| |
| |||||||
Log-Analyse und Auswertung: Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.01.2015, 18:56
| #1 |
 |  Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Hallo ! Frohes neues Jahr noch ! Habe am Sonntag routinemäßig den AVIRA PC Cleaner laufen lassen. Es wurde dabei folgende Schadsoftware gefunden: TR/Trustezeb.145408 Der AVIRA PC Cleaner kann die Datei nicht löschen und Norton hat diese beim Scannen erst gar nicht erkannt. Habe dann den Adwarecleaner laufen lassen. Dieser hat auch eine Datei erkannt und gelöscht. Danach hat der PC Cleaner auch nichts mehr gefunden. Ist wirklich alles weg ? Anbei die Logs, wie von euch "gewünscht": AdwCleaner R12.txt Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 04/01/2015 um 18:40:09
# Aktualisiert 21/12/2014 von Xplode
# Database : 2015-01-03.1 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Volker - PCSPITZBODEN
# Gestartet von : C:\Users\Volker\Downloads\adwcleaner_4.106.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\searchplugins\safesearch.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0.5 (x86 de)
[k4takz5s.default] - Zeile gefunden : user_pref("keyword.URL", "hxxp://nortonsafe.search.ask.com/web?o=APN10506&gct=kwd&qsrc=2869&l=dis&prt=NIS&chn=retail&geo=GB&ver=21&q=");
*************************
AdwCleaner[R0].txt - [14424 octets] - [14/12/2013 15:25:08]
AdwCleaner[R10].txt - [5757 octets] - [01/11/2014 23:34:59]
AdwCleaner[R11].txt - [1971 octets] - [02/11/2014 00:38:47]
AdwCleaner[R12].txt - [2508 octets] - [04/01/2015 18:40:09]
AdwCleaner[R1].txt - [19442 octets] - [07/01/2014 20:56:31]
AdwCleaner[R2].txt - [19503 octets] - [07/01/2014 21:05:58]
AdwCleaner[R3].txt - [19564 octets] - [07/01/2014 21:12:01]
AdwCleaner[R4].txt - [1150 octets] - [07/01/2014 22:19:34]
AdwCleaner[R5].txt - [1271 octets] - [08/01/2014 19:37:09]
AdwCleaner[R6].txt - [1391 octets] - [10/01/2014 00:41:12]
AdwCleaner[R7].txt - [1511 octets] - [10/01/2014 23:15:19]
AdwCleaner[R8].txt - [1690 octets] - [21/01/2014 18:57:06]
AdwCleaner[R9].txt - [1757 octets] - [24/01/2014 14:48:36]
AdwCleaner[S0].txt - [16947 octets] - [07/01/2014 21:12:29]
AdwCleaner[S1].txt - [1212 octets] - [07/01/2014 22:20:05]
AdwCleaner[S2].txt - [1332 octets] - [08/01/2014 19:37:55]
AdwCleaner[S3].txt - [1452 octets] - [10/01/2014 00:41:29]
AdwCleaner[S4].txt - [1572 octets] - [10/01/2014 23:15:35]
AdwCleaner[S5].txt - [1753 octets] - [21/01/2014 18:57:43]
AdwCleaner[S6].txt - [1818 octets] - [24/01/2014 14:48:59]
AdwCleaner[S7].txt - [5565 octets] - [01/11/2014 23:36:45]
AdwCleaner[S8].txt - [2024 octets] - [02/11/2014 00:41:42]
########## EOF - C:\AdwCleaner\AdwCleaner[R12].txt - [3653 octets] ##########
Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 04/01/2015 um 18:41:33
# Aktualisiert 21/12/2014 von Xplode
# Database : 2015-01-03.1 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Volker - PCSPITZBODEN
# Gestartet von : C:\Users\Volker\Downloads\adwcleaner_4.106.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gelöscht : C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\searchplugins\safesearch.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0.5 (x86 de)
[k4takz5s.default\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://nortonsafe.search.ask.com/web?o=APN10506&gct=kwd&qsrc=2869&l=dis&prt=NIS&chn=retail&geo=GB&ver=21&q=");
*************************
AdwCleaner[R0].txt - [14424 octets] - [14/12/2013 15:25:08]
AdwCleaner[R10].txt - [5757 octets] - [01/11/2014 23:34:59]
AdwCleaner[R11].txt - [1971 octets] - [02/11/2014 00:38:47]
AdwCleaner[R12].txt - [3750 octets] - [04/01/2015 18:40:09]
AdwCleaner[R1].txt - [19442 octets] - [07/01/2014 20:56:31]
AdwCleaner[R2].txt - [19503 octets] - [07/01/2014 21:05:58]
AdwCleaner[R3].txt - [19564 octets] - [07/01/2014 21:12:01]
AdwCleaner[R4].txt - [1150 octets] - [07/01/2014 22:19:34]
AdwCleaner[R5].txt - [1271 octets] - [08/01/2014 19:37:09]
AdwCleaner[R6].txt - [1391 octets] - [10/01/2014 00:41:12]
AdwCleaner[R7].txt - [1511 octets] - [10/01/2014 23:15:19]
AdwCleaner[R8].txt - [1690 octets] - [21/01/2014 18:57:06]
AdwCleaner[R9].txt - [1757 octets] - [24/01/2014 14:48:36]
AdwCleaner[S0].txt - [16947 octets] - [07/01/2014 21:12:29]
AdwCleaner[S1].txt - [1212 octets] - [07/01/2014 22:20:05]
AdwCleaner[S2].txt - [1332 octets] - [08/01/2014 19:37:55]
AdwCleaner[S3].txt - [1452 octets] - [10/01/2014 00:41:29]
AdwCleaner[S4].txt - [1572 octets] - [10/01/2014 23:15:35]
AdwCleaner[S5].txt - [1753 octets] - [21/01/2014 18:57:43]
AdwCleaner[S6].txt - [1818 octets] - [24/01/2014 14:48:59]
AdwCleaner[S7].txt - [5565 octets] - [01/11/2014 23:36:45]
AdwCleaner[S8].txt - [2024 octets] - [02/11/2014 00:41:42]
AdwCleaner[S9].txt - [3663 octets] - [04/01/2015 18:41:33]
########## EOF - C:\AdwCleaner\AdwCleaner[S9].txt - [3723 octets] ##########
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:38 on 05/01/2015 (Volker)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-05 17:56:38
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST1000NM0011 rev.SN03 931.51GB
Running: Gmer-19357.exe; Driver: C:\Users\Volker\AppData\Local\Temp\pwriifoc.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8bc8c169a 4 bytes [8C, BC, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8bc8c16a2 4 bytes [8C, BC, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8bc8c181a 4 bytes [8C, BC, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8bc8c1832 4 bytes [8C, BC, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff896131f6a 4 bytes [13, 96, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[1808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff896131f82 4 bytes [13, 96, F8, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [616:1640] fffff960009a8b90
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{ECD9A8B4-6E82-4FD5-B233-420EE94D476D}\Connection@Name isatap.fritz.box
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1300218819
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{ECD9A8B4-6E82-4FD5-B233-420EE94D476D}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{ECD9A8B4-6E82-4FD5-B233-420EE94D476D}@DefunctTimestamp 0x3F 0xB5 0x6B 0x54 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 15427
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 4082
Reg HKLM\SYSTEM\CurrentControlSet\Services\SRTSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\SRTSP
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2015
Ran by Volker (administrator) on PCSPITZBODEN on 05-01-2015 17:40:22
Running from C:\Users\Volker\Downloads
Loaded Profile: Volker (Available profiles: Volker)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-15] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1840720 2007-04-04] (CANON INC.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe [8925504 2014-10-15] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55360 2013-11-12] (Raptr, Inc)
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Personal ID] => C:\coolspot AG\Personal ID\pid.exe [1134008 2009-03-04] (coolspot AG, Düsseldorf)
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Amazon Music] => C:\Users\Volker\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-12-08] ()
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-29] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.uk.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Handler-x32: osf-roaming - {C57E9882-B128-4E07-BA2D-FF83B8989C76} - C:\Users\Volker\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default
FF SearchEngineOrder.1: foxsearch
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Office Launcher - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\officelaunch@microsoft.com [2013-03-24]
FF Extension: Garmin Communicator - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-20]
FF Extension: Adblock Plus - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn [2015-01-05]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-24]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-24]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe [707888 2014-10-15] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\IPSDefs\20150102.001\IDSvia64.sys [637656 2014-11-18] (Symantec Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-17] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\VirusDefs\20150104.024\ENG64.SYS [129752 2014-08-24] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\VirusDefs\20150104.024\EX64.SYS [2137304 2014-08-24] (Symantec Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [47632 2010-01-27] (CACE Technologies, Inc.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [129856 2012-10-20] (Ray Hinchliffe)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1506000.020\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [389240 2014-07-10] (BitDefender S.R.L.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-05 17:40 - 2015-01-05 17:40 - 00015820 _____ () C:\Users\Volker\Downloads\FRST.txt
2015-01-05 17:39 - 2015-01-05 17:39 - 00000000 ____D () C:\Users\Volker\Downloads\FRST-OlderVersion
2015-01-05 17:39 - 2015-01-05 17:38 - 00000474 _____ () C:\Users\Volker\Desktop\defogger_disable.log
2015-01-05 17:38 - 2015-01-05 17:38 - 00000474 _____ () C:\Users\Volker\Downloads\defogger_disable.log
2015-01-04 19:30 - 2015-01-05 15:24 - 00002090 _____ () C:\Users\Volker\Desktop\Entfernen des Avira PC Cleaners.lnk
2015-01-04 19:30 - 2015-01-05 15:24 - 00002034 _____ () C:\Users\Volker\Desktop\Avira PC Cleaner.lnk
2015-01-04 19:16 - 2015-01-05 16:15 - 00089976 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-04 18:44 - 2015-01-04 18:44 - 00003819 _____ () C:\Users\Volker\Desktop\AdwCleaner[S9].txt
2015-01-04 18:42 - 2015-01-04 18:42 - 00000602 _____ () C:\WINDOWS\PFRO.log
2015-01-04 18:41 - 2015-01-04 18:41 - 00003750 _____ () C:\Users\Volker\Desktop\AdwCleaner[R12].txt
2015-01-04 18:39 - 2015-01-04 18:39 - 02173952 _____ () C:\Users\Volker\Downloads\adwcleaner_4.106.exe
2014-12-30 00:14 - 2014-12-30 21:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-12-29 22:59 - 2014-12-29 22:59 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-25 13:55 - 2014-12-25 14:20 - 00000000 ____D () C:\Users\Volker\Downloads\USA 2015
2014-12-11 17:55 - 2014-12-11 17:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-11 17:11 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 17:11 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-09 21:57 - 2014-12-09 21:57 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-09 21:05 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-09 21:05 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-09 20:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-09 20:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-09 20:35 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-09 20:35 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-09 20:35 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-09 20:35 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-09 20:35 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-09 20:35 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-09 20:35 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-09 20:35 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-09 20:35 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-09 20:35 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-09 20:35 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-09 20:35 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-09 20:35 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-09 20:35 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-09 20:35 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-09 20:35 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-09 20:35 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-09 20:35 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-09 20:35 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-09 20:35 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-09 20:35 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-09 20:35 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-09 20:35 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-09 20:35 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-09 20:35 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-09 20:35 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-09 20:35 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-09 20:35 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-09 20:35 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-09 20:35 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-09 20:35 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-09 20:35 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-09 20:35 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-09 20:35 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-09 20:35 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-09 20:35 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-09 20:35 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-09 20:35 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-09 20:35 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-09 20:35 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-09 20:35 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-09 20:35 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-09 20:35 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-09 20:35 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-09 20:35 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-09 20:35 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-05 17:40 - 2014-11-02 16:55 - 00000000 ____D () C:\FRST
2015-01-05 17:39 - 2014-11-02 16:54 - 02123776 _____ (Farbar) C:\Users\Volker\Downloads\FRST64.exe
2015-01-05 17:37 - 2013-03-19 19:16 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-05 16:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-05 15:31 - 2013-12-03 21:45 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F4A79B6B-A380-4C13-9551-5944638F3A99}
2015-01-05 15:23 - 2014-10-03 00:14 - 00002336 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-01-05 15:23 - 2013-11-20 21:00 - 00000000 __RDO () C:\Users\Volker\SkyDrive
2015-01-05 15:23 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-04 19:18 - 2013-03-21 21:46 - 00000000 ____D () C:\Users\Volker\AppData\Local\CrashDumps
2015-01-04 19:17 - 2013-04-26 15:08 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-01-04 18:41 - 2013-12-14 15:24 - 00000000 ____D () C:\AdwCleaner
2015-01-04 18:41 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-04 18:38 - 2013-11-20 22:11 - 01536512 ___SH () C:\Users\Volker\Downloads\Thumbs.db
2015-01-04 18:33 - 2013-09-30 05:14 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-04 18:33 - 2013-09-30 04:56 - 00765378 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-04 18:33 - 2013-09-30 04:56 - 00159696 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-04 18:28 - 2013-03-19 17:00 - 01262080 ___SH () C:\Users\Volker\Desktop\Thumbs.db
2015-01-04 18:09 - 2014-01-07 18:00 - 00000000 ____D () C:\Users\Volker\AppData\Local\NPE
2015-01-04 18:07 - 2014-10-02 23:56 - 00000000 ____D () C:\NPE
2015-01-04 16:07 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-04 16:03 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-03 00:10 - 2013-03-19 17:32 - 00000000 ____D () C:\Users\Volker\AppData\Roaming\vlc
2015-01-02 23:39 - 2014-07-18 22:30 - 00000000 ____D () C:\Users\Volker\Downloads\WM 2014
2014-12-31 12:18 - 2013-03-14 20:00 - 00000000 ____D () C:\Users\Volker\AppData\Local\Thunderbird
2014-12-30 22:58 - 2013-03-14 19:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-27 11:13 - 2014-05-12 16:06 - 00000000 ____D () C:\Users\Volker\Documents\DVDVideoSoft
2014-12-21 16:58 - 2013-03-14 18:42 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-727225698-2809878298-2680435891-1001
2014-12-20 23:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-20 23:53 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 21:50 - 2014-06-26 23:12 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-17 17:55 - 2014-06-26 23:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-14 14:15 - 2014-09-24 21:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-14 14:15 - 2014-09-24 21:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-14 13:09 - 2014-08-07 21:43 - 00001249 _____ () C:\Users\Volker\Desktop\Amazon Music.lnk
2014-12-14 12:51 - 2014-09-24 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-13 14:42 - 2014-08-17 11:19 - 00000000 ____D () C:\Users\Volker\AppData\Local\Adobe
2014-12-13 14:41 - 2013-03-19 19:16 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-09 21:57 - 2014-07-12 19:14 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-09 21:57 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-09 21:57 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2014-12-09 21:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-09 21:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 21:16 - 2013-08-13 18:47 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-09 21:16 - 2013-02-19 10:34 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-09 20:34 - 2013-02-19 11:34 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-06 22:58 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-12-06 11:57 - 2014-06-26 23:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-12-06 11:57 - 2014-01-21 19:23 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
Some content of TEMP:
====================
C:\Users\Volker\AppData\Local\Temp\Quarantine.exe
C:\Users\Volker\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-05 16:02
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Volker at 2014-11-03 22:46:09
Running from C:\Users\Volker\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Norton 360 (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Ad-Aware Antivirus (HKLM\...\{6D1428BD-E5F2-4378-B620-E7442E7C2BFB}_AdAwareUpdater) (Version: 11.4.6792.0 - Lavasoft)
AdAwareInstaller (Version: 11.4.6792.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.4.6792.0 - Lavasoft) Hidden
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.6.0.671 - Amazon Services LLC)
AMD Catalyst Install Manager (HKLM\...\{4ED88849-15C4-39B7-4238-24FEE1F82E9F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
AntimalwareEngine (Version: 3.0.0.56 - Lavasoft) Hidden
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon iP4500 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series) (Version: - )
Canon iP4500 series Benutzerregistrierung (HKLM-x32\...\Canon iP4500 series Benutzerregistrierung) (Version: - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Galería de fotos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6010.0727 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.6.0.32 - Symantec Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Personal ID (HKLM-x32\...\{F722209B-739E-40E4-ADB1-062BD032A0DB}) (Version: 1.8.5 - coolspot AG)
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Raptr (HKLM-x32\...\Raptr) (Version: - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
SonyEditor (remove only) (HKLM-x32\...\SonyEditor) (Version: - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinPcap 4.1.1 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.1753 - CACE Technologies)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{7843D2B1-4B7C-499B-882E-3692B166B514}) (Version: 21.00.8480 - Buhl Data Service GmbH)
xp-AntiSpy 3.98-2 (HKLM-x32\...\xp-AntiSpy) (Version: - Christian Taubenheim)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-727225698-2809878298-2680435891-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Volker\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-727225698-2809878298-2680435891-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Volker\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-727225698-2809878298-2680435891-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Volker\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-727225698-2809878298-2680435891-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Volker\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
11-10-2014 13:33:01 Geplanter Prüfpunkt
18-10-2014 14:19:33 AA11
28-10-2014 20:27:15 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {086D1537-692D-4265-9DD7-5E178E04B5A8} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {30F39754-AD3C-434A-81D8-48F0BCA2240D} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {419B9F9C-996A-48F2-876D-6064948380E8} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {4952106D-256A-48C8-9E37-9AA6F2E7A42D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {7339C1F1-FFCE-43E9-BDA8-3AA53A82AD79} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {742BB20C-BC51-4467-99B8-A2BF2FC7ABF9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-10-18] (Microsoft Corporation)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {816D9B42-13C3-4453-80F9-8249C2EA090C} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {976D9522-43BD-44DF-B58F-229FEBC88582} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {9C51591B-548B-4A1D-BCCE-2F4839A9D2D7} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A43F775D-D603-45E2-9EEF-6B6BFE636B82} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-20] (Adobe Systems Incorporated)
Task: {C518977D-F826-4707-B9F5-24B384349BE1} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {D8A35F3D-0BC6-44E5-8D44-661E5FAD25E2} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {D9549B4C-E877-49E0-B4F8-50AC8C07D531} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E13AF151-B273-4248-9F02-30643D7A0A2B} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {E7954165-8B0C-4258-8B54-DDA1666ECAF8} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {F28448F8-EB9A-4B1B-BFDE-7D28FDDBC158} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {F5E721C7-5911-4413-B08C-CEDDD343E8DA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-23] (Piriform Ltd)
Task: {FA675BC9-3CEB-474F-8189-2507E1A993F3} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-04-26 15:08 - 2010-04-05 20:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2014-10-15 12:37 - 2014-10-15 12:37 - 00707888 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
2014-10-15 13:03 - 2014-10-15 13:03 - 00103768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_thread-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00024408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_system-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00055648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_date_time-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00123744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_filesystem-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00033624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_chrono-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 12459344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareServiceKernel.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 03396400 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\RCF.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00788824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_regex-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00734536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareActivation.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 02185560 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareApplicationUpdater.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00813896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareGamingMode.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00098624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareReset.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00120128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTime.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00952152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareDefinitionsUpdater.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00869224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01108808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareIgnoreList.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00250696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareQuarantine.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00989016 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiMalwareEngine.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00212824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiRootkitEngine.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01172816 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScannerHistory.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01281344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScanner.dll
2014-10-15 13:04 - 2014-10-15 13:04 - 00035160 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_timer-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00976728 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScannerScheduler.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01092440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareRealTimeProtection.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00229200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareIncompatibles.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00893768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiSpam.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00845136 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiPhishing.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 03096912 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareParentalControl.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 02887504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareWebProtection.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01067344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareEmailProtection.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01290584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareNetworkProtection.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01004352 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwarePromo.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00343880 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareFeedback.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 02787160 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareThreatWorkAlliance.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01264960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwarePinCode.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01004864 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareNotice.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00957256 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAvcEngine.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 01179496 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareRealTimeProtectionHistory.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00154944 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\SecurityCenter.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 02753360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareShellExtension.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 08925504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe
2014-10-15 13:03 - 2014-10-15 13:03 - 00500056 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_locale-vc100-mt-1_55.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 02132800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\HtmlFramework.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00066872 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\DllStorage.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00869712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTrayDefaultSkin.dll
2014-10-15 13:03 - 2014-10-15 13:03 - 00811328 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\Localization.dll
2014-08-07 21:42 - 2014-10-15 06:35 - 06281024 _____ () C:\Users\Volker\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-10-23 20:19 - 2014-10-23 20:19 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-11-02 15:56 - 2014-11-02 15:56 - 00050477 _____ () C:\Users\Volker\Downloads\Defogger.exe
2014-01-08 18:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-01-08 18:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-01-08 18:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-01-08 18:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-01-08 18:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-03-13 11:15 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Volker\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKCU\...\StartupApproved\Run: => "GarminExpressTrayApp"
HKCU\...\StartupApproved\Run: => "Personal ID"
HKCU\...\StartupApproved\Run: => "Raptr"
========================= Accounts: ==========================
Administrator (S-1-5-21-727225698-2809878298-2680435891-500 - Administrator - Disabled)
Gast (S-1-5-21-727225698-2809878298-2680435891-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-727225698-2809878298-2680435891-1005 - Limited - Enabled)
Volker (S-1-5-21-727225698-2809878298-2680435891-1001 - Administrator - Enabled) => C:\Users\Volker
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/03/2014 09:52:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/03/2014 09:52:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/02/2014 04:49:00 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database
Error: (11/02/2014 03:49:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/02/2014 03:49:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/02/2014 11:57:51 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/02/2014 11:57:51 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/02/2014 00:45:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.6.0.1030, Zeitstempel: 0x5042b0f0
Name des fehlerhaften Moduls: IAStorUtil.ni.dll, Version: 11.6.0.1030, Zeitstempel: 0x5042b0eb
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002f3fd
ID des fehlerhaften Prozesses: 0x1698
Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0
Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1
Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2
Berichtskennung: IAStorDataMgrSvc.exe3
Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5
Error: (11/02/2014 00:45:25 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: IAStorDataMgrSvc.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges()
bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState()
bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (11/02/2014 00:43:34 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (11/03/2014 10:04:13 PM) (Source: SRTSP) (EventID: 4) (User: )
Description: Error loading virus definitions.
Error: (11/02/2014 00:45:30 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/02/2014 00:43:22 AM) (Source: DCOM) (EventID: 10016) (User: PCSPITZBODEN)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}PCSpitzbodenVolkerS-1-5-21-727225698-2809878298-2680435891-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/02/2014 00:43:22 AM) (Source: DCOM) (EventID: 10016) (User: PCSPITZBODEN)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}PCSpitzbodenVolkerS-1-5-21-727225698-2809878298-2680435891-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/02/2014 00:22:31 AM) (Source: DCOM) (EventID: 10001) (User: PCSPITZBODEN)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server15612Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar
Error: (11/02/2014 00:22:31 AM) (Source: DCOM) (EventID: 10001) (User: PCSPITZBODEN)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server15612Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar
Error: (11/01/2014 11:52:31 PM) (Source: DCOM) (EventID: 10001) (User: PCSPITZBODEN)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server15612Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar
Error: (11/01/2014 11:52:31 PM) (Source: DCOM) (EventID: 10001) (User: PCSPITZBODEN)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server15612Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar
Error: (11/01/2014 11:40:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/01/2014 11:38:43 PM) (Source: DCOM) (EventID: 10001) (User: PCSPITZBODEN)
Description: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server15612Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mcaNicht verfügbarNicht verfügbar
Microsoft Office Sessions:
=========================
Error: (11/03/2014 09:52:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/03/2014 09:52:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/02/2014 04:49:00 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883
Error: (11/02/2014 03:49:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/02/2014 03:49:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/02/2014 11:57:51 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/02/2014 11:57:51 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (11/02/2014 00:45:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: IAStorDataMgrSvc.exe11.6.0.10305042b0f0IAStorUtil.ni.dll11.6.0.10305042b0ebc00000050002f3fd169801cff62de6cc8080C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeC:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\b6657f01c735ef1fe7a652ab2d424b74\IAStorUtil.ni.dll26e0abb7-6221-11e4-bed1-902b349c8ab6
Error: (11/02/2014 00:45:25 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: IAStorDataMgrSvc.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges()
bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState()
bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (11/02/2014 00:43:34 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3570 CPU @ 3.40GHz
Percentage of memory in use: 20%
Total physical RAM: 16331.27 MB
Available physical RAM: 12963.79 MB
Total Pagefile: 18763.27 MB
Available Pagefile: 15402.12 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:913.17 GB) (Free:712.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 64FE36FC)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=913.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=18 GB) - (Type=27)
==================== End Of Log ============================
Danke ! Folka |
|
05.01.2015, 19:06
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen hi,
__________________Logfile von Avira?
__________________ |
|
05.01.2015, 22:03
| #3 |
| | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Ist dies die logfile ?
__________________Code:
ATTFilter 05.01.2015, 20:33:18 [INFO] Working directory: C:\Users\Volker\AppData\Local\Temp\cleaner
05.01.2015, 20:33:18 [INFO] Temporary directory: C:\Users\Volker\AppData\Local\Temp\cleaner\pccleaner
05.01.2015, 20:33:18 [INFO] LoaderControlFile C:\Users\Volker\AppData\Local\Temp\cleaner\loadercontrol.xml successfully loaded
05.01.2015, 20:33:18 [INFO] CMDLINE: GUI Mode is activated
05.01.2015, 20:33:18 [INFO] CMDLINE: No welcome dialog will be shown
05.01.2015, 20:33:18 [INFO] CMDLINE: Temporary downloaded files will not be deleted
05.01.2015, 20:33:18 [INFO] Product PCCL chosen from LoaderControlFile.
05.01.2015, 20:33:18 [INFO] GUI plugin C:\Users\Volker\AppData\Local\Temp\cleaner\avwebloaderGUI.dll successfully loaded
05.01.2015, 20:33:18 [INFO] Language resource C:\Users\Volker\AppData\Local\Temp\cleaner\rcnwload.dll successfully loaded
05.01.2015, 20:33:18 [INFO] Product type: PCCL, language: de choosen to download
05.01.2015, 20:33:18 [INFO] Initialising update data
05.01.2015, 20:33:18 [INFO] Loading update library C:\Users\Volker\AppData\Local\Temp\cleaner\update.dll
05.01.2015, 20:33:18 [INFO] Using Windows system proxy settings
05.01.2015, 20:33:18 [INFO] Checking Internet connection...
05.01.2015, 20:33:20 [INFO] Host hxxp://personal.avira-update.com/update is reachable -> Internet connection check successful
05.01.2015, 20:33:20 [INFO] Update servers: hxxp://personal.avira-update.com/update , hxxp://personal.avira-update.net/update
05.01.2015, 20:33:20 [INFO] Downloading mapping file
05.01.2015, 20:33:20 [INFO] Downloading mapping file from /pccleaner/win32/de/map-pccleaner.xml.gz to C:\Users\Volker\AppData\Local\Temp\cleaner\pccleaner\mapfile.xml.gz
05.01.2015, 20:33:20 [INFO] Connected with update server hxxp://2.16.100.48/update
05.01.2015, 20:33:22 [INFO] File C:\Users\Volker\AppData\Local\Temp\cleaner\pccleaner\mapfile.xml.gz downloaded
05.01.2015, 20:33:22 [INFO] Mapping file successfully downloaded
05.01.2015, 20:33:22 [INFO] Mapping file successfully loaded
05.01.2015, 20:33:22 [INFO] Starting to download product files
05.01.2015, 20:33:22 [INFO] Connected with update server hxxp://2.16.100.48/update
05.01.2015, 20:33:25 [INFO] Product files will be downloaded
05.01.2015, 20:33:25 [INFO] Download successfully finished
05.01.2015, 20:33:25 [INFO] Starting to copy product files
05.01.2015, 20:33:25 [INFO] Product files successfully copied
05.01.2015, 20:33:25 [INFO] Download folder deleted
05.01.2015, 20:33:25 [WARNING] GUI Plugin has been cancelled by user
Code:
ATTFilter
Avira PC Cleaner
Erstellungsdatum der Reportdatei: 05 January 2015 19:40
Es wird nach 7856354 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : PC-Cleaner
Seriennummer : 2228416265-DECLE-0000001
Plattform : Windows 8.1
Windowsversion : (plain) [6.2.9200]
Boot Modus : Normal gebootet
Benutzername : Volker
Computername : PCSPITZBODEN
Versionsinformationen:
BUILD.DAT : 1.0.0.188 6233 Bytes 07.04.2014 13:37:00
AVSCAN.EXE : 1.0.0.32 821816 Bytes 04.01.2015 17:45:37
AVSCANRC.DLL : 1.0.0.188 61008 Bytes 04.01.2015 17:45:37
LUKE.DLL : 12.1.0.17 68304 Bytes 04.01.2015 17:45:26
AVSCPLR.DLL : 1.0.0.188 96336 Bytes 04.01.2015 17:45:37
AVREG.DLL : 12.1.0.20 227024 Bytes 04.01.2015 17:45:24
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:47:28
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 17:47:33
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 17:47:38
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 17:47:41
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 17:47:47
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 17:47:58
VBASE006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 17:48:28
VBASE007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 17:49:54
VBASE008.VDF : 7.11.165.166 4050944 Bytes 07.08.2014 17:50:02
VBASE009.VDF : 7.11.178.10 3456000 Bytes 14.10.2014 17:50:09
VBASE010.VDF : 7.11.190.10 3786240 Bytes 03.12.2014 17:50:15
VBASE011.VDF : 7.11.190.11 2048 Bytes 03.12.2014 17:50:15
VBASE012.VDF : 7.11.190.12 2048 Bytes 03.12.2014 17:50:15
VBASE013.VDF : 7.11.192.218 134656 Bytes 05.12.2014 17:50:15
VBASE014.VDF : 7.11.193.81 140288 Bytes 08.12.2014 17:50:15
VBASE015.VDF : 7.11.193.219 325120 Bytes 10.12.2014 17:50:16
VBASE016.VDF : 7.11.194.77 116736 Bytes 11.12.2014 17:50:18
VBASE017.VDF : 7.11.194.197 199680 Bytes 12.12.2014 17:50:18
VBASE018.VDF : 7.11.197.86 949760 Bytes 23.12.2014 17:50:20
VBASE019.VDF : 7.11.197.177 164864 Bytes 25.12.2014 17:50:20
VBASE020.VDF : 7.11.197.251 117248 Bytes 26.12.2014 17:50:20
VBASE021.VDF : 7.11.198.59 145920 Bytes 27.12.2014 17:50:21
VBASE022.VDF : 7.11.198.117 199680 Bytes 29.12.2014 17:50:21
VBASE023.VDF : 7.11.198.201 258560 Bytes 31.12.2014 17:50:21
VBASE024.VDF : 7.11.198.255 182784 Bytes 02.01.2015 17:50:22
VBASE025.VDF : 7.11.199.51 148480 Bytes 03.01.2015 17:50:22
VBASE026.VDF : 7.11.199.97 142848 Bytes 04.01.2015 17:50:22
VBASE027.VDF : 7.11.199.98 2048 Bytes 04.01.2015 17:50:22
VBASE028.VDF : 7.11.199.99 2048 Bytes 04.01.2015 17:50:22
VBASE029.VDF : 7.11.199.100 2048 Bytes 04.01.2015 17:50:22
VBASE030.VDF : 7.11.199.101 2048 Bytes 04.01.2015 17:50:22
VBASE031.VDF : 7.11.199.148 422912 Bytes 05.01.2015 18:40:31
Engineversion : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 04.01.2015 17:45:20
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 04.01.2015 17:45:20
AESCN.DLL : 8.3.2.2 139456 Bytes 04.01.2015 17:45:19
AESBX.DLL : 8.2.20.24 1409224 Bytes 04.01.2015 17:45:21
AERDL.DLL : 8.2.1.16 743328 Bytes 04.01.2015 17:45:19
AEPACK.DLL : 8.4.0.56 789360 Bytes 04.01.2015 17:45:19
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 04.01.2015 17:45:18
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 04.01.2015 17:45:23
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 04.01.2015 17:45:18
AEHELP.DLL : 8.3.1.0 278728 Bytes 04.01.2015 17:45:13
AEGEN.DLL : 8.1.7.40 456608 Bytes 04.01.2015 17:45:13
AEEXP.DLL : 8.4.2.48 252776 Bytes 04.01.2015 17:45:21
AEEMU.DLL : 8.1.3.4 399264 Bytes 04.01.2015 17:45:12
AEDROID.DLL : 8.4.3.6 850800 Bytes 04.01.2015 17:45:22
AECORE.DLL : 8.3.4.0 243624 Bytes 04.01.2015 17:45:12
AEBB.DLL : 8.1.2.0 60448 Bytes 04.01.2015 17:45:12
AVWINLL.DLL : 12.1.0.17 27344 Bytes 04.01.2015 17:45:25
AVPREF.DLL : 12.1.0.17 51920 Bytes 04.01.2015 17:45:24
AVREP.DLL : 12.1.0.17 179408 Bytes 04.01.2015 17:45:24
AVARKT.DLL : Keine Information!
SQLITE3.DLL : 3.7.0.0 398288 Bytes 04.01.2015 17:45:34
AVSMTP.DLL : Keine Information!
NETNT.DLL : Keine Information!
RCIMAGE.DLL : 1.0.0.160 112720 Bytes 04.01.2015 17:45:37
RCTEXT.DLL : 1.0.0.164 405584 Bytes 04.01.2015 17:45:38
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: unknown
Konfigurationsdatei...................: C:\Users\Volker\AppData\Local\Temp\cleaner\pccleaner\setup\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: löschen
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: 05 January 2015 19:40
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'Cleaner.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'avwebloader.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'thunderbird.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'IntelMeFWService.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWSCSvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDUpdSvc.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'N360.exe' - '136' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDFSSvc.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'N360.exe' - '186' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'IJPLMSVC.EXE' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'Garmin.Cartography.MapUpdate.CoreService.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '0' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Windows>
C:\swapfile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Ende des Suchlaufs: 05 January 2015 20:07
Benötigte Zeit: 26:38 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
34896 Verzeichnisse wurden überprüft
332922 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
332921 Dateien ohne Befall
4532 Archive wurden durchsucht
1 Warnungen
0 Hinweise
|
|
06.01.2015, 11:36
| #4 |
| /// the machine /// TB-Ausbilder | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Ich meine das Log vom Avira PC Cleaner. Ich will wissen wo der was gefunden hat. Der reine Name bringt nix.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.01.2015, 20:48
| #5 |
| | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Hallo ! Ich habe im REPORT-Ordner von Avira keine LOG.Files mehr, die den Fund aufzeigen ! Warum, weiß ich nicht. Ich habe nichts aktiv gelöscht. Muss/kann ich noch woanders nachschauen ? Komme jetzt ein wenig an meine Grenzen. |
|
07.01.2015, 08:51
| #6 | |
| /// the machine /// TB-Ausbilder | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschenZitat:
__________________ --> Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen |
|
07.01.2015, 19:49
| #7 |
| | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Hallo Schrauber ! Danke ! Das sind jetzt alle LOG-Dateien aus dem Ordner vom 04.01.2015...mehr habe ich leider nicht ! Warum auch immer..? Das müßten jedoch schon die Scans n a c h dem Durchlauf von AdWCleaner sein, da das LOG vom AdwCleaner schon von 18:40 Uhr ist, siehe oben. Ich weiß, dass das jetzt keine wirkliche Hilfe ist ! Tut mir leid. Meinst Du, ich bin trotzdem clean ? Gibt es noch Alternativen ? Code:
ATTFilter
Avira PC Cleaner
Erstellungsdatum der Reportdatei: 04 January 2015 18:50
Es wird nach 7849293 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : PC-Cleaner
Seriennummer : 2228416265-DECLE-0000001
Plattform : Windows 8.1
Windowsversion : (plain) [6.2.9200]
Boot Modus : Normal gebootet
Benutzername : Volker
Computername : PCSPITZBODEN
Versionsinformationen:
BUILD.DAT : 1.0.0.188 6233 Bytes 07.04.2014 13:37:00
AVSCAN.EXE : 1.0.0.32 821816 Bytes 04.01.2015 17:45:37
AVSCANRC.DLL : 1.0.0.188 61008 Bytes 04.01.2015 17:45:37
LUKE.DLL : 12.1.0.17 68304 Bytes 04.01.2015 17:45:26
AVSCPLR.DLL : 1.0.0.188 96336 Bytes 04.01.2015 17:45:37
AVREG.DLL : 12.1.0.20 227024 Bytes 04.01.2015 17:45:24
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:47:28
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 17:47:33
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 17:47:38
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 17:47:41
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 17:47:47
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 17:47:58
VBASE006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 17:48:28
VBASE007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 17:49:54
VBASE008.VDF : 7.11.165.166 4050944 Bytes 07.08.2014 17:50:02
VBASE009.VDF : 7.11.178.10 3456000 Bytes 14.10.2014 17:50:09
VBASE010.VDF : 7.11.190.10 3786240 Bytes 03.12.2014 17:50:15
VBASE011.VDF : 7.11.190.11 2048 Bytes 03.12.2014 17:50:15
VBASE012.VDF : 7.11.190.12 2048 Bytes 03.12.2014 17:50:15
VBASE013.VDF : 7.11.192.218 134656 Bytes 05.12.2014 17:50:15
VBASE014.VDF : 7.11.193.81 140288 Bytes 08.12.2014 17:50:15
VBASE015.VDF : 7.11.193.219 325120 Bytes 10.12.2014 17:50:16
VBASE016.VDF : 7.11.194.77 116736 Bytes 11.12.2014 17:50:18
VBASE017.VDF : 7.11.194.197 199680 Bytes 12.12.2014 17:50:18
VBASE018.VDF : 7.11.197.86 949760 Bytes 23.12.2014 17:50:20
VBASE019.VDF : 7.11.197.177 164864 Bytes 25.12.2014 17:50:20
VBASE020.VDF : 7.11.197.251 117248 Bytes 26.12.2014 17:50:20
VBASE021.VDF : 7.11.198.59 145920 Bytes 27.12.2014 17:50:21
VBASE022.VDF : 7.11.198.117 199680 Bytes 29.12.2014 17:50:21
VBASE023.VDF : 7.11.198.201 258560 Bytes 31.12.2014 17:50:21
VBASE024.VDF : 7.11.198.255 182784 Bytes 02.01.2015 17:50:22
VBASE025.VDF : 7.11.199.51 148480 Bytes 03.01.2015 17:50:22
VBASE026.VDF : 7.11.199.97 142848 Bytes 04.01.2015 17:50:22
VBASE027.VDF : 7.11.199.98 2048 Bytes 04.01.2015 17:50:22
VBASE028.VDF : 7.11.199.99 2048 Bytes 04.01.2015 17:50:22
VBASE029.VDF : 7.11.199.100 2048 Bytes 04.01.2015 17:50:22
VBASE030.VDF : 7.11.199.101 2048 Bytes 04.01.2015 17:50:22
VBASE031.VDF : 7.11.199.118 341504 Bytes 04.01.2015 17:50:23
Engineversion : 8.3.28.4
Code:
ATTFilter Avira PC Cleaner
Erstellungsdatum der Reportdatei: 04 January 2015 19:31
Es wird nach 7849293 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : PC-Cleaner
Seriennummer : 2228416265-DECLE-0000001
Plattform : Windows 8.1
Windowsversion : (plain) [6.2.9200]
Boot Modus : Normal gebootet
Benutzername : Volker
Computername : PCSPITZBODEN
Versionsinformationen:
BUILD.DAT : 1.0.0.188 6233 Bytes 07.04.2014 13:37:00
AVSCAN.EXE : 1.0.0.32 821816 Bytes 04.01.2015 17:45:37
AVSCANRC.DLL : 1.0.0.188 61008 Bytes 04.01.2015 17:45:37
LUKE.DLL : 12.1.0.17 68304 Bytes 04.01.2015 17:45:26
AVSCPLR.DLL : 1.0.0.188 96336 Bytes 04.01.2015 17:45:37
AVREG.DLL : 12.1.0.20 227024 Bytes 04.01.2015 17:45:24
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:47:28
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 17:47:33
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 17:47:38
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 17:47:41
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 17:47:47
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 17:47:58
VBASE006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 17:48:28
VBASE007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 17:49:54
VBASE008.VDF : 7.11.165.166 4050944 Bytes 07.08.2014 17:50:02
VBASE009.VDF : 7.11.178.10 3456000 Bytes 14.10.2014 17:50:09
VBASE010.VDF : 7.11.190.10 3786240 Bytes 03.12.2014 17:50:15
VBASE011.VDF : 7.11.190.11 2048 Bytes 03.12.2014 17:50:15
VBASE012.VDF : 7.11.190.12 2048 Bytes 03.12.2014 17:50:15
VBASE013.VDF : 7.11.192.218 134656 Bytes 05.12.2014 17:50:15
VBASE014.VDF : 7.11.193.81 140288 Bytes 08.12.2014 17:50:15
VBASE015.VDF : 7.11.193.219 325120 Bytes 10.12.2014 17:50:16
VBASE016.VDF : 7.11.194.77 116736 Bytes 11.12.2014 17:50:18
VBASE017.VDF : 7.11.194.197 199680 Bytes 12.12.2014 17:50:18
VBASE018.VDF : 7.11.197.86 949760 Bytes 23.12.2014 17:50:20
VBASE019.VDF : 7.11.197.177 164864 Bytes 25.12.2014 17:50:20
VBASE020.VDF : 7.11.197.251 117248 Bytes 26.12.2014 17:50:20
VBASE021.VDF : 7.11.198.59 145920 Bytes 27.12.2014 17:50:21
VBASE022.VDF : 7.11.198.117 199680 Bytes 29.12.2014 17:50:21
VBASE023.VDF : 7.11.198.201 258560 Bytes 31.12.2014 17:50:21
VBASE024.VDF : 7.11.198.255 182784 Bytes 02.01.2015 17:50:22
VBASE025.VDF : 7.11.199.51 148480 Bytes 03.01.2015 17:50:22
VBASE026.VDF : 7.11.199.97 142848 Bytes 04.01.2015 17:50:22
VBASE027.VDF : 7.11.199.98 2048 Bytes 04.01.2015 17:50:22
VBASE028.VDF : 7.11.199.99 2048 Bytes 04.01.2015 17:50:22
VBASE029.VDF : 7.11.199.100 2048 Bytes 04.01.2015 17:50:22
VBASE030.VDF : 7.11.199.101 2048 Bytes 04.01.2015 17:50:22
VBASE031.VDF : 7.11.199.118 341504 Bytes 04.01.2015 17:50:23
Engineversion : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 04.01.2015 17:45:20
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 04.01.2015 17:45:20
AESCN.DLL : 8.3.2.2 139456 Bytes 04.01.2015 17:45:19
AESBX.DLL : 8.2.20.24 1409224 Bytes 04.01.2015 17:45:21
AERDL.DLL : 8.2.1.16 743328 Bytes 04.01.2015 17:45:19
AEPACK.DLL : 8.4.0.56 789360 Bytes 04.01.2015 17:45:19
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 04.01.2015 17:45:18
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 04.01.2015 17:45:23
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 04.01.2015 17:45:18
AEHELP.DLL : 8.3.1.0 278728 Bytes 04.01.2015 17:45:13
AEGEN.DLL : 8.1.7.40 456608 Bytes 04.01.2015 17:45:13
AEEXP.DLL : 8.4.2.48 252776 Bytes 04.01.2015 17:45:21
AEEMU.DLL : 8.1.3.4 399264 Bytes 04.01.2015 17:45:12
AEDROID.DLL : 8.4.3.6 850800 Bytes 04.01.2015 17:45:22
AECORE.DLL : 8.3.4.0 243624 Bytes 04.01.2015 17:45:12
AEBB.DLL : 8.1.2.0 60448 Bytes 04.01.2015 17:45:12
AVWINLL.DLL : 12.1.0.17 27344 Bytes 04.01.2015 17:45:25
AVPREF.DLL : 12.1.0.17 51920 Bytes 04.01.2015 17:45:24
AVREP.DLL : 12.1.0.17 179408 Bytes 04.01.2015 17:45:24
AVARKT.DLL : Keine Information!
SQLITE3.DLL : 3.7.0.0 398288 Bytes 04.01.2015 17:45:34
AVSMTP.DLL : Keine Information!
NETNT.DLL : Keine Information!
RCIMAGE.DLL : 1.0.0.160 112720 Bytes 04.01.2015 17:45:37
RCTEXT.DLL : 1.0.0.164 405584 Bytes 04.01.2015 17:45:38
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: unknown
Konfigurationsdatei...................: C:\Users\Volker\AppData\Local\Temp\cleaner\pccleaner\setup\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: löschen
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: 04 January 2015 19:31
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'Cleaner.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'avwebloader.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'thunderbird.exe' - '127' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNSEMAIN.EXE' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'IntelMeFWService.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWSCSvc.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDUpdSvc.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'N360.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDFSSvc.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'N360.exe' - '174' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'IJPLMSVC.EXE' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'Garmin.Cartography.MapUpdate.CoreService.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '0' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Windows>
C:\swapfile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Ende des Suchlaufs: 04 January 2015 19:52
Benötigte Zeit: 21:20 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
34857 Verzeichnisse wurden überprüft
335776 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
335775 Dateien ohne Befall
5662 Archive wurden durchsucht
1 Warnungen
0 Hinweise
|
|
08.01.2015, 07:18
| #8 |
| /// the machine /// TB-Ausbilder | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Kontrollieren wir mal  Downloade Dir bitte  Malwarebytes Anti-Malware
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.01.2015, 20:27
| #9 |
| | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Guten Abend Schrauber :-) Hier die gewünschten LOGs - Danke und viele Grüße ! Den Virenscanner hatte ich versehentlich nicht deaktiviert; gab jedoch keine Konflikte glücklicherweise... Malwarebytes Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 08/01/2015 Suchlauf-Zeit: 20:03:30 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.08.12 Rootkit Datenbank: v2015.01.07.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Volker Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 340206 Verstrichene Zeit: 7 Min, 21 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Warnen PUM: Warnen Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 x64
Ran by Volker on 08/01/2015 at 20:14:49.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Volker\AppData\Roaming\mozilla\firefox\profiles\k4takz5s.default\minidumps [252 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08/01/2015 at 20:16:26.38
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Volker (administrator) on PCSPITZBODEN on 08-01-2015 20:18:20
Running from C:\Users\Volker\Downloads
Loaded Profile: Volker (Available profiles: Volker)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-05-15] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1840720 2007-04-04] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55360 2013-11-12] (Raptr, Inc)
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Personal ID] => C:\coolspot AG\Personal ID\pid.exe [1134008 2009-03-04] (coolspot AG, Düsseldorf)
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [Amazon Music] => C:\Users\Volker\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-12-08] ()
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-29] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-727225698-2809878298-2680435891-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.uk.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Handler-x32: osf-roaming - {C57E9882-B128-4E07-BA2D-FF83B8989C76} - C:\Users\Volker\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default
FF SearchEngineOrder.1: foxsearch
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Office Launcher - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\officelaunch@microsoft.com [2013-03-24]
FF Extension: Garmin Communicator - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-20]
FF Extension: Adblock Plus - C:\Users\Volker\AppData\Roaming\Mozilla\Firefox\Profiles\k4takz5s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-08]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn [2015-01-08]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-24]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-24]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\BASHDefs\20141209.001\BHDrvx64.sys [1587416 2014-10-03] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\IPSDefs\20150107.001\IDSvia64.sys [637656 2015-01-07] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\VirusDefs\20150107.035\ENG64.SYS [129752 2014-08-24] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\VirusDefs\20150107.035\EX64.SYS [2137304 2014-08-24] (Symantec Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [47632 2010-01-27] (CACE Technologies, Inc.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [129856 2012-10-20] (Ray Hinchliffe)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1506000.020\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-08 20:16 - 2015-01-08 20:17 - 00000749 _____ () C:\Users\Volker\Desktop\JRT.txt
2015-01-08 20:14 - 2015-01-08 20:14 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-08 20:12 - 2015-01-08 20:12 - 01707939 _____ (Thisisu) C:\Users\Volker\Downloads\JRT.exe
2015-01-08 20:12 - 2015-01-08 20:12 - 00001182 _____ () C:\Users\Volker\Desktop\mbam.txt
2015-01-06 20:30 - 2015-01-06 20:34 - 00002090 _____ () C:\Users\Volker\Desktop\Entfernen des Avira PC Cleaners.lnk
2015-01-06 20:30 - 2015-01-06 20:34 - 00002034 _____ () C:\Users\Volker\Desktop\Avira PC Cleaner.lnk
2015-01-05 17:40 - 2015-01-08 20:18 - 00015355 _____ () C:\Users\Volker\Downloads\FRST.txt
2015-01-05 17:39 - 2015-01-08 19:52 - 00000000 ____D () C:\Users\Volker\Downloads\FRST-OlderVersion
2015-01-05 17:38 - 2015-01-05 17:38 - 00000474 _____ () C:\Users\Volker\Downloads\defogger_disable.log
2015-01-04 19:16 - 2015-01-08 20:16 - 00334348 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-04 18:42 - 2015-01-04 18:42 - 00000602 _____ () C:\WINDOWS\PFRO.log
2015-01-04 18:39 - 2015-01-04 18:39 - 02173952 _____ () C:\Users\Volker\Downloads\adwcleaner_4.106.exe
2014-12-30 00:14 - 2014-12-30 21:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-12-29 22:59 - 2014-12-29 22:59 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-25 13:55 - 2014-12-25 14:20 - 00000000 ____D () C:\Users\Volker\Downloads\USA 2015
2014-12-11 17:55 - 2014-12-11 17:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-11 17:11 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 17:11 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-09 21:57 - 2014-12-09 21:57 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-09 21:05 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-09 21:05 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-09 20:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-09 20:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-09 20:35 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-09 20:35 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-09 20:35 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-09 20:35 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-09 20:35 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-09 20:35 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-09 20:35 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-09 20:35 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-09 20:35 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-09 20:35 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-09 20:35 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-09 20:35 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-09 20:35 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-09 20:35 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-09 20:35 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-09 20:35 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-09 20:35 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-09 20:35 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-09 20:35 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-09 20:35 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-09 20:35 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-09 20:35 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-09 20:35 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-09 20:35 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-09 20:35 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-09 20:35 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-09 20:35 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-09 20:35 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-09 20:35 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-09 20:35 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-09 20:35 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-09 20:35 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-09 20:35 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-09 20:35 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-09 20:35 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-09 20:35 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-09 20:35 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-09 20:35 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-09 20:35 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-09 20:35 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-09 20:35 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-09 20:35 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-09 20:35 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-09 20:35 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-09 20:35 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-09 20:35 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-09 20:35 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-09 20:35 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-08 20:18 - 2014-11-02 16:55 - 00000000 ____D () C:\FRST
2015-01-08 20:03 - 2014-06-26 23:12 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-08 20:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-08 19:59 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-08 19:55 - 2013-12-03 21:45 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F4A79B6B-A380-4C13-9551-5944638F3A99}
2015-01-08 19:52 - 2014-11-02 16:54 - 02124288 _____ (Farbar) C:\Users\Volker\Downloads\FRST64.exe
2015-01-08 19:49 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-08 19:46 - 2013-11-20 21:00 - 00000000 __RDO () C:\Users\Volker\SkyDrive
2015-01-08 19:45 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-07 21:40 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-07 21:37 - 2013-03-19 19:16 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-06 21:08 - 2013-03-14 18:42 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-727225698-2809878298-2680435891-1001
2015-01-06 20:27 - 2013-03-19 17:00 - 01278976 ___SH () C:\Users\Volker\Desktop\Thumbs.db
2015-01-05 23:00 - 2013-03-19 17:32 - 00000000 ____D () C:\Users\Volker\AppData\Roaming\vlc
2015-01-05 22:10 - 2013-09-30 05:14 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 22:10 - 2013-09-30 04:56 - 00765378 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 22:10 - 2013-09-30 04:56 - 00159696 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-05 22:09 - 2013-03-21 21:46 - 00000000 ____D () C:\Users\Volker\AppData\Local\CrashDumps
2015-01-04 19:17 - 2013-04-26 15:08 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-01-04 18:41 - 2013-12-14 15:24 - 00000000 ____D () C:\AdwCleaner
2015-01-04 18:38 - 2013-11-20 22:11 - 01536512 ___SH () C:\Users\Volker\Downloads\Thumbs.db
2015-01-04 18:09 - 2014-01-07 18:00 - 00000000 ____D () C:\Users\Volker\AppData\Local\NPE
2015-01-04 18:07 - 2014-10-02 23:56 - 00000000 ____D () C:\NPE
2015-01-04 16:03 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-02 23:39 - 2014-07-18 22:30 - 00000000 ____D () C:\Users\Volker\Downloads\WM 2014
2014-12-31 12:18 - 2013-03-14 20:00 - 00000000 ____D () C:\Users\Volker\AppData\Local\Thunderbird
2014-12-30 22:58 - 2013-03-14 19:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-27 11:13 - 2014-05-12 16:06 - 00000000 ____D () C:\Users\Volker\Documents\DVDVideoSoft
2014-12-20 23:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-20 23:53 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 17:55 - 2014-06-26 23:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-14 14:15 - 2014-09-24 21:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-14 14:15 - 2014-09-24 21:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-14 13:09 - 2014-08-07 21:43 - 00001249 _____ () C:\Users\Volker\Desktop\Amazon Music.lnk
2014-12-14 12:51 - 2014-09-24 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-13 14:42 - 2014-08-17 11:19 - 00000000 ____D () C:\Users\Volker\AppData\Local\Adobe
2014-12-13 14:41 - 2013-03-19 19:16 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-09 21:57 - 2014-07-12 19:14 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-09 21:57 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-09 21:57 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2014-12-09 21:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-09 21:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 21:16 - 2013-08-13 18:47 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-09 21:16 - 2013-02-19 10:34 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-09 20:34 - 2013-02-19 11:34 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-07 19:54
==================== End Of Log ============================
|
|
08.01.2015, 20:47
| #10 |
| /// the machine /// TB-Ausbilder | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Sieht gut aus Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.01.2015, 22:35
| #11 |
| | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Hallo Schrauber ! Alles erledigt ! Danke für die schnelle Hilfe ! Viele Grüße Folka |
|
08.01.2015, 23:07
| #12 |
| /// the machine /// TB-Ausbilder | Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen |
| ad-aware, antivirus, avira, bingbar, browser, canon, converter, desktop, dvdvideosoft ltd., entfernen, error, fehler, firefox, flash player, helper, helper.exe, homepage, internet, internet explorer, livecomm.exe, mozilla, mp3, programm, realtek, registry, scan, security, svchost.exe, symantec, windows, windowsapps |
Linear-Darstellung
