12-21 13:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-21 13:49 - 2009-07-14 05:51 - 00515717 _____ () C:\Windows\setupact.log
2014-12-21 13:48 - 2014-10-17 14:14 - 00000000 ____D () C:\AdwCleaner
2014-12-21 13:40 - 2012-09-06 14:49 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2014-12-21 13:36 - 2012-09-21 12:56 - 00000000 ____D () C:\Users\Markus\Documents\Outlook-Dateien
2014-12-21 13:14 - 2014-02-12 16:46 - 00000568 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job
2014-12-21 13:07 - 2014-09-29 20:33 - 00000000 ____D () C:\Program Files (x86)\StarMoney Business 6.0
2014-12-21 13:06 - 2012-08-27 14:14 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-21 13:05 - 2014-02-13 14:41 - 00000000 ____D () C:\Users\Markus\.VirtualBox
2014-12-20 10:06 - 2012-09-12 09:06 - 00000000 ____D () C:\Users\Markus\AppData\Local\CrashDumps
2014-12-20 09:39 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-12-20 09:37 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-19 23:52 - 2012-08-25 10:14 - 00000000 ____D () C:\ServiceTrace
2014-12-18 16:49 - 2014-05-19 13:38 - 00000000 ____D () C:\Users\Markus\Desktop\__3 in Bearbeitung
2014-12-18 12:24 - 2014-09-29 07:42 - 00000000 ____D () C:\Users\Markus\Desktop\Aktuelle ST Praesentationen
2014-12-18 10:22 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-12-18 10:22 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-12-18 10:22 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-12-18 10:19 - 2014-10-06 09:20 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-18 10:19 - 2012-08-24 22:34 - 00000000 ____D () C:\ProgramData\Skype
2014-12-18 09:45 - 2014-07-18 15:42 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-12-17 14:13 - 2012-09-04 13:49 - 00000000 ____D () C:\Users\mduus\Documents\Outlook-Dateien
2014-12-16 22:19 - 2014-09-19 10:57 - 00001026 _____ () C:\Users\Markus\Desktop\Dropbox.lnk
2014-12-16 22:19 - 2014-09-19 10:57 - 00000000 ___RD () C:\Users\Markus\Dropbox
2014-12-16 22:19 - 2014-09-19 10:56 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-16 22:19 - 2014-09-19 10:53 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Dropbox
2014-12-16 15:18 - 2012-09-25 08:23 - 00002334 ____H () C:\Users\Markus\Documents\Default.rdp
2014-12-16 12:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-16 11:52 - 2012-08-24 19:26 - 00000000 ____D () C:\Users\mduus
2014-12-13 22:17 - 2012-11-18 17:31 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2014-12-11 23:56 - 2014-05-19 13:41 - 00000000 ____D () C:\Users\Markus\Desktop\__5 Fertig
2014-12-10 16:31 - 2012-09-13 10:14 - 00000000 ____D () C:\Users\Markus\Tracing
2014-12-10 13:37 - 2013-11-28 10:54 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-12-10 12:07 - 2014-09-23 15:30 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-10 09:38 - 2014-05-07 06:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-10 09:09 - 2012-08-24 22:18 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 09:08 - 2013-08-14 12:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-10 09:05 - 2012-08-24 20:22 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 07:58 - 2014-09-29 07:58 - 00000000 ____D () C:\Users\Markus\Desktop\Aktuelle ST Unterlagen
2014-12-07 15:39 - 2014-10-17 14:47 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-04 14:42 - 2012-09-11 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ServiceTracerClient
2014-12-04 14:41 - 2014-02-18 17:06 - 00001509 _____ () C:\Users\Public\Desktop\STC Workflow Editor.lnk
2014-12-04 14:41 - 2012-08-25 17:41 - 00000000 ____D () C:\Program Files (x86)\ServiceTracerClient
2014-12-04 09:42 - 2014-05-19 13:38 - 00000000 ____D () C:\Users\Markus\Desktop\__4 Im Testing
2014-12-03 08:19 - 2012-09-06 08:08 - 00000000 ____D () C:\Users\Markus\AppData\Local\Microsoft Help
2014-11-28 09:14 - 2013-04-25 18:15 - 3346800030 ____N () C:\Windows\MEMORY.DMP
2014-11-28 09:14 - 2013-04-25 18:15 - 00000000 ____D () C:\Windows\Minidump
2014-11-27 16:12 - 2014-02-12 16:46 - 00003608 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015
2014-11-27 14:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-25 17:49 - 2013-09-23 18:55 - 00000000 ____D () C:\Users\Markus\Desktop\Produkt_Projekte
2014-11-21 06:14 - 2014-10-17 14:47 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-21 06:14 - 2014-10-17 14:47 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-21 06:14 - 2014-10-17 14:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
Some content of TEMP:
====================
C:\Users\mduus\AppData\Local\Temp\Quarantine.exe
C:\Users\mduus\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-16 12:42
==================== End Of Log ============================
5. Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by mduus at 2014-12-21 14:01:38
Running from C:\Users\mduus\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Disabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: Kaspersky Anti-Virus (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Microsoft Security Essentials (Disabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Kaspersky Anti-Virus (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden
8500A909_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909a (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Aastra 800 TAPI (HKLM\...\Aastra 800 TAPI) (Version: 3.15.25 - Aastra Telecom Schweiz AG)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
ACT! by Sage Premium 2010 (HKLM-x32\...\InstallShield_{565BA335-F3D6-466F-9AF8-B4A69A7F1300}) (Version: 12.0.0.0 - Sage Software, Inc.)
ACT! by Sage Premium 2010 (x32 Version: 12.0.0.0 - Sage Software, Inc.) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
AeroFly 5 (HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\{52989499-E3EF-442C-8B07-B1D2D32388ED}) (Version: 5.00.03.05 - IPACS)
AeroFly 5 (HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\{52989499-E3EF-442C-8B07-B1D2D32388ED}) (Version: 5.00.03.05 - IPACS)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BPD_DSWizards (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Chartist Version 4.10 (HKLM-x32\...\Chartist) (Version: - )
Chinese Simplified Fonts Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-2447-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Citrix Online Launcher (HKLM-x32\...\{77463C86-BB3A-426E-A6C2-06B4D28C250F}) (Version: 1.0.223 - Citrix)
Colasoft Capsa 7 Free (HKLM-x32\...\Colasoft Capsa 7 Free_is1) (Version: 7.8.1.4863 - Colasoft)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.0 - REINER SCT)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2425.52 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2219.57 - CyberLink Corp.)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 15.3.45.87 - Synaptics Incorporated)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
DisplayLink Core Software (HKLM\...\{89019C7F-1F8C-4F95-90AD-45E5B5D783A3}) (Version: 6.2.37054.0 - DisplayLink Corp.)
DJI driver version 1.0 (HKLM-x32\...\{9A2C30EE-6E35-4479-B0E6-B1B47A54E8CD}_is1) (Version: 1.0 - DJI)
DJI Phantom 2 Assistant version 1.08 (HKLM-x32\...\{CD2EF94A-5983-4C19-A72A-0B0DA4B32564}_is1) (Version: 1.08 - DJI)
DocMgr (x32 Version: 140.0.65.000 - Ihr Firmenname) Hidden
DocProc (x32 Version: 140.0.100.000 - Hewlett-Packard) Hidden
Fax (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Foxit Reader (HKLM-x32\...\{27E3028E-06C8-4C09-8C3E-07F7F508304E}) (Version: 5.3.1.606 - Foxit Corporation)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
FRITZ!Fernzugang (HKLM\...\{5001E5BC-C9BF-4598-AB89-E7318C76C5F4}) (Version: 1.2.6 - AVM Berlin)
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Gerätetreiber für Intel(R) Wireless Music (HKLM\...\{4169B8AC-D144-4E38-A9CA-637EA44129ED}) (Version: 1.5.5323.0 - Intel Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{7455D86F-5295-389C-AA29-18D2BDAF8DD8}) (Version: 65.169.102 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GoToMeeting 5.4.0.1083 (HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\GoToMeeting) (Version: 5.4.0.1083 - CitrixOnline)
GPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
GPL Ghostscript 8.70 (HKLM-x32\...\GPL Ghostscript 8.70) (Version: - )
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Officejet Pro 8500 A909 Series (HKLM\...\{F86D9734-D358-4C5B-BC2B-6D90557FF05B}) (Version: 14.0 - HP)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2897 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{3015F546-6C3E-4E6A-B564-BCDF88C0BA2A}) (Version: 2.1.1.0153 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Smart Connect Technology 2.0 x64 (HKLM\...\{54F8B6C7-9B25-4E85-A1E0-26CFB80DE787}) (Version: 2.0.1083.0 - Intel)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{4E4282C3-F66E-4852-837A-7675527178C2}) (Version: 3.1.26.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{54EB8041-1115-4406-AA4B-44D236E84B3B}) (Version: 15.01.1000.0927 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Kaspersky Small Office Security (HKLM-x32\...\InstallWIX_{1549B388-042B-4573-B0CE-A8FF0D7F8F2A}) (Version: 9.1.0.59 - Kaspersky Lab)
Lehre und Erkenntnis 1.0 (HKLM-x32\...\Lehre und Erkenntnis) (Version: 1.0 - Verlag Friedrich Bischoff GmbH)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Lync 2010 Attendee (HKLM-x32\...\{44228375-A198-489B-B90F-F88A1A78D5F5}) (Version: 4.0.7577.4391 - Microsoft Corporation)
Microsoft Office Live Meeting 2007 (HKLM-x32\...\{E30E7561-A466-4393-B8BF-FD93E733EF3C}) (Version: 8.0.6362.202 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
MPM (HKLM-x32\...\{8AEA6737-8AF3-47BB-95CE-AAB62BE68985}) (Version: 1.00.0000 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.11100.8.0 - Nero AG)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0604 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0604 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Oracle VM VirtualBox 4.3.8 (HKLM\...\{5D328A41-BFF8-4B78-B45E-5BEE1D133EF5}) (Version: 4.3.8 - Oracle Corporation)
Parallels runtime modules (x32 Version: 1.00.0000 - Parallels) Hidden
Parallels USB Driver (x32 Version: 6.00.18494 - Parallels) Hidden
PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.7501 - CyberLink Corp.)
ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.14.009 - Dell Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6606 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.28094 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (x32 Version: 140.0.167.000 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
ServiceTrace Idea Exchange 1.0 (HKLM\...\{765F1F65-0741-44FC-89D8-B464985D3959}_is1) (Version: - ServiceTrace e.K.)
ServiceTrace Service Check Package 3.0.3881.1 (HKLM-x32\...\{B3EE006A-94A9-457D-AB80-C1AC70102456}_is1) (Version: 1.0 - ServiceTrace GmbH)
ServiceTrace VoIP-Tracer Package 3.0.3881.1 (HKLM-x32\...\{9659E4E5-5B56-4AB1-9FC4-8EB15507DB91}_is1) (Version: 1.0 - ServiceTrace GmbH.)
ServiceTrace Web Automation Package 3.0.3881.1 (HKLM-x32\...\{9D1F1CBB-5EF2-4A5F-80D0-E9666DC5D913}_is1) (Version: 1.0 - ServiceTrace GmbH)
ServiceTracer Agent 4.0.2819.1 (HKLM\...\{EE86AED7-6E72-42E5-B64D-C05042141FDD}_is1) (Version: - ServiceTrace e.K.)
ServiceTracer Robot 4.6.3881.1 (HKLM-x32\...\ServiceTracer-Client_is1) (Version: 4.6.3881.1 - ServiceTrace e.K.)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
SnagIt 5 (HKLM-x32\...\SnagIt5) (Version: 5.0 - TechSmith Corporation)
SnapAPI (x32 Version: 3.0.306 - Acronis) Hidden
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.11.0018 - ST Microelectronics)
StarMoney (x32 Version: 3.0.5.8 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.2.34 - StarFinanz) Hidden
StarMoney 9.0 (HKLM-x32\...\{74E75332-22E4-47E7-8EF1-B152C49AFE76}) (Version: 9.0 - Star Finanz GmbH)
StarMoney Business 6.0 (HKLM-x32\...\{8B738273-2D3F-477A-8547-87190F4D96EE}) (Version: 6.0 - Star Finanz GmbH)
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version: - )
System Checkup 3.4 (HKLM-x32\...\{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1) (Version: 3.4.2.29 - iolo technologies, LLC)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
VLC media player 2.0.6 (HKLM-x32\...\VLC media player) (Version: 2.0.6 - VideoLAN)
VMware vSphere Client 4.1 (HKLM-x32\...\{A0B433B1-941D-46F5-AE59-286263534232}) (Version: 4.1.0.12319 - VMware, Inc.)
WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows-Treiberpaket - dji-innovations inc. (usbser) Ports (01/19/2011 5.1.2600.5512) (HKLM\...\2DC11E587B8BA912FF8FD5433B426EE46F8E22DD) (Version: 01/19/2011 5.1.2600.5512 - dji-innovations inc.)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )
WorkflowEditor 3.0.3881.1 (HKLM-x32\...\{E9CC12C6-3CB1-4E69-A713-CBFA780E02FD}_is1) (Version: - ServiceTrace GmbH)
XMind (HKLM-x32\...\XMind) (Version: 3.3.0 - XMind Ltd.)
XviD MPEG-4 Codec (HKLM-x32\...\XviD) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1083\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1484493839-596051297-3328508428-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
11-12-2014 09:29:51 Cisco WebEx Meeting Center für Internet Explorer wird installiert
11-12-2014 12:59:43 Windows Update
14-12-2014 09:03:13 Windows Update
17-12-2014 17:50:06 Windows Update
18-12-2014 07:44:10 Windows Update
19-12-2014 23:59:35 Revo Uninstaller's restore point - Acronis True Image 2014
20-12-2014 00:03:08 Revo Uninstaller's restore point - QuickShare
21-12-2014 13:27:08 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-12-20 09:36 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0D109502-3094-4459-AB5B-9DF26AA5BCE9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {2138003A-7FD3-4CFC-90BF-67F6F727A895} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {2B788C7D-CC6E-41F2-AD42-42A27F94995E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {361BA8B9-F874-4127-957F-F051D69BC7B7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-01] (Google Inc.)
Task: {4D6402B4-FE6F-4143-9996-0665F5B16532} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-01] (Google Inc.)
Task: {5922D071-7DB7-4E6C-A31D-2CED5E3898E1} - System32\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015 => C:\Users\Markus\AppData\Local\Citrix\GoToMeeting\2033\g2mupdate.exe [2014-11-27] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {913C747F-077A-4DA5-A38A-D16E4D2484A5} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {A801D794-E6A2-4A1E-A3CE-2A7201D095DA} - System32\Tasks\{7CEF60C7-22B2-4CF3-9C63-8B821B327870} => C:\Program Files (x86)\XMind\XMind.exe [2012-08-11] ()
Task: {C2A7183A-FE14-42BE-80ED-42BA30E67078} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {FA5892C3-5D35-47F9-B32B-9470D8324014} - System32\Tasks\Microsoft\Windows\MobilePC\DisplayLink TMM Control
Task: {FE723EA4-B5C5-4D7E-8C3B-6B6EFD395FD1} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {FEB47593-6E07-422A-A124-6B2C20139A01} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job => C:\Users\Markus\AppData\Local\Citrix\GoToMeeting\2033\g2mupdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-08-24 19:59 - 2013-10-23 09:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-08-24 21:51 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2012-02-09 15:26 - 2012-02-09 15:26 - 00133632 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2012-02-09 15:26 - 2012-02-09 15:26 - 00048128 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2012-02-09 15:26 - 2012-02-09 15:26 - 00036864 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetDetect.dll
2012-08-24 19:55 - 2012-02-14 08:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-06-05 22:27 - 2013-08-26 14:05 - 00132546 _____ () C:\Program Files\ServiceTracer\Agent\AgileDotNetRT64.dll
2014-06-05 22:27 - 2014-01-13 12:40 - 01083392 _____ () C:\Program Files\ServiceTracer\Agent\System.Data.SQLite.dll
2014-06-05 22:27 - 2014-01-13 12:40 - 00272384 _____ () C:\Program Files\ServiceTracer\Agent\C5.dll
2012-08-24 21:03 - 2005-04-22 12:36 - 00143360 ____N () C:\Windows\system32\BrSNMP64.dll
2011-02-18 07:18 - 2011-02-18 07:18 - 00245760 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-08-24 21:47 - 2005-06-07 11:26 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-12-12 09:40 - 2007-05-31 07:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2013-02-12 15:20 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\EnumDevLib.dll
2014-08-05 13:52 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-09-29 20:36 - 2011-01-13 09:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney Business 6.0\ouservice\PATCHW32.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-08-11 14:20 - 2011-08-24 03:39 - 00081920 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\koan\_ctypes.pyd
2013-08-11 14:20 - 2011-08-24 03:39 - 00053248 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\Koan\_socket.pyd
2013-08-11 14:20 - 2011-08-24 03:39 - 00655360 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\Koan\_ssl.pyd
2013-10-10 11:02 - 2013-10-10 11:02 - 00013120 _____ () C:\Program Files (x86)\Common Files\Acronis\TibMounter\icudt38.dll
2014-02-04 17:25 - 2014-02-04 17:25 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-02-04 17:25 - 2014-02-04 17:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-10-17 15:38 - 2014-10-17 15:38 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-08-24 19:53 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-08-24 19:34 - 2012-02-01 13:44 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\CLDShowX.ini:Update.CL
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1484493839-596051297-3328508428-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-1484493839-596051297-3328508428-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1484493839-596051297-3328508428-1008 - Limited - Enabled)
Markus (S-1-5-21-1484493839-596051297-3328508428-1015 - Limited - Enabled) => C:\Users\Markus
mduus (S-1-5-21-1484493839-596051297-3328508428-1000 - Administrator - Enabled) => C:\Users\mduus
stcadmin (S-1-5-21-1484493839-596051297-3328508428-1019 - Limited - Enabled) => C:\Users\stcadmin
UpdatusUser (S-1-5-21-1484493839-596051297-3328508428-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP Color LaserJet CM6040 MFP
Description: HP Color LaserJet CM6040 MFP
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: HP CM8050 MFP with Edgeline
Description: HP CM8050 MFP with Edgeline
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Power Control [2012/12/29 22:46:55]
Description: Power Control [2012/12/29 22:46:55]
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Officejet Pro 8600
Description: Officejet Pro 8600
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-12-20 09:35:59.980
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-20 09:35:59.871
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-20 00:24:24.659
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-20 00:24:24.659
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.838
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.837
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.833
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:27:04.832
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.641
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-11-15 11:23:16.620
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3612QM CPU @ 2.10GHz
Percentage of memory in use: 16%
Total physical RAM: 16266.36 MB
Available physical RAM: 13609.66 MB
Total Pagefile: 32530.89 MB
Available Pagefile: 29594.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive b: (System_Reserve) (Fixed) (Total:18.25 GB) (Free:2.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive c: () (Fixed) (Total:458.65 GB) (Free:198.59 GB) NTFS
Drive d: (MSata256GB) (Fixed) (Total:238.47 GB) (Free:11.07 GB) NTFS
Drive e: (OCZ256GB) (Fixed) (Total:223.47 GB) (Free:40.75 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 476.9 GB) (Disk ID: E88F74CD)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=18.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=458.7 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 1EDE08E7)
Partition 1: (Not Active) - (Size=238.5 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: C6BD147D)
Partition 1: (Not Active) - (Size=223.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Die Schadsoftware Win32/Fareit wurde auf dem PC erkannt
Windows hat Win32/Fareit auf dem Computer gefunden und entfernt. Win32/Fareit ist eine Schadsoftware, mit der Kennwörter ausspioniert werden können.
Wichtig
Es wird dringend empfohlen, dass Sie umgehend alle Kennwörter für Websites ändern, die ein Kennwort erfordern, insbesondere für email-Websites und andere Sites, auf denen persönliche Informationen gespeichert werden.
Ermitteln, wann diese Schadsoftware vom Computer entfernt wurde
Klicken Sie auf die Schaltfläche Start, geben Sie im Suchfeld den Begriff Microsoft Security Essentials ein, und klicken Sie dann auf Microsoft Security Essentials.
Klicken Sie in Microsoft Security Essentials auf die Registerkarte Verlauf.
Klicken Sie auf Alle erkannten Elemente, und klicken Sie dann auf die Schaltfläche Details anzeigen.
Im Bericht werden alle erkannten Elemente sowie das Datum angezeigt, an dem Win32/Fareit entfernt wurde.
Was ist Malware?
Schädliche Software, auch Malware genannt, wird vorsätzlich dazu entwickelt, auf Computern Schaden anzurichten. Dabei kann es sich zum Beispiel um Viren, Würmer oder trojanische Pferde handeln. Sie können Ihren Computer vor Malware schützen, indem Sie stets aktuelle Antiviren- und Antispywaresoftware verwenden.
--------------------------------------------------------------------------------
Beste Grüße Markus |
|
22.12.2014, 11:50
| #6 |
| /// the machine /// TB-Ausbilder | Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr Hat MSE auch gemeldet wo es das gefunden hat? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr |
|
22.12.2014, 21:46
| #7 |
| | 4ter scan Hallo, hier die Ergebnisse des 4ten Scans. 1_Eset Online Scaner: Code:
ATTFilter C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32cert.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32prop.dll.vir Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64cert.dll.vir Variante von Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64prop.dll.vir Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\BrowserHelper.exe.vir Variante von MSIL/Toolbar.Linkury.A evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll.vir Variante von Win32/Toolbar.Linkury.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll.vir Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll.vir Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.ShortcutsLibrary.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\Smartbar.Resources.UninstallScreen.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_10.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_11.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_12.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_13.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_14.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_15.dll.vir Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_18.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_19.dll.vir Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll.vir Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.DMP.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.NotepadPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.ScreenCapturePlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.UninstallProductsPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll.vir Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\AdwCleaner\Quarantine\C\Users\mduus\AppData\Roaming\OpenCandy\0594DCA1283341E4808D883D0F47517E\HSS-2.67-install-p76-335-conduit.exe.vir Win32/Toolbar.Conduit evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\ServiceTrace\Technik\Administration\Lizenzen\Camptasia\Camtasia8\8\setup.exe Win32/Toolbar.Conduit evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.LanguageSettings.resources.dll Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.ProductUninstaller.dll Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.SetBrowsersSettings.dll Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert
Das Log von Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.93
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
Kaspersky Anti-Virus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 65
Java version 32-bit out of Date!
Adobe Flash Player 15.0.0.223 Flash Player out of Date!
Mozilla Firefox (33.1)
Google Chrome (39.0.2171.71)
Google Chrome (39.0.2171.95)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
StarMoney 9.0 ouservice StarMoneyOnlineUpdate.exe
StarMoney Business 6.0 ouservice StarMoneyOnlineUpdate.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Und hier noch der Scan von FRST64: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by mduus (administrator) on SERVICETRACE01 on 22-12-2014 21:35:19
Running from C:\Users\mduus\Desktop
Loaded Profiles: mduus & UpdatusUser (Available profiles: mduus & UpdatusUser & Markus & stcadmin & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brsvc01a.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brss01a.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Realtek) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe
(ServiceTrace e.K.) C:\Program Files\ServiceTracer\Agent\ServiceTracerAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Sage Software, Inc.) C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney Business 6.0\offlagent10\offlagent.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
() C:\Users\mduus\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6469736 2012-03-29] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2870032 2012-03-07] (Synaptics Incorporated)
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [Act.Outlook.Service] => C:\Program Files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe [17920 2010-01-06] (Sage Software, Inc.)
HKLM-x32\...\Run: [Act! Preloader] => C:\Program Files (x86)\ACT\Act for Windows\ActSage.exe [331776 2010-01-04] (Sage Software, Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [144616 2011-03-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PowerDVD12DMREngine] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-10-19] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] => C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\PowerDVD12Agent.exe [374560 2012-10-19] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-02] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-11-12] (cyberlink)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [SMB60StarMoneyRunEntry] => C:\Program Files (x86)\StarMoney Business 6.0\app\oflagent.exe [51856 2014-12-18] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll [X]
HKLM\...\Policies\Explorer: [NoCDBurning] 1
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Run: [DellSystemDetect] => C:\Users\Markus\AppData\Local\Apps\2.0\EKQO9AYK.E5D\LZVYA245.DQ8\dell..tion_e30b47f5d4a30e9e_0005.000c_1df9a4898fae00de\DellSystemDetect.exe [264488 2014-11-12] (Dell)
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Run: [Installation Diagnostics] => "C:\Program Files (x86)\Brother\Brmfl04b\Brinstck.exe" /I MFC-5440CN LAN
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\MountPoints2: {a208c8d6-ee18-11e1-8f08-806e6f6e6963} - D:\autoRcd.exe
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [168616 2013-11-21] (NVIDIA Corporation)
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\kloehk.dll [15448 2010-12-09] (Kaspersky Lab)
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\sbhook64.dll [69720 2010-12-09] (Kaspersky Lab)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-11-21] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\mzvkbd3.dll [109144 2010-12-09] (Kaspersky Lab)
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\sbhook.dll [72280 2010-12-09] (Kaspersky Lab)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startvm.bat ()
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => No File
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => No File
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => No File
ShellIconOverlayIdentifiers: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\shellex.dll (Kaspersky Lab ZAO)
ShellIconOverlayIdentifiers-x32: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\shellex.dll (Kaspersky Lab ZAO)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1484493839-596051297-3328508428-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1484493839-596051297-3328508428-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\x64\ievkbd.dll (Kaspersky Lab)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\ievkbd.dll (Kaspersky Lab)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile -> {D5233FCD-D258-4903-89B8-FB1568E7413D} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.99.1
Tcpip\..\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: [NameServer] 8.8.8.8,8.8.8.8
FireFox:
========
FF ProfilePath: C:\Users\mduus\AppData\Roaming\Mozilla\Firefox\Profiles\el66lcwh.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2014-09-26]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Модуль перевірки посилань - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\url_advisor@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\FFExt\content_blocker@kaspersky.com [2014-12-18]
FF HKLM-x32\...\Thunderbird\Extensions: [{eea12ec4-729d-4703-bc37-106ce9879ce2}] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt
FF Extension: Kaspersky Anti-Spam Extension - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Small Office Security\THBExt [2014-07-18]
FF HKU\S-1-5-21-1484493839-596051297-3328508428-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-08-24]
FF HKU\S-1-5-21-1484493839-596051297-3328508428-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 ACT! Scheduler; C:\Program Files (x86)\ACT\Act for Windows\Act.Scheduler.exe [81920 2010-01-04] (Sage Software, Inc.) [File not signed]
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-13] (brother Industries Ltd) [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT)
R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-10-19] (CyberLink Corp.)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2010-11-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-10-19] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-10-19] (CyberLink)
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [8498608 2012-03-15] (DisplayLink Corp.)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-01] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R2 MSSQL$ACT7; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [199272 2011-05-18] (Realtek Semiconductor)
R2 ServiceTracer Agent; C:\Program Files\ServiceTracer\Agent\ServiceTracerAgent.exe [877568 2014-01-13] (ServiceTrace e.K.) [File not signed]
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 StarMoney Business 6.0 OnlineUpdate; C:\Program Files (x86)\StarMoney Business 6.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] () [File not signed]
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)
S2 CLKMSVC10_1628BCEA; "C:\Program Files (x86)\CyberLink\PowerDVD DX\Kernel\BD\NavFilter\kmsvc.exe" /svc [X]
S2 CSObjectsSrv; "C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 Capsax64Drv0; C:\Windows\System32\Drivers\Capsax64Drv0.sys [35976 2014-08-15] (Colasoft Co., Ltd.)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
U5 CSCrySec; C:\Windows\System32\Drivers\CSCrySec.sys [85048 2009-12-14] (Infowatch)
R1 CSN5PDTS82x64; C:\Windows\System32\Drivers\CSN5PDTS82x64.sys [34840 2012-10-24] (Colasoft Co., Ltd.)
S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_6.2.37054.0.sys [17408 2012-03-15] (hxxp://libusb-win32.sourceforge.net)
S3 dlcdcecm; C:\Windows\System32\DRIVERS\dlcdcecm.sys [38400 2012-03-15] (DisplayLink Corp.)
S3 dlusbaudio; C:\Windows\System32\DRIVERS\dlusbaudio_x64.sys [192120 2012-03-15] (DisplayLink Corp.)
R3 hswpan; C:\Windows\System32\DRIVERS\hswpan.sys [109056 2012-01-27] (Ozmo Inc)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
S3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-12-18] (Kaspersky Lab ZAO)
R0 KLBG; C:\Windows\System32\DRIVERS\klbg.sys [40464 2009-10-14] (Kaspersky Lab)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-12-18] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-12-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-12-18] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-12-18] (Kaspersky Lab ZAO)
R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-11-21] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 SmbDrvIntel; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [24848 2012-03-07] (Synaptics Incorporated)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-10-24] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-10-24] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-10-24] (Acronis International GmbH)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-12-21] ()
R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink\PowerDVD12_neu\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-10-19] (CyberLink Corp.)
S1 awtocttz; \??\C:\Windows\system32\drivers\awtocttz.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S1 cmelsjaq; \??\C:\Windows\system32\drivers\cmelsjaq.sys [X]
S1 CSN5PDTS82; System32\Drivers\CSN5PDTS82.sys [X]
S1 CsNdisLWF; System32\Drivers\CsNdisLWF.sys [X]
S1 dcstxbht; \??\C:\Windows\system32\drivers\dcstxbht.sys [X]
S1 ipwuabum; \??\C:\Windows\system32\drivers\ipwuabum.sys [X]
S1 putybsdl; \??\C:\Windows\system32\drivers\putybsdl.sys [X]
S1 qawzvpin; \??\C:\Windows\system32\drivers\qawzvpin.sys [X]
S1 sedgtwrs; \??\C:\Windows\system32\drivers\sedgtwrs.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-22 21:05 - 2014-12-22 21:03 - 00852505 _____ () C:\Users\mduus\Desktop\SecurityCheck.exe
2014-12-22 21:03 - 2014-12-22 21:03 - 00852505 _____ () C:\Users\stcadmin\Desktop\SecurityCheck.exe
2014-12-21 14:01 - 2014-12-22 21:35 - 00037437 _____ () C:\Users\mduus\Desktop\FRST.txt
2014-12-21 14:01 - 2014-12-21 14:02 - 00043208 _____ () C:\Users\mduus\Desktop\Addition.txt
2014-12-21 14:01 - 2014-12-21 14:01 - 00000000 ____D () C:\Users\mduus\Desktop\FRST-OlderVersion
2014-12-21 14:00 - 2014-12-21 14:01 - 02122240 _____ (Farbar) C:\Users\mduus\Desktop\FRST64.exe
2014-12-21 13:59 - 2014-12-21 13:59 - 00000860 _____ () C:\Users\mduus\Desktop\JRT.txt
2014-12-21 13:53 - 2014-12-21 13:53 - 00000000 ____D () C:\Windows\ERUNT
2014-12-21 13:52 - 2014-12-21 13:30 - 01707646 _____ (Thisisu) C:\Users\mduus\Desktop\JRT.exe
2014-12-21 13:49 - 2014-12-21 13:49 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2014-12-21 13:41 - 2014-12-21 13:26 - 02166272 _____ () C:\Users\mduus\Desktop\AdwCleaner_4.105.exe
2014-12-21 13:30 - 2014-12-21 13:30 - 01707646 _____ (Thisisu) C:\Users\stcadmin\Desktop\JRT.exe
2014-12-21 13:26 - 2014-12-21 13:26 - 02166272 _____ () C:\Users\stcadmin\Desktop\AdwCleaner_4.105.exe
2014-12-21 13:22 - 2014-12-21 13:21 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\stcadmin\Desktop\mbam-setup-2.0.4.1028.exe
2014-12-20 10:05 - 2014-12-20 10:05 - 00000008 __RSH () C:\ProgramData\D9A609DD66.sys
2014-12-20 09:39 - 2014-12-20 09:39 - 00047166 _____ () C:\ComboFix.txt
2014-12-20 00:24 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-20 00:24 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-20 00:24 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-20 00:24 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-20 00:16 - 2014-12-20 09:39 - 00000000 ____D () C:\Qoobox
2014-12-20 00:16 - 2014-12-20 09:38 - 00000000 ____D () C:\Windows\erdnt
2014-12-20 00:16 - 2014-12-20 00:12 - 05601641 ____R (Swearware) C:\Users\mduus\Desktop\ComboFix.exe
2014-12-20 00:12 - 2014-12-20 00:12 - 05601641 _____ (Swearware) C:\Users\stcadmin\Desktop\ComboFix.exe
2014-12-20 00:01 - 2014-12-20 00:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2014-12-20 00:01 - 2014-12-20 00:01 - 00000000 ____D () C:\Program Files (x86)\Acronis
2014-12-19 23:58 - 2014-12-19 23:58 - 00001264 _____ () C:\Users\mduus\Desktop\Revo Uninstaller.lnk
2014-12-19 23:58 - 2014-12-19 23:58 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-12-19 23:57 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\mduus\Desktop\revosetup95.exe
2014-12-19 23:53 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\stcadmin\Desktop\revosetup95.exe
2014-12-19 23:47 - 2014-12-19 23:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Markus\Desktop\revosetup95.exe
2014-12-19 18:33 - 2014-12-19 18:33 - 00380416 _____ () C:\Users\stcadmin\Desktop\Gmer-19357.exe
2014-12-19 18:08 - 2014-12-19 18:09 - 00054482 _____ () C:\Users\stcadmin\Desktop\FRST.txt
2014-12-19 18:08 - 2014-12-19 18:08 - 00050359 _____ () C:\Users\stcadmin\Desktop\Addition.txt
2014-12-19 18:07 - 2014-12-22 21:35 - 00000000 ____D () C:\FRST
2014-12-19 18:07 - 2014-12-19 18:07 - 02121216 _____ (Farbar) C:\Users\stcadmin\Desktop\FRST64.exe
2014-12-19 18:04 - 2014-12-19 18:05 - 00050477 _____ () C:\Users\stcadmin\Desktop\Defogger.exe
2014-12-19 17:56 - 2014-12-16 10:11 - 02347384 _____ (ESET) C:\Users\stcadmin\Desktop\esetsmartinstaller_deu.exe
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieUserList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieSiteList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 __SHD () C:\Users\stcadmin\AppData\Local\EmieBrowserModeList
2014-12-19 17:55 - 2014-12-19 17:55 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Macromedia
2014-12-18 13:18 - 2014-12-18 13:18 - 00000000 ____D () C:\Users\Markus\AppData\Local\WebEx
2014-12-18 13:17 - 2014-12-18 13:18 - 00631744 _____ (Cisco WebEx LLC) C:\Users\Markus\Downloads\Cisco_WebEx_Add-On.exe
2014-12-18 13:16 - 2014-12-18 13:18 - 00000000 ____D () C:\ProgramData\WebEx
2014-12-18 09:46 - 2014-12-18 09:46 - 00001089 _____ () C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2014-12-18 09:46 - 2014-12-18 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2014-12-18 09:46 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-12-18 09:45 - 2014-12-18 10:22 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-12-18 09:45 - 2014-12-18 10:22 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-12-18 09:45 - 2014-12-18 09:45 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-12-18 09:44 - 2014-12-18 09:44 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Foxit Software
2014-12-18 07:10 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 07:10 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 08:49 - 2014-12-22 21:00 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CrashDumps
2014-12-17 08:49 - 2014-12-17 08:49 - 00111672 _____ () C:\Users\stcadmin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-17 08:49 - 2014-12-17 08:49 - 00001421 _____ () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\IsolatedStorage
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel Corporation
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\CyberLink
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Adobe
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\ACT
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\MediaServer
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\IsolatedStorage
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Google
2014-12-17 08:49 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\CyberLink
2014-12-17 08:48 - 2014-12-17 08:49 - 00000000 ____D () C:\Users\stcadmin
2014-12-17 08:48 - 2014-12-17 08:48 - 00000020 ___SH () C:\Users\stcadmin\ntuser.ini
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Vorlagen
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Startmenü
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Netzwerkumgebung
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Lokale Einstellungen
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Eigene Dateien
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Druckumgebung
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Musik
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Documents\Eigene Bilder
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Verlauf
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\AppData\Local\Anwendungsdaten
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 _SHDL () C:\Users\stcadmin\Anwendungsdaten
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Intel
2014-12-17 08:48 - 2014-12-17 08:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\VirtualStore
2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Roaming\Apple Computer
2014-12-17 08:48 - 2012-12-20 10:48 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Apple Computer
2014-12-17 08:48 - 2012-08-24 23:24 - 00000000 ____D () C:\Users\stcadmin\AppData\Local\Microsoft Help
2014-12-17 08:48 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-17 08:48 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\stcadmin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-16 15:29 - 2014-12-16 15:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-12-16 15:11 - 2014-12-16 15:11 - 00071848 _____ () C:\Users\Markus\Desktop\123.xml
2014-12-16 10:11 - 2014-12-19 17:52 - 00000000 ____D () C:\Users\Markus\Desktop\trojaner_scan
2014-12-16 09:49 - 2014-12-16 09:48 - 16503606 _____ () C:\Users\mduus\Desktop\AcronisTrueImage.msi.txt
2014-12-15 21:55 - 2014-12-15 21:55 - 00111877 _____ () C:\Users\Markus\Downloads\33516_gr_rx16_3a99_f9.bin
2014-12-12 09:51 - 2014-12-12 09:55 - 00000000 ____D () C:\Users\Markus\Desktop\bilder
2014-12-12 00:05 - 2014-12-12 01:21 - 25027790 _____ () C:\Users\Markus\Desktop\weihnachtsfeier2014.pptx
2014-12-11 11:08 - 2014-12-11 12:54 - 00050515 _____ () C:\Users\Markus\Desktop\141204_CorporateAccount_List__.xlsx
2014-12-10 13:30 - 2014-12-10 13:30 - 00634563 _____ () C:\Users\Markus\Desktop\Portokasse Deutsche Post_do.mht
2014-12-10 09:38 - 2014-12-10 09:38 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-10 09:04 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 09:04 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 09:04 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-10 09:04 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-10 09:04 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-10 09:04 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-10 09:04 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-10 09:04 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-10 09:04 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-10 09:04 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-10 07:25 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 07:25 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 07:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 07:25 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 07:25 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 07:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 07:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 07:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 07:25 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 07:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 07:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 07:25 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 07:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 07:25 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 07:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 07:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 07:25 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 07:25 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 07:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 07:25 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 07:25 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 07:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 07:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 07:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 07:25 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 07:25 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 07:25 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 07:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 07:25 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 07:25 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 07:25 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 07:25 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 07:25 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 07:25 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 07:25 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 07:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 07:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 07:25 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 07:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 07:25 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 07:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 07:25 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 07:25 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 07:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 07:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 07:25 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 07:25 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 07:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 07:25 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 07:25 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 07:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 07:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 07:25 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 07:25 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 07:18 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 07:18 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 07:18 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 07:18 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 07:18 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 07:18 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 07:17 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 07:17 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 07:17 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 07:17 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 07:17 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 07:17 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 07:17 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 07:17 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 07:17 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 07:17 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-04 14:45 - 2014-12-04 14:45 - 00000000 ____D () C:\Users\mduus\AppData\Local\ServiceTrace_GmbH_Darmsta
2014-12-02 23:10 - 2014-12-02 23:10 - 00000000 ____D () C:\Users\Markus\Downloads\VPN
2014-12-01 14:58 - 2014-12-01 14:58 - 03271355 _____ () C:\Users\Markus\Desktop\PP WIN - Kopie.pptx
2014-11-28 09:14 - 2014-11-28 09:14 - 01383960 _____ () C:\Windows\Minidump\112814-31028-01.dmp
2014-11-23 22:58 - 2014-11-23 22:58 - 00002334 _____ () C:\Users\Markus\Desktop\Demo_Maschine.RDP
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-22 21:14 - 2014-02-12 16:46 - 00000568 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015.job
2014-12-22 21:06 - 2012-08-27 14:14 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-22 21:05 - 2012-08-29 16:54 - 00000000 ____D () C:\Users\mduus\AppData\Local\CrashDumps
2014-12-22 21:05 - 2012-08-27 14:14 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-22 21:05 - 2012-08-25 12:48 - 00000952 ___SH () C:\ProgramData\KGyGaAvL.sys
2014-12-22 21:05 - 2012-08-24 22:35 - 00000000 ____D () C:\Users\mduus\AppData\Roaming\Skype
2014-12-22 19:23 - 2014-10-17 14:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-22 19:22 - 2013-01-15 10:10 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-12-22 19:20 - 2012-09-06 14:49 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2014-12-22 19:19 - 2012-09-21 12:56 - 00000000 ____D () C:\Users\Markus\Documents\Outlook-Dateien
2014-12-22 18:40 - 2014-09-29 20:33 - 00000000 ____D () C:\Program Files (x86)\StarMoney Business 6.0
2014-12-22 18:37 - 2012-08-24 19:26 - 01472854 _____ () C:\Windows\WindowsUpdate.log
2014-12-22 18:26 - 2009-07-14 05:51 - 00516109 _____ () C:\Windows\setupact.log
2014-12-22 16:46 - 2012-08-25 10:14 - 00000000 ____D () C:\ServiceTrace
2014-12-22 16:33 - 2014-05-19 13:38 - 00000000 ____D () C:\Users\Markus\Desktop\__3 in Bearbeitung
2014-12-22 14:36 - 2014-02-13 14:41 - 00000000 ____D () C:\Users\Markus\.VirtualBox
2014-12-22 13:13 - 2013-11-28 10:54 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-12-21 14:30 - 2012-08-24 22:18 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-21 14:30 - 2009-07-14 03:34 - 00000513 _____ () C:\Windows\win.ini
2014-12-21 14:29 - 2012-09-12 09:06 - 00000000 ____D () C:\Users\Markus\AppData\Local\CrashDumps
2014-12-21 13:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 13:57 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 13:56 - 2012-08-25 05:20 - 00749922 _____ () C:\Windows\system32\perfh007.dat
2014-12-21 13:56 - 2012-08-25 05:20 - 00168104 _____ () C:\Windows\system32\perfc007.dat
2014-12-21 13:56 - 2009-07-14 06:13 - 01760122 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-21 13:49 - 2012-08-24 19:59 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-21 13:49 - 2012-08-24 19:48 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2014-12-21 13:49 - 2010-11-21 04:47 - 00488624 _____ () C:\Windows\PFRO.log
2014-12-21 13:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-21 13:48 - 2014-10-17 14:14 - 00000000 ____D () C:\AdwCleaner
2014-12-20 09:39 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-12-20 09:37 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-18 12:24 - 2014-09-29 07:42 - 00000000 ____D () C:\Users\Markus\Desktop\Aktuelle ST Praesentationen
2014-12-18 10:22 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-12-18 10:22 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-12-18 10:22 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-12-18 10:19 - 2014-10-06 09:20 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-18 10:19 - 2012-08-24 22:34 - 00000000 ____D () C:\ProgramData\Skype
2014-12-18 09:45 - 2014-07-18 15:42 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-12-17 14:13 - 2012-09-04 13:49 - 00000000 ____D () C:\Users\mduus\Documents\Outlook-Dateien
2014-12-16 22:19 - 2014-09-19 10:57 - 00001026 _____ () C:\Users\Markus\Desktop\Dropbox.lnk
2014-12-16 22:19 - 2014-09-19 10:57 - 00000000 ___RD () C:\Users\Markus\Dropbox
2014-12-16 22:19 - 2014-09-19 10:56 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-16 22:19 - 2014-09-19 10:53 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Dropbox
2014-12-16 15:18 - 2012-09-25 08:23 - 00002334 ____H () C:\Users\Markus\Documents\Default.rdp
2014-12-16 12:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-16 11:52 - 2012-08-24 19:26 - 00000000 ____D () C:\Users\mduus
2014-12-13 22:17 - 2012-11-18 17:31 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2014-12-11 23:56 - 2014-05-19 13:41 - 00000000 ____D () C:\Users\Markus\Desktop\__5 Fertig
2014-12-10 16:31 - 2012-09-13 10:14 - 00000000 ____D () C:\Users\Markus\Tracing
2014-12-10 12:07 - 2014-09-23 15:30 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-10 09:38 - 2014-05-07 06:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-10 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-10 09:08 - 2013-08-14 12:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-10 09:05 - 2012-08-24 20:22 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 07:58 - 2014-09-29 07:58 - 00000000 ____D () C:\Users\Markus\Desktop\Aktuelle ST Unterlagen
2014-12-07 15:39 - 2014-10-17 14:47 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-12-07 15:39 - 2014-10-17 14:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-04 14:42 - 2012-09-11 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ServiceTracerClient
2014-12-04 14:41 - 2014-02-18 17:06 - 00001509 _____ () C:\Users\Public\Desktop\STC Workflow Editor.lnk
2014-12-04 14:41 - 2012-08-25 17:41 - 00000000 ____D () C:\Program Files (x86)\ServiceTracerClient
2014-12-04 09:42 - 2014-05-19 13:38 - 00000000 ____D () C:\Users\Markus\Desktop\__4 Im Testing
2014-12-03 08:19 - 2012-09-06 08:08 - 00000000 ____D () C:\Users\Markus\AppData\Local\Microsoft Help
2014-11-28 09:14 - 2013-04-25 18:15 - 3346800030 ____N () C:\Windows\MEMORY.DMP
2014-11-28 09:14 - 2013-04-25 18:15 - 00000000 ____D () C:\Windows\Minidump
2014-11-27 16:12 - 2014-02-12 16:46 - 00003608 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1484493839-596051297-3328508428-1015
2014-11-27 14:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-25 17:49 - 2013-09-23 18:55 - 00000000 ____D () C:\Users\Markus\Desktop\Produkt_Projekte
Some content of TEMP:
====================
C:\Users\mduus\AppData\Local\Temp\Quarantine.exe
C:\Users\mduus\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-16 12:42
==================== End Of Log ============================
Hoffe das das Problem ist damit gelöst. Danke für die gute Unterstützung! Beste Grüße Markus |
|
23.12.2014, 18:06
| #8 |
| /// the machine /// TB-Ausbilder | Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr Java und Flash updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\Installer\MSI5ADA.tmp-
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Tcpip\..\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: [NameServer] 8.8.8.8,8.8.8.8
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.12.2014, 22:38
| #9 |
| | Last step to clean? Hallo "Schrauber", erst einmal herzlichen Dank für die super schnelle und fachkundige Unterstützung!!! Hier noch das Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-12-2014
Ran by stcadmin at 2014-12-23 22:14:16 Run:1
Running from C:\Users\stcadmin\Desktop
Loaded Profiles: UpdatusUser & stcadmin (Available profiles: mduus & UpdatusUser & Markus & stcadmin & Administrator)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Windows\Installer\MSI5ADA.tmp-
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Tcpip\..\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}: [NameServer] 8.8.8.8,8.8.8.8
Emptytemp:
*****************
"C:\Windows\Installer\MSI5ADA.tmp-" directory move:
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\CustomAction.config" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\MACTrackBarLib.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Deployment.WindowsInstaller.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Practices.EnterpriseLibrary.Common.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Practices.EnterpriseLibrary.Logging.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Microsoft.Practices.ObjectBuilder.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\RegAsm.exe" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.GUI.Controls.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.GUI.Docking.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.BusinessEntities.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.EventManager.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.Plugins.Base.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.Plugins.DefaultBrowser.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.Plugins.ShareManagerLocalPlugin.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Infrastructure.Utilities.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Personalization.BusinessEntities.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Personalization.BusinessLogic.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Personalization.Common.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Personalization.Settings.PersonalizationSettingsManager.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Personalization.Settings.UserSettingsManager.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.BrowserHelperUtils.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.XmlSerializers.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.LanguageSettings.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.ProcessDownMonitor.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.ProductsRemovalLibary.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.ShortcutsLibrary.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.SideBySide.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.SocialNetsSharer.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.Translations.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.UninstallScreen.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-\Smartbar.Resources.Utilities.dll" => Scheduled to move on reboot.
Could not move "C:\Windows\Installer\MSI5ADA.tmp-" directory. => Scheduled to move on reboot.
HKU\S-1-5-21-1484493839-596051297-3328508428-1000\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2AB3835E-72F1-40E1-9350-BDA5CD046F9F}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3C7693E5-2E96-418B-8343-85F6CB8A8519}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4C5318AB-3562-493F-A099-6E479F4CA40E}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{54BBB2ED-58E0-4D5D-BDCD-BDD8F538AB6F}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{63A7092C-EDF1-4C76-AD89-FA0C6394FBFA}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{648D702C-7471-42B5-8226-908D05AB05DE}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B5D5DC9C-F9B0-4736-8B08-C879B27B887C}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F943B3A8-7939-44C7-A1E6-54B07CDF2000}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FD441542-FC23-4B04-BE6A-35CD0C55F769}\\NameServer => Value could not be deleted.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FDF2BE7A-7E33-41F2-AA6F-37E2A00C761A}\\NameServer => Value could not be deleted.
EmptyTemp: => Removed 38.7 MB temporary data.
Bekommen wir das mit der Blokade von Applikationen wegen der ... Gruppenrichtlinie noch hin, oder ist das eben so wegen der neuen Win Updates? Beste Grüße und ein schönes Weihnachten!! Feedback kommt noch ;-) Markus |
|
24.12.2014, 18:23
| #10 |
| /// the machine /// TB-Ausbilder | Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr was genau wird noch blockiert?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Komisches Verhalten bei Programstart + IExplorer und Mozilla springen auf nicht gewählte Seiten + Meldung "Diese Programm wurde durch ein Gr |
| adware, antivir, avira, browser, cpu, ebanking, failed, fehler, flash player, google, hacken, kaspersky, linkury, mozilla, officejet, programm, realtek, refresh, registry, robot, rundll, scan, security, sekunden, software, starmoney, super, svchost.exe, synology, trojaner, usb, warnung, windows |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
