| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weissWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.01.2015, 12:39
| #1 |
 |  Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Hallo! ich habe beim Suchlauf mit Antivir mehrere Problemmeldungen bekommen. Zudem ist der Bildschirm meines Laptops nach dem Start mehrere Sekunden weiss bevor der normale Desktop erscheint und alles zwar sehr langsam aber funktioniert. Ich bin nicht sehr PC erfahren und bitte um einen verständlichen Lösungsweg. Anbei ein Screenshot von den Ergebnissen von Antivir. Vielen Dank! lmk |
|
07.01.2015, 12:41
| #2 |
| /// the machine /// TB-Ausbilder    | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
07.01.2015, 12:59
| #3 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Danke schoneinmal für die schnelle Antwort!
__________________FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015 Ran by Lisa (administrator) on LISA-VAIO on 07-01-2015 12:49:26 Running from C:\Users\Lisa\Desktop\Downloads Loaded Profile: Lisa (Available profiles: Lisa) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe (Veoh Networks) C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Spotify Ltd) C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe (ALPS) C:\Program Files\Apoint\Apvfb.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHVE.EXE (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Dropbox, Inc.) C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe () C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (SAMSUNG ELECTRONICS) C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe ((주)마크애니) C:\Program Files (x86)\MarkAny\ContentSafer\MaAgent.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.Exe (France Telecom SA) C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXRCV.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7938080 2009-09-17] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-09-17] (Realtek Semiconductor Corp.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-09-28] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation) HKLM-x32\...\Run: [SMSTray] => C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2007-02-23] (SAMSUNG ELECTRONICS) HKLM-x32\...\Run: [MAAgent] => C:\Program Files (x86)\MarkAny\ContentSafer\MAAgent.exe [57344 2007-01-30] ((주)마크애니) HKLM-x32\...\Run: [SpywareTerminator] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2557440 2010-12-22] (Crawler.com) HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation) HKLM-x32\...\Run: [BEWINTERNET-SPSessionManager] => C:\Program Files (x86)\Orange\Internet Everywhere Pro\SessionManager\SessionManager.exe [140016 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [CardDetectorHUAWEI1752_1552] => C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe [295664 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [522744 2012-06-07] (Cisco Systems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X] HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [VeohPlugin] => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [4686848 2013-12-27] (Veoh Networks) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [SpywareTerminatorUpdate] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3318784 2010-12-22] (Crawler.com) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-04-22] (TomTom) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Facebook Update] => C:\Users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Spotify Web Helper] => C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-24] (Spotify Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHVE.EXE [241280 2012-07-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22040168 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\MountPoints2: {5e5c0132-bc0d-11e0-9d44-d7753c85b68c} - G:\MicroLauncher.exe HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\MountPoints2: {6ad8348b-7da2-11e2-a456-0024beb0571c} - G:\Setup.exe HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\MountPoints2: {9493307e-beba-11e0-bf06-ff689398b8ea} - G:\MicroLauncher.exe HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\MountPoints2: {d1688dd6-a960-11e0-a2bf-0024beb0571c} - G:\KODAK_Software_Downloader.exe HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\1\E_YATIHVE.EXE /EPT "EPLTarget\P0000000000000000" /M "Epson Stylus Office BX635FWD" HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk ShortcutTarget: tbhcn.lnk -> C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe () ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) BootExecute: autocheck autochk * sdnclean64.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-1835249705-154528930-3876099220-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {2FD26EDA-EF2A-45B5-A77D-D648C80D1EC9} URL = hxxp://www.zinio.com/search/index.jsp?s={searchTerms}&rf=sonyie8search SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {9CAD618A-B558-4860-B4CE-D3F506049A16} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms} SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {E3E73F4E-4BC0-418D-9621-5F3FA6E19E9F} URL = hxxp://de.shopping.com/?linkin_id=8056363 SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {F7122350-F123-4217-931D-E620592DF091} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) DPF: HKLM-x32 {55963676-2F5E-4BAF-AC28-CF26AA587566} https://asa03.lrz.de/CACHE/stc/1/binaries/vpnweb.cab DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553240000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {DAF7E6E6-D53A-439A-B28D-12271406B8A9} hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: ShellHook Class - {88485281-8b4b-4f8d-9ede-82e29a064277} - C:\Program Files (x86)\MarkAny\ContentSafer\MACSMANAGER.dll [192512 2004-11-23] (MarkAny Cooperation.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll No File FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1835249705-154528930-3876099220-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lisa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-maps.xml FF Extension: Adblock Edge - C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-11-14] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-09] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-11-16] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR Profile: C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avira Browserschutz) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-27] CHR Extension: (appbarioDE) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf [2014-10-27] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-10-27] CHR HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [2014-01-12] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [2014-01-12] CHR HKLM-x32\...\Chrome\Extension: [ncapomajoehhoogiooemilfafoicepmc] - C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor_air_chrome.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-10-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2010-03-22] (France Telecom SA) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.) R2 MySQL; C:\Program Files\MySQL\MySQL Server 5.1\my.ini [8919 2010-04-29] () [File not signed] S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions) S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [189984 2009-09-17] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation) S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation) R2 sp_rssrv; C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe [948775 2010-12-22] (Crawler.com) [File not signed] R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.) R3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [845312 2010-08-11] (Sony Corporation) [File not signed] R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-23] (DT Soft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-07] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd) R2 risdptsk; C:\Windows\system32\drivers\risdsn64.sys [76288 2009-09-23] (REDC) S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2014-12-30] () R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [50696 2010-07-07] (Windows (R) Win 7 DDK provider) S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 12:48 - 2015-01-07 12:49 - 00000000 ____D () C:\FRST 2015-01-06 07:33 - 2015-01-06 07:33 - 00000000 ____D () C:\Users\Lisa\AppData\Local\{3C801BB6-413F-4B81-A394-35B46C4CFA81} 2015-01-05 19:32 - 2015-01-05 19:32 - 00000000 ____D () C:\Users\Lisa\AppData\Local\{1B17FC5E-0443-4022-90DF-6AB3AB2769C6} 2014-12-30 22:02 - 2014-12-30 22:02 - 00003130 _____ () C:\Windows\System32\Tasks\USER_ESRV_SVC 2014-12-30 22:01 - 2014-12-30 22:01 - 00002027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care.lnk 2014-12-30 22:01 - 2014-12-30 22:01 - 00000000 __RHD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care 2014-12-28 18:16 - 2014-12-28 18:16 - 00001054 _____ () C:\Users\Lisa\Desktop\scan.txt 2014-12-28 17:37 - 2015-01-07 12:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-28 14:08 - 2014-12-28 14:08 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-28 14:08 - 2014-12-28 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2014-12-28 14:08 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-28 14:08 - 2014-12-28 14:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-28 13:55 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-12-28 13:55 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\bBmz2SW 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6wPPpQF 2014-12-23 18:08 - 2014-12-23 18:08 - 00003278 _____ () C:\Windows\System32\Tasks\6yW3JnUcdFcSwI6 2014-12-23 18:08 - 2014-12-23 18:08 - 00003238 _____ () C:\Windows\System32\Tasks\0DpOX5082tGH1oL 2014-12-18 05:12 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 05:12 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-16 20:36 - 2014-12-31 17:18 - 00000775 _____ () C:\Users\Lisa\Desktop\ficha registro, ejemplo.lnk 2014-12-16 17:55 - 2014-12-16 17:55 - 00000000 ____D () C:\Users\Lisa\Desktop\Cal 2014-12-15 12:03 - 2014-12-15 13:15 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-12-15 12:03 - 2014-12-15 12:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-15 12:03 - 2014-12-15 12:03 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-12-15 12:03 - 2014-12-15 12:03 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-12-15 12:03 - 2014-12-15 12:03 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-12-15 12:03 - 2014-12-15 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-12-15 12:03 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-12-12 03:14 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-12 03:14 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-12 03:14 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-12 03:14 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-11 03:26 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-11 03:26 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-11 03:26 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-11 03:26 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-11 03:26 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-11 03:26 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-11 03:26 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-11 03:26 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-11 03:26 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-11 03:26 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-11 03:26 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-11 03:26 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-11 03:26 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-11 03:26 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-11 03:26 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-11 03:26 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-11 03:26 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-11 03:26 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-11 03:26 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-11 03:26 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-11 03:26 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-11 03:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-11 03:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-11 03:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-11 03:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-11 03:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-11 03:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-11 03:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-11 03:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-11 03:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-11 03:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-11 03:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-11 03:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-11 03:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-11 03:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-11 03:24 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-11 03:24 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-11 03:24 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-11 03:24 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-11 03:24 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-11 03:24 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-09 14:27 - 2014-12-09 14:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 12:50 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-07 12:50 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-07 12:48 - 2014-06-12 12:24 - 00000000 ____D () C:\Users\Lisa\Desktop\Madrid 2015-01-07 12:47 - 2012-07-25 13:33 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\BrowserCompanion 2015-01-07 12:39 - 2011-06-01 19:56 - 07715328 ___SH () C:\Users\Lisa\Desktop\Thumbs.db 2015-01-07 12:31 - 2010-01-07 17:04 - 01685806 _____ () C:\Windows\WindowsUpdate.log 2015-01-07 12:20 - 2009-11-27 04:01 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-07 12:10 - 2011-05-09 21:31 - 00000000 ___RD () C:\Users\Lisa\Dropbox 2015-01-07 12:10 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Dropbox 2015-01-07 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-01-07 12:09 - 2010-01-07 17:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB25F1A-BB3C-4A69-A37D-CE8C1215F895} 2015-01-07 12:02 - 2009-11-27 04:01 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-07 12:01 - 2014-10-06 10:12 - 00130586 _____ () C:\Windows\PFRO.log 2015-01-07 12:01 - 2014-10-03 10:48 - 00003584 _____ () C:\Windows\setupact.log 2015-01-07 12:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-07 12:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache 2015-01-06 11:01 - 2014-11-25 03:27 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6ZrCIYN 2015-01-06 11:01 - 2014-11-21 22:25 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\l1Vsnq1 2015-01-06 11:00 - 2012-11-20 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-06 10:59 - 2010-04-17 20:38 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Skype 2015-01-06 08:29 - 2011-12-08 17:49 - 00001134 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA.job 2015-01-05 23:29 - 2011-12-08 17:49 - 00001112 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core.job 2015-01-05 13:34 - 2014-10-11 14:24 - 00000000 ___RD () C:\Users\Lisa\Desktop\Dropbox 2015-01-05 13:17 - 2014-06-16 07:59 - 00000000 ____D () C:\AdwCleaner 2015-01-05 13:09 - 2010-01-25 17:58 - 00000000 ____D () C:\Program Files (x86)\DivX 2014-12-30 22:05 - 2010-01-15 11:11 - 00000000 ____D () C:\Update 2014-12-30 22:02 - 2009-11-27 03:59 - 00000000 ____D () C:\Program Files (x86)\SONY 2014-12-30 22:01 - 2011-04-18 17:38 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation 2014-12-30 22:01 - 2009-11-27 04:18 - 00000000 ____D () C:\Program Files\Sony 2014-12-30 21:57 - 2014-06-03 22:20 - 00013792 _____ () C:\Windows\system32\Drivers\semav6thermal64ro.sys 2014-12-29 00:58 - 2010-09-27 21:36 - 00212992 ___SH () C:\Users\Lisa\Thumbs.db 2014-12-29 00:58 - 2010-02-06 18:15 - 00274944 ___SH () C:\Users\Lisa\Documents\Thumbs.db 2014-12-28 18:35 - 2009-11-27 12:52 - 05569300 _____ () C:\Windows\system32\perfh007.dat 2014-12-28 18:35 - 2009-11-27 12:52 - 01714936 _____ () C:\Windows\system32\perfc007.dat 2014-12-28 18:35 - 2009-07-14 06:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-28 18:21 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-27 22:47 - 2013-02-23 20:56 - 00000290 _____ () C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job 2014-12-19 04:34 - 2012-04-08 21:46 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Spotify 2014-12-18 14:28 - 2012-04-08 21:55 - 00000000 ____D () C:\Users\Lisa\AppData\Local\Spotify 2014-12-17 22:42 - 2013-02-23 20:56 - 00000274 _____ () C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job 2014-12-16 11:44 - 2014-08-21 13:36 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-16 11:44 - 2013-02-24 00:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-16 11:44 - 2013-02-24 00:06 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-15 22:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-15 11:47 - 2014-10-10 15:40 - 00001141 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk 2014-12-12 14:17 - 2014-11-23 19:39 - 00000002 _____ () C:\Users\Lisa\AppData\Local\recently-fix.db 2014-12-12 04:23 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-12 04:19 - 2014-06-15 18:59 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\wp_update 2014-12-12 04:00 - 2013-01-25 22:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-12 03:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-12 03:37 - 2009-11-27 04:07 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-12 03:34 - 2013-08-23 02:03 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-12 03:21 - 2010-04-07 22:25 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-10 16:00 - 2012-11-20 12:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-09 22:46 - 2011-12-24 00:49 - 00000000 ____D () C:\Users\Lisa\AppData\Local\Apple Computer 2014-12-09 22:01 - 2014-10-16 09:34 - 00000000 ____D () C:\Users\Lisa\Desktop\handy 10-2014 Some content of TEMP: ==================== C:\Users\Lisa\AppData\Local\Temp\avgnt.exe C:\Users\Lisa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwggthj.dll C:\Users\Lisa\AppData\Local\Temp\Quarantine.exe C:\Users\Lisa\AppData\Local\Temp\SkypeSetup.exe C:\Users\Lisa\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 05:20 ==================== End Of Log ============================ --- --- --- Addition FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by Lisa at 2015-01-07 12:51:44
Running from C:\Users\Lisa\Desktop\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - ALPS ELECTRIC CO., LTD.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{7BB90344-0647-468E-925A-7F69F7983421}) (Version: 2.0.1.85 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.390 - ArcSoft)
Autodesk Design Review 2012 (HKLM-x32\...\Autodesk Design Review 2012) (Version: 12.0.0.93 - Autodesk, Inc.)
Autodesk Design Review 2012 (x32 Version: 12.0.0.93 - Autodesk, Inc.) Hidden
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version: - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version: - AVM Berlin)
Benutzerhandbuch EPSON BX635FWD Series (HKLM-x32\...\EPSON BX635FWD Series Useg) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Card Detector for Huawei E1752 and E1552 (HKLM-x32\...\CardDetectorHUAWEI1752_1552) (Version: 1.4.0.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
Celtx (2.9.1) (HKLM-x32\...\Celtx (2.9.1)) (Version: 2.9.1 (es-ES) - Greyfirst)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.0.08057 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.0.08057 - Cisco Systems, Inc.) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cuevana Storm version 0.1b (HKLM-x32\...\{CB7BA2E8-323E-4684-8D96-4A5EAF481D9A}_is1) (Version: 0.1b - Cuevana)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)
DivX Plus DirectShow Filters (HKLM-x32\...\DivX Plus DirectShow Filters) (Version: - DivX, Inc.)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.0.34 - DivX, LLC)
Dll-Files Fixer (HKLM-x32\...\Dll-Files Fixer_is1) (Version: 1.0 - Dll-Files.com)
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
Dropbox (HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
DWG TrueView 2012 (HKLM\...\DWG TrueView 2012) (Version: 18.2.51.0 - Autodesk)
DWG TrueView 2012 (Version: 18.2.51.0 - Autodesk) Hidden
EasyBits GO (HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Game Organizer) (Version: - EasyBits Media)
Einstellungen für VAIO-Inhaltsüberwachung (HKLM-x32\...\{23825B69-36DF-4DAD-9CFD-118D11D80F16}) (Version: 2.4.1.09180 - Sony Corporation)
EPSON BX635FWD Series Printer Uninstall (HKLM\...\EPSON BX635FWD Series) (Version: - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{FFF841F3-9A15-4F61-BD16-C19F132E5A27}) (Version: 2.3.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (HKLM-x32\...\{FA9D303D-0FB2-49C7-9397-8E6B11EA892D}) (Version: 2.50.0001 - SEIKO EPSON CORPORATION)
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.20.00 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.0.545 - Evernote Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
fix version 1.0.0.0 (HKLM-x32\...\{ACA88935-7188-47AD-B220-B50106DC0D9C}_is1) (Version: 1.0.0.0 - )
FOTOParadies (HKLM-x32\...\{0239225E-36E3-4B6B-B334-59BDCFEBC8D9}}_is1) (Version: 3.1.10.103 - Foto Online Service GmbH)
FoxTab PDF Creator (HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\FoxTab PDF Creator) (Version: - ) <==== ATTENTION
Free YouTube to MP3 Converter version 3.12.17.1127 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
GIMP 2.6.10 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
IBM SPSS Statistics 19 (HKLM\...\{06C43FAA-7226-41EF-A05E-9AE0AA849FFE}) (Version: 19.0.0 - SPSS Inc., an IBM Company)
iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)
Inkscape 0.48.2 (HKLM-x32\...\Inkscape) (Version: 0.48.2 - )
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Interaktive Sprachreise - Grammatiktrainer Español (HKLM-x32\...\GTS_17_689521) (Version: - digital publishing AG)
Internet Everywhere Pro (HKLM-x32\...\{BEWINTERNET-SP}.UninstallSuite) (Version: - )
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java(TM) 6 Update 16 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416016FF}) (Version: 6.0.160 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ken Ward's Zipper 1.4000 (HKLM-x32\...\Ken Ward's Zipper_is1) (Version: - Ken Ward)
K-Lite Codec Pack 7.0.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.0.0 - )
KODAK Create@Home Software (für dm) (HKLM-x32\...\{43B8BDF6-13EC-44BE-9EDA-F284C4CA19A6}) (Version: 7.8.1392 - Eastman Kodak Company)
Longman iBT Prep 2.0 (HKLM-x32\...\Longman iBT 2.0) (Version: - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.1.0.10210 - Sony Corporation)
Media Gallery (x32 Version: 1.1.0.10210 - Sony Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.3 (HKLM-x32\...\{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}) (Version: 2.0.2313.0 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 x64 English (HKLM\...\{F83779DF-E1F5-43A2-A7BE-732F856FADB7}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MusicStation (HKLM-x32\...\{AB259D46-F851-41B0-9AFA-AED8998AD68A}) (Version: 2.0.0.1067 - Omnifone)
MySQL Server 5.1 (HKLM\...\{02412CEB-47C0-4157-80DE-6E96AAE67604}) (Version: 5.1.46 - MySQL AB)
Netzwerkhandbuch EPSON BX635FWD Series (HKLM-x32\...\EPSON BX635FWD Series Netg) (Version: - )
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
Open Freely (HKLM\...\{1BF14E04-85DE-480C-9A04-EB36744C66C3}_is1) (Version: 1.0 - Download Freely, LLC)
OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 0.9.9 - Frank Heindörfer, Philip Chinery)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.0.00.10260 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.5.00.03020 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (Click to Disc) (HKLM-x32\...\InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}) (Version: 3.2.00.16060 - Sony Corporation)
PMB VAIO Edition plug-in (Click to Disc) (x32 Version: 3.2.00.16060 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Image Optimizer) (x32 Version: 1.4.00.12020 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Movie Story) (HKLM-x32\...\{E5B09DD4-3982-4CC1-8481-829CFFE268CB}) (Version: 2.2.00.15250 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Movie Story) (HKLM-x32\...\InstallShield_{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}) (Version: 2.2.00.15250 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Movie Story) (x32 Version: 2.2.00.15250 - Sony Corporation) Hidden
QuickTime (HKLM-x32\...\{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}) (Version: 7.65.17.80 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5886 - Realtek Semiconductor Corp.)
Roxio Easy Media Creator 10 LJ (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio)
Samsung Media Studio (HKLM-x32\...\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}) (Version: 5 - Samsung)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Setting Utility Series (HKLM-x32\...\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}) (Version: 5.1.0.11200 - Sony Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Sony Home Network Library (HKLM-x32\...\{D03D02D8-AB64-4785-A48E-5AA8B0FB8C14}) (Version: 2.0.1.10160 - Sony Corporation)
Sony Home Network Library (x32 Version: 2.0.1.10160 - Sony Corporation) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Spotify (HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Spyware Terminator (HKLM-x32\...\Spyware Terminator_is1) (Version: 2.8.1.188 - Crawler Inc.)
TeamViewer 6 (HKLM-x32\...\TeamViewer 6) (Version: 6.0.10194 - TeamViewer GmbH)
The Sims 3 Complete Edition version 1.02 (HKLM-x32\...\{75D84EF7-0D8C-4e70-SIMS3-7B42A5D4E0EB}_is1) (Version: 1.02 - Black_Box)
TOEFL Sample Questions (HKLM-x32\...\{A8E9FAEE-4AC2-4A38-99D9-55D1F26F8163}) (Version: 4.00.0000 - ETS)
TomTom HOME 2.8.2.2264 (HKLM-x32\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities 2014) (Version: 14.0.1000.89 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.89 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4000.60 - TuneUp Software) Hidden
VAIO - PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}) (Version: 1.5.00.03020 - Sony Corporation)
VAIO - PMB VAIO Edition plug-in (VAIO Image Optimizer) (HKLM-x32\...\InstallShield_{9CCA7C1A-6308-4F12-AEDD-D230CAAF847E}) (Version: 1.4.00.12020 - Sony Corporation)
VAIO Care (HKLM\...\{D9FFE40D-1A85-4541-992C-5EF505F391A4}) (Version: 8.4.2.12041 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (HKLM-x32\...\{4882EBF5-CA37-4EF4-BCB8-9B0E78B907D0}) (Version: 3.6.0.09250 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (x32 Version: 3.6.0.09250 - Sony Corporation) Hidden
VAIO Content Metadata Intelligent Network Service Manager (HKLM-x32\...\{4427F384-B5BE-4769-B7D0-C784FC321EB1}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata Intelligent Network Service Manager (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Metadata Manager Settings (HKLM-x32\...\{12D0BE8D-538C-4AB1-86DE-C540308F50DA}) (Version: 3.6.0.09240 - Sony Corporation)
VAIO Content Metadata Manager Settings (x32 Version: 3.6.0.09240 - Sony Corporation) Hidden
VAIO Content Metadata XML Interface Library (HKLM-x32\...\{291FB4BF-EEC7-4CF9-8469-F39ED1DBC4D8}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata XML Interface Library (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Monitoring Settings (x32 Version: 2.4.1.09180 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.1.0.10160 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.2.0.09150 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.2.0.09150 - Sony Corporation) Hidden
VAIO DVD Menu Data (HKLM-x32\...\{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}) (Version: 2.1.00.15050 - Sony Corporation)
VAIO Energie Verwaltung (HKLM-x32\...\{803E4FA5-A940-4420-B89D-A8BC2E160247}) (Version: 5.0.0.11180 - Sony Corporation)
VAIO Event Service (HKLM-x32\...\{C7477742-DDB4-43E5-AC8D-0259E1E661B1}) (Version: 5.1.0.11040 - Sony Corporation)
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.2.1.09131 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 1.0.0.10290 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 3.9.1 - Sony Corporation) Hidden
VAIO Marketing Tools (HKLM-x32\...\MarketingTools) (Version: - Sony Corporation)
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.0.1.10160 - Sony Corporation)
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 1.2.0.09100 - Sony Corporation)
VAIO Movie Story MergeModules x64 (Version: 1.0.14240 - Sony Corporation) Hidden
VAIO Movie Story Template Data (HKLM-x32\...\InstallShield_{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 2.0.00.09240 - Sony Corporation)
VAIO Movie Story Template Data (x32 Version: 2.0.00.09240 - Sony Corporation) Hidden
VAIO NW screensaver (HKLM-x32\...\VAIO NW screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Original Function Settings (x32 Version: 2.0.0.07010 - Sony Corporation) Hidden
VAIO Original Funktion Einstellungen (HKLM-x32\...\{A63E7492-A0BC-4BB9-89A7-352965222380}) (Version: 2.0.0.07010 - Sony Corporation)
VAIO Personalization Manager (HKLM-x32\...\{A95187EF-BCF4-4468-B501-C0BAB976ADD1}) (Version: 2.0.0.06220 - Sony Corporation)
VAIO Personalization Manager (x32 Version: 2.0.0.06220 - Sony Corporation) Hidden
VAIO Premium Partners (HKLM-x32\...\VAIO Premium Partners) (Version: 1.0 - Sony Europe)
VAIO Quick Web Access (HKLM-x32\...\splashtop) (Version: 1.2.0.3 - Sony Corporation)
VAIO Quick Web Access (x32 Version: 1.2.0.3 - Sony Corporation) Hidden
VAIO Sample Contents (HKLM-x32\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.1.0.09020 - Sony Corporation)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.3.1.08110 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
VAIO Wallpaper Contents (HKLM-x32\...\{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}) (Version: 2.0.0.06010 - Sony Corporation)
VAIO Window Organizer (HKLM-x32\...\{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}) (Version: 2.0.0.08280 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.1.2.06030 - Sony Corporation)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Veetle TV 0.9.18 (HKLM-x32\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc)
Veoh Web Player (HKLM-x32\...\Veoh Web Player Beta) (Version: 1.1.2.0000 - Veoh Networks, Inc.)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (HKLM\...\6B8550A319DDC8B17F35F4A89988705E4592349B) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Winservices (HKLM-x32\...\WinServices) (Version: 1.0.0.0 - Kreapixel inc.)
WinZip 15.0 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}) (Version: 15.0.9411 - WinZip Computing, S.L. )
WinZip Self-Extractor (HKLM-x32\...\WinZip Self-Extractor) (Version: - WinZip Computing, S.L.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2012\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2012\dwgviewr.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1835249705-154528930-3876099220-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
26-12-2014 03:00:25 Windows Update
27-12-2014 03:00:41 Windows Update
28-12-2014 01:38:41 Windows Update
29-12-2014 03:00:55 Windows Update
30-12-2014 03:00:49 Windows Update
31-12-2014 03:00:46 Windows Update
31-12-2014 17:42:23 Windows Update
04-01-2015 13:11:13 Windows Update
05-01-2015 03:01:17 Windows Update
06-01-2015 03:00:42 Windows Update
06-01-2015 11:03:56 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-11-23 19:24 - 00002595 ____A C:\Windows\system32\Drivers\etc\hosts
129.187.254.164 asa04.lrz.de
129.187.254.165 asa05.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.165 asa05.lrz.de
129.187.254.163 asa03.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.163 asa03.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.163 asa03.lrz.de
129.187.254.163 asa03.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.165 asa05.lrz.de
129.187.254.164 asa04.lrz.de
129.187.254.165 asa05.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.40 asa01.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.40 asa01.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
129.187.254.21 asa-cluster.lrz.de
There are 17 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {000E2C53-C262-42C6-B7C7-EA8359D84AE3} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {046FC09C-8551-4BDE-847F-AF3323D271C8} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {04E6FEEB-4D9B-443B-A466-06A44159996C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {06F08D6A-519D-4089-9C53-EBCC7B337A13} - System32\Tasks\WIN-statsAdmin => C:\Users\Lisa\AppData\Local\Microsoft\WinU\~kstmtgc.exe [2014-08-06] () <==== ATTENTION
Task: {0F3FE51E-0DCB-478C-BD3E-B6BC8FD675D2} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {198D724F-094C-493A-93C1-5BE6CCA32CA4} - \0ae988b5-099d-4c86-96f6-822600c1e6d6-4 No Task File <==== ATTENTION
Task: {2BB4EC2B-CAE2-4B88-84E8-ABE472BCD567} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27] (Google Inc.)
Task: {2D1322A0-50C3-41EB-9D59-4CC6F4954B8E} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\Lisa\AppData\Roaming\~nvipbvu.exe
Task: {2DB138F3-76B2-4E05-B04D-C9CC1F290A12} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {3195AC22-4536-438F-BF37-4F5139E2F1E4} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core => C:\Users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: {31C51577-733F-4E39-AECD-9190C3758D0F} - System32\Tasks\systemspeedup => C:\Users\Lisa\AppData\Roaming/Microsoft\~fqtstrx.exe
Task: {3455CF50-5B05-47FE-9A3A-64006AE83A76} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {3DB984BE-03A3-4D7E-8C7A-3871BAFD4A7D} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2014-01-16] (Sony Corporation)
Task: {4054CB2F-C6C9-404C-BD09-430ACFDE01A0} - System32\Tasks\{7B8BA30B-EF27-426C-85EB-5866DDB3C930} => pcalua.exe -a C:\Users\Lisa\Desktop\SpywareTerminatorSetup2.8.1.188.exe -d C:\Users\Lisa\Desktop
Task: {47ABAF1D-077F-49B2-A9A5-BBEB0AEE3E77} - System32\Tasks\{FC2CAD9F-A5E5-4DD6-B7FB-95CA36E1E210} => pcalua.exe -a C:\Users\Lisa\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=tugs -simple=0
Task: {4C5E8282-285F-497D-BD6A-B074C0F0092B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: {5019C184-2C1D-437F-8207-CE8B94B9AF59} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {52F0170A-3B1F-4032-859E-25B979CC1492} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2012-12-04] (Dll-FIles.Com)
Task: {54FED2AF-1453-4D73-9CE1-8321C2D5D94C} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2013-08-30] (TuneUp Software)
Task: {5DF3DE8B-BBB2-4051-A937-881902BD18AE} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-18] (Sony Corporation)
Task: {5EC74031-D5C2-4C53-8D22-D3FAA77A4556} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {602B36E6-E864-4377-AC90-FA684620D993} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-18] (Sony Corporation)
Task: {62F11A81-B5C0-443E-85E9-D1AF042FFFE5} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {62FC6702-06B9-4D97-959C-56D0E134EE00} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-10-25] (Sony Corporation)
Task: {66E1E66D-CE29-4CF4-AAE4-EFD54B6388C1} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {66F41253-A581-435A-94FA-219879F7B09E} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-10-25] (Sony Corporation)
Task: {6700BCF6-7693-460F-AAA0-68D63F8FE031} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {6A15F39C-C511-487C-B347-A9CC288E97E0} - System32\Tasks\6yW3JnUcdFcSwI6 => C:\Users\Lisa\AppData\Roaming\6wPPpQF\eNXIQ3r.exe
Task: {6A7BA815-DC34-4F79-93CB-381D0895F390} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2014-12-03] (Sony Corporation)
Task: {735DF884-D72F-4451-A4E5-2845225898A1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27] (Google Inc.)
Task: {74BFD996-BBE8-4E5F-9B65-F4E958A8108F} - System32\Tasks\{73BE39D3-DB3C-441B-BE9F-CE7F4CBCB507} => Chrome.exe hxxp://ui.skype.com/ui/0/6.21.73.104.456/de/abandoninstall?page=tsWLM
Task: {82E364A6-B927-45DC-9CFE-70B85A22B0AC} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-07-29] ()
Task: {830C3AAE-ADF4-436C-AF24-24B077C084C7} - System32\Tasks\{816AEA89-71A3-4B3D-82E9-2136A365B813} => pcalua.exe -a F:\SETUP.EXE -d F:\
Task: {8681B078-9C0E-49F1-9128-434D3F96DCD4} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {8BCF26F8-1914-426B-8AF8-A44850B54A4E} - System32\Tasks\{72CD8BC8-7A8D-489E-81FE-16E56085D7DF} => pcalua.exe -a "C:\Users\Lisa\Downloads\Firefox Setup 3.6.exe" -d C:\Users\Lisa\Downloads
Task: {8E7C11AB-7F28-497E-B503-D5F42BF7C3E5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {974BE65A-7ADD-4382-968F-D5257A9FCE15} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {9A88A279-0CEC-49BD-91CC-E322820DB031} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [2013-12-27] (Veoh Networks)
Task: {9C066F11-F6F3-47DA-9BBE-E10D8DDDF0D0} - System32\Tasks\{65AFA674-39B2-4CB9-A159-34AC4B3F1A03} => pcalua.exe -a C:\Users\Lisa\Downloads\vpnclient-win-msi-5.0.03.0530-k9.exe -d C:\Users\Lisa\Desktop
Task: {9D588883-38F9-4CC6-B4AE-F910514FD6EE} - System32\Tasks\Sony Corporation\VAIO Care\ActiveStatusCollect => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {9F546E61-16B2-4B67-851D-E328625A4B9F} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {A57CA70B-610B-4657-846A-551DA0124FAE} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {AD6B6AF6-75B5-4A44-B643-A730E8630551} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {B685DA7E-002C-4D17-AFE7-199E4347FC61} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2012-12-04] (Dll-FIles.Com)
Task: {B864477B-8E83-4B12-BA67-FBD2A9EDB615} - System32\Tasks\{F138AD45-83F8-4C13-9C50-952B9E7959AC} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-08-27] (Skype Technologies S.A.)
Task: {C40526B4-364D-4880-A7FE-A7E2C9849B25} - System32\Tasks\{C030C7F3-4F97-4CD6-A8AC-8B5DC4418549} => pcalua.exe -a C:\Users\Lisa\Downloads\sdsetup.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {C9103018-43E8-40DD-9C23-74CA98A9CE10} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {C9BCBC97-27DD-4C00-ABC6-20884A70F5ED} - System32\Tasks\Sun Microsystems-Online-Aktualisierungsprogramm => C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-27] (Sun Microsystems, Inc.)
Task: {D3C89DFE-D482-40BA-A2F9-8516F9A2B360} - System32\Tasks\WIN-statsSystem => C:\Users\Lisa\AppData\Local\Microsoft\WinU\~sizannd.exe
Task: {D43759AC-1F5C-4F89-9875-7C206807D8C3} - \0f35c805-0126-47dc-bc26-393cdbd9833d-4 No Task File <==== ATTENTION
Task: {DD427225-6040-4EAF-AB77-52F98C7F98D9} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA => C:\Users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.)
Task: {E0B6295F-6C3C-49F0-9A5E-929CCEE3A8C2} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-18] (Sony Corporation)
Task: {EB8DF678-2B6F-4747-8CDB-41460FDD5A85} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {EBFB1ED3-6C35-4F29-B9D1-B428874E77F1} - System32\Tasks\0DpOX5082tGH1oL => C:\Users\Lisa\AppData\Roaming\bBmz2SW\Xqd1qXW.exe [2014-12-23] ( )
Task: {ED65EA29-D4C6-44C8-993B-0709BFDC0906} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {EDB47F5D-E7DF-4533-B7F9-05156157B334} - System32\Tasks\iFRHXUwVzFN6yRW => C:\Users\Lisa\AppData\Roaming\l1Vsnq1\e3RRrib.exe
Task: {EF48E5CC-F201-4838-9E0E-F970C088BE7D} - System32\Tasks\TaskUserUpdate_wp => C:\Users\Lisa\AppData\Roaming\~ysnqtfu.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core.job => C:\Users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA.job => C:\Users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-05-14 17:52 - 2005-03-11 23:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2010-04-08 16:28 - 2010-04-08 16:28 - 07647744 _____ () C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
2010-12-22 19:15 - 2010-12-22 19:15 - 00076288 _____ () C:\Program Files (x86)\Spyware Terminator\sptcontmenu64.dll
2012-07-02 10:16 - 2012-07-02 10:16 - 00695448 _____ () C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe
2014-02-12 19:58 - 2014-02-12 19:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-12-15 12:03 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-15 12:03 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-15 12:03 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2009-11-27 04:25 - 2009-11-04 18:32 - 00010752 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2009-11-27 04:25 - 2009-11-04 18:32 - 00009728 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2014-12-15 12:03 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-15 12:03 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2011-06-20 14:37 - 2011-06-20 14:37 - 10836992 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtWebKit4.dll
2011-06-20 12:32 - 2011-06-20 12:32 - 00266752 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\phonon4.dll
2011-06-20 12:21 - 2011-06-20 12:21 - 07994880 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtGui4.dll
2011-06-20 12:04 - 2011-06-20 12:04 - 02233344 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtCore4.dll
2011-06-21 14:48 - 2011-06-21 14:48 - 00910336 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtNetwork4.dll
2011-06-20 12:52 - 2011-06-20 12:52 - 01283584 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\QtScript4.dll
2011-05-26 10:38 - 2011-05-26 10:38 - 00022016 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\imageformats\qgif4.dll
2011-05-26 10:38 - 2011-05-26 10:38 - 00120320 _____ () C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll
2010-12-22 19:18 - 2010-12-22 19:18 - 01901570 _____ () C:\Program Files (x86)\Spyware Terminator\TorentDll.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Lisa\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-01-07 12:09 - 2015-01-07 12:09 - 00043008 _____ () c:\users\lisa\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwggthj.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Lisa\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Lisa\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Lisa\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2009-08-18 15:54 - 2009-08-18 15:54 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-12-09 14:27 - 2014-12-09 14:27 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2011-01-31 21:41 - 2014-06-10 11:22 - 09496576 _____ () C:\Users\Lisa\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu
2014-05-08 12:21 - 2014-05-08 12:21 - 00305520 _____ () C:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll
2011-01-31 21:48 - 2014-06-12 13:49 - 00014336 _____ () C:\Users\Lisa\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_Updater.DEU
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1835249705-154528930-3876099220-500 - Administrator - Disabled)
Gast (S-1-5-21-1835249705-154528930-3876099220-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1835249705-154528930-3876099220-1002 - Limited - Enabled)
Lisa (S-1-5-21-1835249705-154528930-3876099220-1000 - Administrator - Enabled) => C:\Users\Lisa
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/06/2015 11:05:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: VCAgent.exe, Version: 8.4.2.12030, Zeitstempel: 0x5476d099
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fe910fb8c1
ID des fehlerhaften Prozesses: 0x748
Startzeit der fehlerhaften Anwendung: 0xVCAgent.exe0
Pfad der fehlerhaften Anwendung: VCAgent.exe1
Pfad des fehlerhaften Moduls: VCAgent.exe2
Berichtskennung: VCAgent.exe3
Error: (01/06/2015 11:05:32 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCAgent.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei VCAgent.View.MainWindow.WindowProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.PublicHooksFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.HwndSubclass.DefWndProcWrapper(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.IntGetMessageW(System.Windows.Interop.MSG ByRef, System.Runtime.InteropServices.HandleRef, Int32, Int32)
bei MS.Win32.UnsafeNativeMethods.IntGetMessageW(System.Windows.Interop.MSG ByRef, System.Runtime.InteropServices.HandleRef, Int32, Int32)
bei System.Windows.Threading.Dispatcher.GetMessage(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run()
bei VCAgent.App.Main()
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1418549
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1418549
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6942
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6942
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/06/2015 02:36:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5710
Error: (01/06/2015 02:36:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5710
System errors:
=============
Error: (01/07/2015 00:10:10 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (01/07/2015 00:07:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst IPBusEnum erreicht.
Error: (01/07/2015 00:06:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet:
%%268439612
Error: (01/07/2015 00:03:19 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/07/2015 00:02:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/07/2015 00:02:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (01/07/2015 00:02:02 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.
Error: (01/06/2015 11:05:07 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2667402)
Error: (01/06/2015 03:11:24 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024200d fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2667402)
Error: (01/05/2015 07:24:21 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.
Microsoft Office Sessions:
=========================
Error: (01/06/2015 11:05:34 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: VCAgent.exe8.4.2.120305476d099unknown0.0.0.000000000c0000005000007fe910fb8c174801d02816013cd07cC:\Program Files\Sony\VAIO Care\VCAgent.exeunknown8d936d48-958b-11e4-bf9e-0024beb0571c
Error: (01/06/2015 11:05:32 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCAgent.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.NullReferenceException
Stapel:
bei VCAgent.View.MainWindow.WindowProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei System.Windows.Interop.HwndSource.PublicHooksFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.HwndSubclass.DefWndProcWrapper(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.CallWindowProc(IntPtr, IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
bei MS.Win32.UnsafeNativeMethods.IntGetMessageW(System.Windows.Interop.MSG ByRef, System.Runtime.InteropServices.HandleRef, Int32, Int32)
bei MS.Win32.UnsafeNativeMethods.IntGetMessageW(System.Windows.Interop.MSG ByRef, System.Runtime.InteropServices.HandleRef, Int32, Int32)
bei System.Windows.Threading.Dispatcher.GetMessage(System.Windows.Interop.MSG ByRef, IntPtr, Int32, Int32)
bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
bei System.Windows.Application.RunInternal(System.Windows.Window)
bei System.Windows.Application.Run()
bei VCAgent.App.Main()
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1418549
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1418549
Error: (01/06/2015 03:00:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6942
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6942
Error: (01/06/2015 02:36:40 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/06/2015 02:36:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5710
Error: (01/06/2015 02:36:39 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5710
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz
Percentage of memory in use: 53%
Total physical RAM: 3935.02 MB
Available physical RAM: 1842.09 MB
Total Pagefile: 7868.22 MB
Available Pagefile: 4468.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:285.65 GB) (Free:50.73 GB) NTFS
Drive g: (The Sims 3 Complete Edition) (CDROM) (Total:17.6 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: FE3DAC26)
Partition 1: (Not Active) - (Size=12.3 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285.6 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
07.01.2015, 13:38
| #4 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.01.2015, 15:15
| #5 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Habe revo uninstall runtergeladen und den PDF Creator entfernt. Es kam die meldung, dass keine reste vorhanden sind deswegen konnte ich den letzten Schritt nicht durchführen. Combofix habe ich nach Anweisung gestartet und nach ca 20 min "Schritt 48" ging nichts mehr weiter und es wurde auch kein Logfile erstellt. Was nun? Gruß "Stufe_48" mein ich  |
|
07.01.2015, 15:28
| #6 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Warten .Wenn in ner halben Stunde immer noch Stufe 48 angezeigt wird nochmal melden.
__________________ --> Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss |
|
07.01.2015, 16:49
| #7 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss jetzt hats geklappt Combofix Logfile: Code:
ATTFilter ComboFix 15-01-07.01 - Lisa 07.01.2015 14:49:48.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3935.1733 [GMT 1:00]
ausgeführt von:: c:\users\Lisa\Desktop\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Lisa\AppData\Local\Microsoft\WinU
c:\users\Lisa\AppData\Local\Microsoft\WinU\~kstmtgc.exe
c:\users\Lisa\AppData\Local\Microsoft\WinU\~phkaorr.exe
c:\users\Lisa\AppData\Local\Microsoft\WinU\~wtsxyfu.exe
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\base_conf.ini
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\current_conf.ini
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\data.ini
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\lastExecuted
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\r_current_conf.ini
c:\users\Lisa\AppData\Local\Microsoft\WinU\Wmain\r_lastExecuted
c:\users\Lisa\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Lisa\AppData\Roaming\toolplugin\toolbar.dll
c:\users\Lisa\Cookies.lnk
c:\windows\inst.exe
c:\windows\msdownld.tmp
c:\windows\Tasks\DLL-files.com Fixer_MONTHLY.job
c:\windows\Tasks\DLL-files.com Fixer_UPDATES.job
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-12-07 bis 2015-01-07 ))))))))))))))))))))))))))))))
.
.
2015-01-07 14:55 . 2015-01-07 14:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-01-07 14:55 . 2015-01-07 14:55 -------- d-----w- c:\users\ADMINI~1\AppData\Local\temp
2015-01-07 12:42 . 2015-01-07 12:42 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-01-07 11:48 . 2015-01-07 11:54 -------- d-----w- C:\FRST
2015-01-07 11:30 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D2F7E035-4B4B-4B79-985C-C9935A0E6211}\mpengine.dll
2014-12-28 16:37 . 2015-01-07 15:34 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-28 13:08 . 2014-12-28 13:08 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-12-28 13:08 . 2014-12-28 13:08 -------- d-----w- c:\programdata\Malwarebytes
2014-12-28 13:08 . 2014-11-21 05:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-12-28 13:08 . 2014-11-21 05:14 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-12-28 13:08 . 2014-11-21 05:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-12-28 12:55 . 2011-05-13 10:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2014-12-28 12:55 . 2011-03-25 18:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2014-12-23 17:08 . 2015-01-06 10:01 -------- d-----w- c:\users\Lisa\AppData\Roaming\6wPPpQF
2014-12-23 17:08 . 2015-01-06 10:01 -------- d-----w- c:\users\Lisa\AppData\Roaming\bBmz2SW
2014-12-18 04:12 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-18 04:12 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-15 11:03 . 2015-01-07 12:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-12-15 11:03 . 2015-01-07 15:06 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-12-12 02:14 . 2014-07-07 02:06 24576 ----a-w- c:\windows\system32\mfpmp.exe
2014-12-12 02:14 . 2014-07-07 02:02 2048 ----a-w- c:\windows\system32\mferror.dll
2014-12-12 02:14 . 2014-07-07 01:37 2048 ----a-w- c:\windows\SysWow64\mferror.dll
2014-12-12 02:14 . 2014-07-07 02:06 55808 ----a-w- c:\windows\system32\rrinstaller.exe
2014-12-12 02:14 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2014-12-12 02:14 . 2014-07-07 02:06 206848 ----a-w- c:\windows\system32\mfps.dll
2014-12-12 02:14 . 2014-07-07 01:40 103424 ----a-w- c:\windows\SysWow64\mfps.dll
2014-12-12 02:14 . 2014-07-07 01:39 50176 ----a-w- c:\windows\SysWow64\rrinstaller.exe
2014-12-12 02:14 . 2014-07-07 01:39 23040 ----a-w- c:\windows\SysWow64\mfpmp.exe
2014-12-12 02:14 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll
2014-12-11 02:25 . 2014-11-22 02:50 66560 ----a-w- c:\windows\system32\iesetup.dll
2014-12-11 02:24 . 2014-11-08 03:16 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-30 20:57 . 2014-06-03 21:20 13792 ----a-w- c:\windows\system32\drivers\semav6thermal64ro.sys
2014-12-12 02:21 . 2010-04-07 21:25 112710672 ----a-w- c:\windows\system32\MRT.exe
2014-12-10 15:00 . 2012-11-20 11:19 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-12-10 15:00 . 2012-11-20 11:19 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-24 13:04 . 2010-06-01 12:58 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-11-21 21:22 . 2014-11-21 21:23 719521 ----a-w- c:\windows\unins000.exe
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-11 03:08 . 2014-11-19 17:15 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 17:15 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-11-19 17:15 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 17:15 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-10-25 01:57 . 2014-11-12 08:39 77824 ----a-w- c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-12 08:39 67584 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-12 08:39 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-10-18 01:33 . 2014-11-12 08:39 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-10-14 08:57 . 2013-05-07 18:13 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-10-14 08:57 . 2013-03-30 23:32 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-10-14 08:57 . 2013-03-30 23:32 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-10-14 02:16 . 2014-11-12 08:42 155064 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 02:13 . 2014-11-12 08:42 683520 ----a-w- c:\windows\system32\termsrv.dll
2014-10-14 02:13 . 2014-11-12 08:39 3241984 ----a-w- c:\windows\system32\msi.dll
2014-10-14 02:12 . 2014-11-12 08:42 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-10-14 02:09 . 2014-11-12 08:42 146432 ----a-w- c:\windows\system32\msaudite.dll
2014-10-14 02:07 . 2014-11-12 08:42 681984 ----a-w- c:\windows\system32\adtschema.dll
2014-10-14 01:50 . 2014-11-12 08:42 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-10-14 01:50 . 2014-11-12 08:39 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-14 01:49 . 2014-11-12 08:42 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-10-14 01:47 . 2014-11-12 08:42 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2014-10-14 01:46 . 2014-11-12 08:42 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
2014-10-10 00:57 . 2014-11-12 08:39 3198976 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 131480 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 131480 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 131480 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VeohPlugin"="c:\program files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2013-12-27 4686848]
"SpywareTerminatorUpdate"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-12-22 3318784]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]
"Akamai NetSession Interface"="c:\users\Lisa\AppData\Local\Akamai\netsession_win.exe" [2014-10-29 4673432]
"Spotify Web Helper"="c:\users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-24 1514040]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-08-07 43816]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHVE.EXE" [2012-07-12 241280]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22040168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792]
"SMSTray"="c:\program files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 126976]
"MAAgent"="c:\program files (x86)\MarkAny\ContentSafer\MAAgent.exe" [2007-01-30 57344]
"SpywareTerminator"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2010-12-22 2557440]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-17 538472]
"BEWINTERNET-SPSessionManager"="c:\program files (x86)\Orange\Internet Everywhere Pro\SessionManager\SessionManager.exe" [2010-03-22 140016]
"CardDetectorHUAWEI1752_1552"="c:\program files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe" [2010-03-22 295664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"FUFAXRCV"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe" [2011-03-08 495616]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2011-03-08 856064]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-06-07 522744]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-09 702768]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-11-20 126200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallDeleteDir"="rmdir" [X]
.
c:\users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-12-9 39207112]
OpenOffice.org 3.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
tbhcn.lnk - c:\users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe -interval=10 -IEhome=0 -IEsearch=0 -FFhome=0 -FFsearch=0 -CHhome=0 -CHsearch=0 -pubId=ginyas_377 -affId=g377_sfexp_de [2012-7-2 695448]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-11-04 17:32 98304 ------w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe"
"MarketingTools"=c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ESRV_SVC;Energy Server Service;c:\program files\Sony\VAIO Care\ESRV\esrv_svc.exe --AUTO_START --start --address 127.0.0.1;c:\program files\Sony\VAIO Care\ESRV\esrv_svc.exe --AUTO_START --start --address 127.0.0.1 [x]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys;c:\windows\SYSNATIVE\drivers\IntcHdmi.sys [x]
R3 McComponentHostServiceSony;McAfee Security Scan Component Host Service for Sony;c:\program files (x86)\Sony\MSS\3.8.130\McCHSvc.exe;c:\program files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [x]
R3 semav6thermal64ro;semav6thermal64ro;c:\windows\system32\drivers\semav6thermal64ro.sys;c:\windows\SYSNATIVE\drivers\semav6thermal64ro.sys [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\vuagent.exe;c:\program files\Sony\VAIO Update\vuagent.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 USER_ESRV_SVC;User Energy Server Service;c:\program files\Sony\VAIO Care\ESRV\esrv_svc.exe;c:\program files\Sony\VAIO Care\ESRV\esrv_svc.exe [x]
S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-19 22:40 1104200 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-20 15:00]
.
2015-01-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core.job
- c:\users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-08 21:24]
.
2015-01-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA.job
- c:\users\Lisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-08 21:24]
.
2015-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27 03:01]
.
2015-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-11-27 03:01]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-22 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-22 387608]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-22 365592]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-09-17 7938080]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-09-17 1833504]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = about:blank
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
mSearch Bar = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local>
mSearchAssistant = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.178.1
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Wow6432Node-HKU-Default-Run-EPLTarget\P0000000000000000 - c:\windows\system32\spool\DRIVERS\x64\3\1\E_YATIHVE.EXE
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
AddRemove-WinServices - c:\programdata\uninstall_Winservices.exe
AddRemove-FoxTab PDF Creator - c:\program files (x86)\FoxTabPDFConverter\Uninstall\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\progra~2\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgr.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\ Malwarebytes Anti-Malware \mbam.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-01-07 16:41:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-01-07 15:41
.
Vor Suchlauf: 15 Verzeichnis(se), 54.561.816.576 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 54.411.264.000 Bytes frei
.
- - End Of File - - EB18CD83EEF71C94F3C9F90CF7F5AFAF
A36C5E4F47E84449FF07ED3517B43A31 |
|
07.01.2015, 18:09
| #8 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.01.2015, 20:49
| #9 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Malwarebytes Anti-Malware Malwarebytes | Free Anti-Malware & Internet Security Software Suchlauf Datum: 07.01.2015 Suchlauf-Zeit: 19:01:45 Logdatei: suchlauf.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.07.11 Rootkit Datenbank: v2015.01.07.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Lisa Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 389835 Verstrichene Zeit: 35 Min, 29 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Malwarebytes Anti-Malware Malwarebytes | Free Anti-Malware & Internet Security Software Protection, 07.01.2015 12:01:57, SYSTEM, LISA-VAIO, Protection, Malware Protection, Starting, Protection, 07.01.2015 12:01:57, SYSTEM, LISA-VAIO, Protection, Malware Protection, Started, Protection, 07.01.2015 12:01:57, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 12:06:01, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Update, 07.01.2015 12:53:53, SYSTEM, LISA-VAIO, Scheduler, Rootkit Database, 2014.12.30.1, 2015.1.6.1, Update, 07.01.2015 12:54:07, SYSTEM, LISA-VAIO, Scheduler, Malware Database, 2015.1.6.3, 2015.1.7.7, Protection, 07.01.2015 12:54:07, SYSTEM, LISA-VAIO, Protection, Refresh, Starting, Protection, 07.01.2015 12:54:07, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopping, Protection, 07.01.2015 12:54:08, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopped, Protection, 07.01.2015 12:55:09, SYSTEM, LISA-VAIO, Protection, Refresh, Success, Protection, 07.01.2015 12:55:09, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 12:55:09, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Detection, 07.01.2015 13:13:21, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 79.135.131.146, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 13:13:22, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 79.135.131.146, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 13:41:46, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 176.115.108.100, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 13:41:46, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 176.115.108.100, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Update, 07.01.2015 13:58:54, SYSTEM, LISA-VAIO, Scheduler, Malware Database, 2015.1.7.7, 2015.1.7.8, Protection, 07.01.2015 13:58:54, SYSTEM, LISA-VAIO, Protection, Refresh, Starting, Protection, 07.01.2015 13:58:54, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopping, Protection, 07.01.2015 13:58:54, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopped, Protection, 07.01.2015 14:01:11, SYSTEM, LISA-VAIO, Protection, Refresh, Success, Protection, 07.01.2015 14:01:11, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 14:01:12, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Detection, 07.01.2015 14:01:24, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 84.204.194.234, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 14:01:24, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 84.204.194.234, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 14:44:11, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 93.125.93.102, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Detection, 07.01.2015 14:44:11, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, IP, 93.125.93.102, 6881, Outbound, C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe, Update, 07.01.2015 15:03:50, SYSTEM, LISA-VAIO, Scheduler, Failed, Unable to access update server, Protection, 07.01.2015 16:07:13, SYSTEM, LISA-VAIO, Protection, Malware Protection, Starting, Protection, 07.01.2015 16:07:13, SYSTEM, LISA-VAIO, Protection, Malware Protection, Started, Protection, 07.01.2015 16:07:13, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 16:10:20, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Update, 07.01.2015 16:53:48, SYSTEM, LISA-VAIO, Scheduler, Rootkit Database, 2015.1.6.1, 2015.1.7.1, Update, 07.01.2015 16:53:59, SYSTEM, LISA-VAIO, Scheduler, Malware Database, 2015.1.7.8, 2015.1.7.11, Protection, 07.01.2015 16:53:59, SYSTEM, LISA-VAIO, Protection, Refresh, Starting, Protection, 07.01.2015 16:53:59, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopping, Protection, 07.01.2015 16:53:59, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopped, Protection, 07.01.2015 16:54:40, SYSTEM, LISA-VAIO, Protection, Refresh, Success, Protection, 07.01.2015 16:54:40, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 16:54:41, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Update, 07.01.2015 18:52:29, SYSTEM, LISA-VAIO, Scheduler, Failed, Unable to access update server, Protection, 07.01.2015 18:58:53, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopping, Protection, 07.01.2015 18:58:53, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopped, Protection, 07.01.2015 18:58:53, SYSTEM, LISA-VAIO, Protection, Malware Protection, Stopping, Protection, 07.01.2015 18:59:22, SYSTEM, LISA-VAIO, Protection, Malware Protection, Stopped, Protection, 07.01.2015 19:01:07, SYSTEM, LISA-VAIO, Protection, Malware Protection, Starting, Protection, 07.01.2015 19:01:07, SYSTEM, LISA-VAIO, Protection, Malware Protection, Started, Protection, 07.01.2015 19:01:08, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Update, 07.01.2015 19:01:11, SYSTEM, LISA-VAIO, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, Update, 07.01.2015 19:01:11, SYSTEM, LISA-VAIO, Manual, Rootkit Database, 2014.11.18.1, 2015.1.7.1, Protection, 07.01.2015 19:01:19, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Update, 07.01.2015 19:01:31, SYSTEM, LISA-VAIO, Manual, Malware Database, 2014.11.20.6, 2015.1.7.11, Protection, 07.01.2015 19:01:31, SYSTEM, LISA-VAIO, Protection, Refresh, Starting, Protection, 07.01.2015 19:01:31, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopping, Protection, 07.01.2015 19:01:31, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Stopped, Protection, 07.01.2015 19:01:39, SYSTEM, LISA-VAIO, Protection, Refresh, Success, Protection, 07.01.2015 19:01:39, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Starting, Protection, 07.01.2015 19:01:39, SYSTEM, LISA-VAIO, Protection, Malicious Website Protection, Started, Scan, 07.01.2015 19:37:15, SYSTEM, LISA-VAIO, Manual, Start: % 1 "% 2", Dauer: % 1 min 35 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 0-Malwareerkennung, (end)AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 07/01/2015 um 20:16:09
# Aktualisiert 21/12/2014 von Xplode
# Database : 2015-01-03.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Lisa - LISA-VAIO
# Gestartet von : C:\Users\Lisa\Desktop\Downloads\AdwCleaner_4.106(2).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Mozilla Firefox v34.0.5 (x86 de)
-\\ Google Chrome v36.0.1985.125
*************************
AdwCleaner[R0].txt - [44236 octets] - [16/06/2014 08:00:09]
AdwCleaner[R10].txt - [1921 octets] - [07/01/2015 19:46:56]
AdwCleaner[R11].txt - [1982 octets] - [07/01/2015 20:10:25]
AdwCleaner[R1].txt - [14078 octets] - [02/09/2014 10:35:37]
AdwCleaner[R2].txt - [12654 octets] - [18/09/2014 16:22:06]
AdwCleaner[R3].txt - [13445 octets] - [06/10/2014 10:04:42]
AdwCleaner[R4].txt - [13506 octets] - [06/10/2014 10:08:18]
AdwCleaner[R5].txt - [1905 octets] - [11/11/2014 15:17:22]
AdwCleaner[R6].txt - [5735 octets] - [14/11/2014 17:24:33]
AdwCleaner[R7].txt - [1764 octets] - [23/12/2014 17:57:13]
AdwCleaner[R8].txt - [1915 octets] - [28/12/2014 19:24:39]
AdwCleaner[R9].txt - [1860 octets] - [05/01/2015 13:13:51]
AdwCleaner[S0].txt - [40396 octets] - [16/06/2014 08:03:33]
AdwCleaner[S1].txt - [12935 octets] - [02/09/2014 10:45:17]
AdwCleaner[S2].txt - [10512 octets] - [18/09/2014 16:28:24]
AdwCleaner[S3].txt - [13361 octets] - [06/10/2014 10:09:41]
AdwCleaner[S4].txt - [1966 octets] - [11/11/2014 15:25:16]
AdwCleaner[S5].txt - [5422 octets] - [14/11/2014 17:34:11]
AdwCleaner[S6].txt - [1825 octets] - [23/12/2014 21:00:05]
AdwCleaner[S7].txt - [1930 octets] - [29/12/2014 15:59:32]
AdwCleaner[S8].txt - [1903 octets] - [07/01/2015 20:16:09]
########## EOF - C:\AdwCleaner\AdwCleaner[S8].txt - [1963 octets] ##########
jetzt noch der JRT und FRST Scan: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.1 (12.28.2014:1) OS: Windows 7 Home Premium x64 Ran by Lisa on 07.01.2015 at 20:31:04,49 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\veohplugin ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\babylon" Failed to delete: [Folder] "C:\Users\Lisa\AppData\Roaming\browsercompanion" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\dll-files.com" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\dvdvideosoftiehelpers" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\freecompressor" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\getrighttogo" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\performersoft" Successfully deleted: [Folder] "C:\Users\Lisa\AppData\Roaming\toolplugin" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\apn" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\babylon" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\conduit" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\cre" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\freecompressor air" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\globalupdate" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\local\opencandy" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\locallow\certifiedtoolbar" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\locallow\conduit" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\locallow\pdfforge" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\locallow\simplytech" Successfully deleted: [Folder] "C:\Users\Lisa\appdata\locallow\softonic" Successfully deleted: [Folder] "C:\Program Files (x86)\dll-files.com fixer" Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{006B50E9-6596-4F68-A13C-C455D4B2756E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{016E35A8-673F-4A3A-9D1A-42C682C51AEE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{02C2EA24-CACD-4869-A6E3-E3C77D585E8B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0393C8D0-6EEC-484F-B5D4-B0817FB30D1F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0574D85C-03B7-450F-9D40-D1855F8C807A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0585F507-6CE4-408C-A253-FFD3D8C95C9E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{059B54C5-33E6-4E1D-8138-7D0B821649DA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{05DA813E-BBF6-472B-9D99-D37D89513A40} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{06D0E113-533B-4E58-BB96-809BD42C537A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{07A393FF-A42E-4AF7-9461-8DFA905B059E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{07B933B2-F953-45D2-88F1-C162405E513D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0861376C-8ACC-48D7-9784-C80D6F8749D7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0952C552-F71C-42A4-96E2-5B6EC83F2CBD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0A214FB6-0260-4AE2-9CCF-AD8A80C33A61} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0A70ED9C-8A82-455C-9077-EE7DDFF611B0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0BA3B151-86E7-468D-8516-4EB6E4957629} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0C087F5F-64E3-4CF0-A7B1-D834F141CDCD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0C6BE08E-64F6-44F5-B596-F7C255D9C5A0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0CA58F0C-406E-4830-892B-856CD742F4B9} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0CCD75E1-6522-4B86-BDC4-C98CC4EE72CD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0CF1F3C8-3DBF-4D92-A228-0524D0A69832} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0D600E6D-70C8-485B-8D7F-9F5BE12BFB32} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0E5A3E4F-5246-4E78-BC12-F99301CB410C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0E72553D-1059-4C61-830D-54B0FC3B5FB1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{0FD5C913-F4FB-4C31-9B23-9DF1D43464D8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{10ED3ACA-87C3-4473-9B32-75E6B1902E67} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{11AA4E15-A5EC-4EEA-A438-D4C9744F51D7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{11B8C76D-C510-4F64-93F7-59B8044CF094} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{12C10C1C-8816-4503-8DE7-304E0729776A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1320BBD6-B2E9-489B-B09C-DFF66FFACE60} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{135A99D3-B80D-4CB4-A28C-D9DC6B3A79A4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{175B4C8E-9B53-4901-A34B-ED4B5F8DE962} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{17CA814C-9C85-4E70-B246-0DB9A6F4F832} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1912E186-C52B-48CE-9EB4-095E85C1DC13} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{19A5A6F6-63FF-413C-8269-7320D1CF84BA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1A3CED49-75AB-42A0-803B-2858F6607610} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1B03D39A-6EA8-4E9B-8B7F-AB119BC039B5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1B17FC5E-0443-4022-90DF-6AB3AB2769C6} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1B7CD43C-DD01-470A-A2AD-012F2661E39B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1D1832F3-E63E-4D40-A5D7-169724108E83} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1E780334-0F22-4CD2-B8C9-E37D7B9C8693} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{1F78804A-A629-4D82-AFB3-0CA0C6D4008B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{20498520-C1E7-4230-94FB-6BC402D56FDF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{209C1E03-5D0C-4279-A81E-A8F32DE308EE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{21AB5557-1ED3-48D7-8963-69B48B2A24B4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{22421EE2-87DC-4151-B7EA-01C4DB090E08} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{230BC8D3-D73B-4F23-971F-2AB17308831C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{23352B06-5C51-402E-9001-5119778006C8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{239AE28E-C6EA-4178-B6AF-2FEE467EA76A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{26527F38-7D66-4CCB-B5C5-193B8FF53E91} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{26CFCF46-6E91-4F6F-9A0A-DE625D1AF585} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{272EBCAB-991D-452D-987D-A9CBE3672AE0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2871E61A-46B4-49A4-952E-3ED7E3C98295} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{29502D52-2ADD-42D9-AD9C-EE92C8C40AE1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2BEC7158-9BE9-4939-AED2-415BE2FAFF04} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2CA30863-4483-4C75-8271-BB54D405EA7E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2D140BF4-5D81-4216-883F-59F98431B37A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2DC5574F-4FC2-4933-8CED-6DAE1DDC8160} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2E29A963-B1B4-4F59-9A65-AFBBFDBD8E78} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2E736305-9111-418B-A8B9-9C46DDA16D93} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{2EECE403-6F23-4501-A29A-CDBFB08A36D5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{303A7C86-E883-4189-93D3-BFBCC9E2D46A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{30FB436E-4713-49CA-88B7-C19A21351577} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3159187D-ED59-4C41-AC9E-10101C4677B4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3284CF2E-18D2-4769-A82D-14DFE035A50C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{329B54BB-3AC9-4AC2-9F7B-F7B6B0AE4758} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{331B1C32-E655-44FC-9CB0-E0C4AE7A215A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{33389163-A5A2-4497-AF34-95666136EACB} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3422A442-F81F-4E3F-953B-6A6E791ADC7B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3481A4E4-41C6-49AE-B345-5C401FAC225A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{35C9B438-91B9-4E62-B4E6-9E504AD1BF82} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{37035CD2-02FD-4BBD-84D8-9F17EA7AD827} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3755B025-8A53-4E3F-B85F-0AC96516BDFD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{37ED1175-ABCE-49AA-991F-8CCFECFA9881} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{37EE21C4-6307-4749-9578-54526D4AD449} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3914B4F8-B66A-48F5-ADE2-49197F38C452} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3916537C-32F0-4394-BACB-73558A113250} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3A66C6FD-10F8-4548-AC7A-56D060684448} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3AAB718B-9DA1-4351-BA7D-9844C8ED3F59} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3ADDBF7F-CF02-46C8-8B1F-190E65E1039B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3B266892-C4C7-4858-A01B-BAA654B604D0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3C01A780-776E-4C28-B7CC-4EB63EB0AA27} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3C204ED2-87E6-419A-8ED1-CDA06C5430F0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3C801BB6-413F-4B81-A394-35B46C4CFA81} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3C8B5D6D-8854-47A1-9763-6012E3A2AE42} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3DEC30B8-FBA6-416F-B4B7-4DAF9F232BBD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3E7F67C9-CAC4-4CAD-B970-103D66FC9586} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{3EC9AFC5-0A5B-45C1-8B69-4764E3ED2E20} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{40DE18AC-AE61-4D21-AD35-087AC37D0EB1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{414A03B0-510A-4E07-BEA1-47D6C6C3F626} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{415FCBB9-C232-4603-8A31-8EC87F54BFBC} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{429D79FF-8BCA-420E-BACD-8A4658B80EE5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{434FF0BA-020A-4671-9AB8-3B9CF34CEF6B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{439139FA-8911-4470-ADA6-12923E0C935B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{445FD96A-9319-4049-8F0E-10FB898B1B0D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{44A10883-D84B-43C4-A45C-9B2324A064C7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{44CCDA8B-F54B-4B52-87D8-270CD81D4313} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4556CD6B-0FF9-4415-AF1D-100B71FFB5B4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{455922DF-35D4-46C8-B26A-1D55C6C797D3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{45D21D81-9D51-427E-ABB7-7C1C55D584E4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4731CED8-41D8-48BC-878C-FBEBA24774EA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{47C41083-1106-4E42-99A1-D434D357BB33} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{49E365C3-6EE0-4C98-9CAC-79B33852691A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4A539DF4-105C-4AE1-BF8F-17C61D3329B7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4AB0C25C-4A5C-4E86-B6CE-47B1FD1A8DE7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4AFE35C9-E4ED-4398-B384-70E2214DFE5C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4B3F45E2-85B9-4328-8DAE-4DFA5534518F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4B59BE98-4091-4EBE-92A8-C6E2FD892D9A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4D809932-000A-448F-BA3C-27117F37AEEA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4ECF7E5C-E68C-4234-A811-9755A98314F9} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{4F30C1C3-96B1-4FE8-B0F4-1FBE1B007FAE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5091890F-9943-4E4E-BE2D-7F5CC50C5F65} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5144D523-4A57-44F3-8D0D-55935E686641} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5171E99F-E2E7-428A-96BC-28721D9C3DB3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{53889981-2129-4FE3-ADCB-27E8EED2124A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{55F13BCC-EDA2-4FEF-8824-492260F98A5B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{560636CE-2BA0-4A94-B18D-5854E69CF868} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{56A1C490-E0D7-4B27-8BDD-A69B78396EDE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5711DE4D-3428-4E74-A698-48BA5BE1BB5D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{58BDA9DC-E38A-46C8-B15A-2BC459FA163F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5AB9E5C1-7B76-4A52-9C0E-C2FACA147E93} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5B444FFB-CBE1-4158-9DEA-10D503043275} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5BEB130E-794C-4356-907A-A18906091126} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5DA25256-930D-4251-ABEE-575280296DE0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5E1B572A-93ED-408C-A31E-1F11993161CC} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5EF55E0C-F597-4398-B2F1-DFC72C2A5C65} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5FB6DC22-9094-4645-8546-67BC1A6BDAD5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5FC3DB27-FF9B-47DC-90D3-5048ED435EF7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{5FC47782-F5F3-4A0E-87EF-736ADB016535} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{60E13688-52C8-44AE-A648-867EFDB19DF1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{60E9A87E-F7E2-44A1-9B7E-C68D8F47CFAF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{60FE4EE9-38F4-4687-8388-ADE57BC88BDF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{62799EB1-3861-4C6E-93B8-2D74A8AA2D97} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{62981089-9986-4553-9AD0-E92B98E6E0C2} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{62FA32C9-DFC3-4F4A-9EE0-E2F33EA555FA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{62FDB56E-39DC-4CE3-9F62-7653DDCD8291} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{631493A1-9E86-415E-B66A-FD6FDD992B7B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{650D5583-ED56-400B-9199-1E0C1B89A967} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{671C791F-2A64-49F1-B8FA-F9D96CD83DF4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{67CB7070-567A-431C-84A4-E254450A8A26} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6830E4D5-E009-41F2-8290-8E80E861DE95} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{692B9307-CB18-4065-AE49-0AF609DE1731} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6B4AA2D5-0EFF-4575-B923-2250E6FC1DD3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6C010B01-0C3A-45C3-9165-7F58EB88BF95} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6C29CCCF-78E0-4D8F-9659-E6018D9C8203} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6CB24E30-EFDE-4F22-B35A-49F0D24160D0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{6CF4711A-28D1-482D-B430-ED7202FB770F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{71797796-6C9A-43C1-B4C3-922442E2416B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{729112A7-808E-48BA-85E0-119C0C6BB800} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{73235588-2BB7-4443-9D83-39480A4A6F9B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{734C55DC-640A-41C2-9A7A-18F0F9646FE7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{74181401-E17F-46EE-9DF3-D768E944C55F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7573B1FB-361F-4909-9DD1-D0A4212D0F12} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{77D3F6FB-8D8A-4382-886B-F85CF20360E7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7A0F0D7E-8AC7-45BA-AA62-F458AA50160B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7AB2FED1-E509-4B00-8378-CD98670EB69B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7B4E0268-6348-4241-852B-8C2235C068F8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7B97270E-F87A-49D9-BB36-1C3FF0C7BBFA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7C221BA3-87F7-477F-9F81-15F5DDFCF676} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7D08A638-AA5C-4923-800F-BF48975D36F5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7D3362B2-FCEC-4C00-A886-34373E98C80A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7D9185E5-51A9-4B33-8D03-259420C847EB} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7DE4D0C7-D18D-4ADF-8E60-2BBDC9BCE931} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{7E10EC42-8767-446E-B989-7943B845A9AB} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8148A5E6-3F0E-439F-B2BF-4BCA03B2AD4D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{82952650-CAC2-400B-A20C-7519EC0AD847} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{830F46F6-76C1-46A5-9745-F8CB62FBED4F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8319CAA3-ECF3-432C-9EF6-7D3E3C07BEFA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{83DAB97E-CB33-4D2C-A0D4-9FC48104AED2} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{843BBBFF-D682-4EAA-8080-41801F48F4C7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{859CCB4C-C37C-471A-9692-C0EF641ED4B3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{85DF745A-314C-4AC2-B737-FE4FAB332794} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{867282C9-7054-459D-92F3-2A7BC986B349} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{885F9322-682A-42DE-8FAC-3D8BA3464D4B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{88F474A7-96B5-46DD-B0C2-8350F113EAFF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{892F0387-D9DB-4071-9646-BDF57C32D678} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{895DAE39-E1EC-4C90-A39D-DAD9976187EC} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{899BA4DB-F886-4C20-A13A-611CE423D42F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8AC69C41-E9D0-4EA3-B0AC-7F1A8A27084D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8ADCC187-2E80-4A86-870D-6B2CAB0DD33C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8BEAD526-BC37-41C4-BACC-C133D31E453A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8F179C5A-9DB4-4A66-B6EB-16A28C45F5A0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8FA79195-AA59-4D7F-ADF1-2E134F924891} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8FAD76C4-FDE2-449A-9483-30CC1344C370} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8FBA514D-C69F-4CF9-9F44-B7273F7F80B3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{8FDF0790-B94C-42C1-A70D-181DC01EB41C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{91517AAC-7159-4FB0-8ACB-50CF0DDA8D01} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{916D07BB-4BA8-4514-A1B5-C0C98729C902} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{918B1FC7-F018-42DE-8D03-5E85295C0DBA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9302C35A-007E-45BC-ABEA-61356FCC710C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{934677D0-6355-42EC-B5B2-036F81705C06} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{934DFBFC-E878-4134-B7B5-60E48FE5430E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{94756554-26A2-4EA2-BF01-110D1585E96A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{95BD16EA-6504-42EA-8BEC-96944D7CD4EA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9621CA09-F91C-447B-9BEA-C98A0F824A7F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9675D727-5FD7-4941-95DB-F3E28843449A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{972F2FF4-5BB4-44FD-B223-E1833EBD6A98} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{97C2D974-8B7C-44BC-8547-93A176BD65BE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{97FB26DE-1E87-448C-B27A-2AFC4ABEAF9E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{98083866-8782-44AF-91F7-5254A4B85BE9} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9836ED82-DCBE-4324-B535-81C11EBCE164} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{99021E78-673F-44D2-AFB1-C4370959B3BF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{99B2F5D4-BF9C-48E0-B41C-A2EBFA71A521} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9C7D8478-A241-44C4-BECF-88042B8DCE93} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{9F226C04-01FD-4A13-9E83-87F2751A8ED2} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A11F23FC-1CE2-4695-8747-596FCFA045C7} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A21C7496-EFD7-42FD-A8B3-20A4B24DBFC0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A467ED2B-5D78-4CDB-937D-5F5A38732377} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A4FC2D9C-24EB-4B52-B993-92854B2F5A65} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A530D628-072E-4C95-B01F-259AD3FC12C5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A5CE07BE-0CBD-479B-8FA5-45B9B3EAFC50} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A82FB4E7-0FCB-4380-9769-482E8E3C0866} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A8D98836-EE3C-4813-B0B1-FE7607F4709D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{A90F1C3B-4BA5-40C3-BCBD-1176286B4FE8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{AA66D303-EBC0-4ADF-966A-10DB16C9CFEA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{AB0B620C-CEC5-40BE-B7C6-7C087B312371} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{ABFCA7CF-E48C-4831-A3A0-F5902089402F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{AD1AAFF3-6758-46E6-9B5F-A1851AC48243} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{ADCD7C43-848D-4228-A50D-29A88007BD61} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{AE18772C-93D9-4C7B-89C2-F75AC335EF6D} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B0694B7B-F60E-4774-A372-487EAAD1E9DB} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B55D6D75-9A31-4682-87FF-FD2103A489DE} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B61B2991-ACC9-4E14-BBAC-8E4DCF41DBF3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B772BB3F-5885-4CC3-8DC6-336AFD40500B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B79A0C06-94EB-4506-8227-6E3E5FDF4819} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B877403B-90FB-429A-9093-D5790AFD5BC1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B89A2FFA-E904-4506-BF1D-29068A677300} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B8CD5A92-2F45-4FB7-88BA-0F33FB032384} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{B94B90F9-A95E-47EC-AFF8-97463C6456FC} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{BA24C881-5A8C-46C4-9108-D312CEFAFA9E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{BDA36237-A962-4640-9A27-C2E923F31182} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{BE7F8828-07FA-45BC-BC5C-E49D91E617DF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{BE8ED21D-C669-4577-B1A0-AD6C8CCE4A24} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{BF97932D-7C36-48D3-B019-931C55B65192} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C323DEC8-539B-4714-88B3-7F56BEA8E99A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C434CAF4-96B7-4C73-B435-C7B0981A7A4F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C4DF71D5-D85C-41C1-A510-7D188B077B1E} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C59C4F08-7815-46F6-ABA7-CD2A192CD294} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C5D0BF9C-799E-4935-A6F2-1224FEEF91D3} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{C85D6897-80C3-461D-8220-94428E618DA1} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{CAC217D9-8B49-4CF7-9C13-651464F885AF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{CBC4FBC9-7D52-4FB0-8580-1BE0944448D8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{CC5C8913-D11D-430A-87F6-1669DE95EA24} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{CCA221F3-FBC5-4A38-84D1-2DDE998EC418} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{CDAEE0BF-2F70-4D67-A133-AA0886295433} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D0AC6836-7614-4459-B628-D33F1DCC70F6} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D0F93F2E-D77B-4381-9F59-FE2439AD7344} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D20665C7-3A4B-4427-89E0-5B3EA2DA6925} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D22A5A2A-756C-466B-994B-B600A47B3C8C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D34A1C9F-027A-4AB7-AD41-C716EF2801D5} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D35B9B7B-52F8-4F06-840B-FA37453C6904} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D3641EF7-888E-4E41-9426-3AD2CF228182} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D38AD73A-C0B1-4EE2-8467-C9C6BBDBCB80} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D4063052-C0F4-42FB-9A5B-A7712D0F8915} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D4449C9C-0142-42BB-A4B1-C30A16C0CDD2} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D44531C6-DB12-4EB4-8232-A905D0DF0427} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D47DDBB9-CC3E-493B-B053-6D82D40F1E95} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D4916DB1-A734-43EB-8E2B-23C664BAA93F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D534CEC9-2304-4908-9313-97C39FA03E82} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D6CA7FE4-B58F-4DF4-9426-140AEDF4C1DA} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{D8BB7B84-5CEA-4FB2-9E40-CA76E2E881A9} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DB1F7055-9489-46E2-91E6-444B1306F76F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DB9B5E31-1495-4B14-B672-19D57260FBF6} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DBDDF678-BCC8-4A29-95A9-6BC137125086} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DC7DEFF9-AA65-46B7-A2E2-6E2366D54DB0} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DC7FFEA5-4818-4816-9FC9-734CA9085B6F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DDE34D8E-5993-4328-B798-6C2AA1F1F937} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DE24C77E-722E-4C73-87FD-BB51A21C75C4} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{DFC67199-AA24-44F8-956D-930B88AF0937} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E02228BC-922C-44E9-B700-03DCF5DD2C9C} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E05082B6-A5D2-42F7-B8E3-A1A93C859AB8} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E0E7AFC7-26EE-4503-BBD0-15F3055CD042} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E209EABF-3998-453A-B957-FC42DFE69717} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E2726C7B-9CFE-4BF1-B3F8-19C92F21894F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E2FD4073-C7D0-43E5-83B1-93F16056C4D6} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E93A255B-4AB3-4216-AE60-17BB41DCFBEF} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{E9E5FD43-58DE-4A82-9A7C-538A765C0A16} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{EC6C25FE-9DC9-4FDC-AA21-6954AFFDCF65} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{ECAB4CF1-BFB1-4B08-9030-AC34675C541B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F0677A65-7DF8-48BC-8611-247E68AE41CB} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F48D1E1E-075C-4C98-9EB8-5B0BF1141B30} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F56B9E14-A1AF-4C1B-9C64-5ABB2EB3F42B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F73BFBA7-4C7E-4DB6-8B92-E5D101D36B8B} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F73DA803-09CF-4C68-BEDD-1463087D2D4A} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F929CFAF-9F3B-410B-8904-CEF26E113697} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{F9D2262F-6281-4C07-B99A-72D7F713D165} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FA294E4E-30DD-4EA3-A31D-31C5446E0715} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FC107186-6BB2-4072-88F8-3B7EC344E655} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FC64796B-854F-41DA-A0C1-EEC8ED80B86F} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FD78EE6A-7D15-47F1-BC6C-B74C4A6B3EFD} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FE807680-62C0-4A04-9BA5-BAF8FDD70034} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FE840629-DDED-4DC2-9D84-3FBAF1765248} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FE894E7A-1D87-4807-AEC3-55D2F0E4FDD9} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FF6FE05A-D995-40B0-B700-6D9D46E87803} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FFB5BCC5-A4D7-451D-8A7F-FE6FEF622B82} Successfully deleted: [Empty Folder] C:\Users\Lisa\appdata\local\{FFE11F99-0E57-43FF-A2A0-9E2D74BE0F82} ~~~ FireFox Successfully deleted: [File] C:\user.js Emptied folder: C:\Users\Lisa\AppData\Roaming\mozilla\firefox\profiles\vrpndxi8.default-1415983384885\minidumps [2 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 07.01.2015 at 20:39:47,23 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015 Ran by Lisa (administrator) on LISA-VAIO on 07-01-2015 20:45:35 Running from C:\Users\Lisa\Desktop\Downloads Loaded Profile: Lisa (Available profiles: Lisa) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe (Veoh Networks) C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Spotify Ltd) C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Dropbox, Inc.) C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe (SAMSUNG ELECTRONICS) C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe ((주)마크애니) C:\Program Files (x86)\MarkAny\ContentSafer\MaAgent.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.Exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (France Telecom SA) C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXRCV.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\FAX Utility\FUFAXSTM.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe (ALPS) C:\Program Files\Apoint\Apvfb.exe (Thisisu) C:\Users\Lisa\Desktop\Downloads\JRT.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7938080 2009-09-17] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-09-17] (Realtek Semiconductor Corp.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-09-28] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation) HKLM-x32\...\Run: [SMSTray] => C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2007-02-23] (SAMSUNG ELECTRONICS) HKLM-x32\...\Run: [MAAgent] => C:\Program Files (x86)\MarkAny\ContentSafer\MAAgent.exe [57344 2007-01-30] ((주)마크애니) HKLM-x32\...\Run: [SpywareTerminator] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2557440 2010-12-22] (Crawler.com) HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation) HKLM-x32\...\Run: [BEWINTERNET-SPSessionManager] => C:\Program Files (x86)\Orange\Internet Everywhere Pro\SessionManager\SessionManager.exe [140016 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [CardDetectorHUAWEI1752_1552] => C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe [295664 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [522744 2012-06-07] (Cisco Systems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X] HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [SpywareTerminatorUpdate] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3318784 2010-12-22] (Crawler.com) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-04-22] (TomTom) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Spotify Web Helper] => C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-24] (Spotify Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHVE.EXE [241280 2012-07-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22040168 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk ShortcutTarget: tbhcn.lnk -> C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe () ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) BootExecute: autocheck autochk * sdnclean64.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-1835249705-154528930-3876099220-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-1835249705-154528930-3876099220-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {2FD26EDA-EF2A-45B5-A77D-D648C80D1EC9} URL = hxxp://www.zinio.com/search/index.jsp?s={searchTerms}&rf=sonyie8search SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {9CAD618A-B558-4860-B4CE-D3F506049A16} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms} SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {E3E73F4E-4BC0-418D-9621-5F3FA6E19E9F} URL = hxxp://de.shopping.com/?linkin_id=8056363 SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {F7122350-F123-4217-931D-E620592DF091} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) DPF: HKLM-x32 {55963676-2F5E-4BAF-AC28-CF26AA587566} https://asa03.lrz.de/CACHE/stc/1/binaries/vpnweb.cab DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553240000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {DAF7E6E6-D53A-439A-B28D-12271406B8A9} hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: ShellHook Class - {88485281-8b4b-4f8d-9ede-82e29a064277} - C:\Program Files (x86)\MarkAny\ContentSafer\MACSMANAGER.dll [192512 2004-11-23] (MarkAny Cooperation.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll No File FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1835249705-154528930-3876099220-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lisa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-maps.xml FF Extension: Adblock Edge - C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-11-14] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-09] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-11-16] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR Profile: C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avira Browserschutz) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-27] CHR Extension: (appbarioDE) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf [2014-10-27] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-10-27] CHR HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [ncapomajoehhoogiooemilfafoicepmc] - C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor_air_chrome.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-10-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2010-03-22] (France Telecom SA) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.) R2 MySQL; C:\Program Files\MySQL\MySQL Server 5.1\my.ini [8919 2010-04-29] () [File not signed] S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions) S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [189984 2009-09-17] (Realtek Semiconductor) S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation) S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation) R2 sp_rssrv; C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe [948775 2010-12-22] (Crawler.com) [File not signed] R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.) R3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [845312 2010-08-11] (Sony Corporation) [File not signed] R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-23] (DT Soft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-07] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd) R2 risdptsk; C:\Windows\system32\drivers\risdsn64.sys [76288 2009-09-23] (REDC) S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2014-12-30] () R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [50696 2010-07-07] (Windows (R) Win 7 DDK provider) S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 20:39 - 2015-01-07 20:39 - 00033587 _____ () C:\Users\Lisa\Desktop\JRT.txt 2015-01-07 20:30 - 2015-01-07 20:30 - 00000000 ____D () C:\Windows\ERUNT 2015-01-07 20:21 - 2015-01-07 15:55 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts.ac 2015-01-07 19:45 - 2015-01-07 19:45 - 00006858 _____ () C:\Users\Lisa\Desktop\suchlauf1.txt 2015-01-07 19:44 - 2015-01-07 19:44 - 00001204 _____ () C:\Users\Lisa\Desktop\suchlauf.txt 2015-01-07 16:41 - 2015-01-07 16:41 - 00034603 _____ () C:\ComboFix.txt 2015-01-07 13:59 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-01-07 13:59 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-01-07 13:59 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-01-07 13:55 - 2015-01-07 16:42 - 00000000 ____D () C:\Qoobox 2015-01-07 13:54 - 2015-01-07 16:38 - 00000000 ____D () C:\Windows\erdnt 2015-01-07 13:42 - 2015-01-07 13:42 - 00001264 _____ () C:\Users\Lisa\Desktop\Revo Uninstaller.lnk 2015-01-07 13:42 - 2015-01-07 13:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-07 12:48 - 2015-01-07 20:45 - 00000000 ____D () C:\FRST 2014-12-30 22:02 - 2014-12-30 22:02 - 00003130 _____ () C:\Windows\System32\Tasks\USER_ESRV_SVC 2014-12-30 22:01 - 2014-12-30 22:01 - 00002027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care.lnk 2014-12-30 22:01 - 2014-12-30 22:01 - 00000000 __RHD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care 2014-12-28 18:16 - 2014-12-28 18:16 - 00001054 _____ () C:\Users\Lisa\Desktop\scan.txt 2014-12-28 17:37 - 2015-01-07 20:25 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-28 14:08 - 2015-01-07 18:59 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-28 14:08 - 2015-01-07 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2015-01-07 18:59 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2014-12-28 14:08 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-28 14:08 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-28 13:55 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-12-28 13:55 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\bBmz2SW 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6wPPpQF 2014-12-23 18:08 - 2014-12-23 18:08 - 00003278 _____ () C:\Windows\System32\Tasks\6yW3JnUcdFcSwI6 2014-12-23 18:08 - 2014-12-23 18:08 - 00003238 _____ () C:\Windows\System32\Tasks\0DpOX5082tGH1oL 2014-12-18 05:12 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 05:12 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-16 17:55 - 2014-12-16 17:55 - 00000000 ____D () C:\Users\Lisa\Desktop\Cal 2014-12-15 12:03 - 2015-01-07 16:06 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-15 12:03 - 2015-01-07 13:58 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-12-15 12:03 - 2014-12-15 12:03 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-12-12 03:14 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-12 03:14 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-12 03:14 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-12 03:14 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-11 03:26 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-11 03:26 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-11 03:26 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-11 03:26 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-11 03:26 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-11 03:26 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-11 03:26 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-11 03:26 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-11 03:26 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-11 03:26 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-11 03:26 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-11 03:26 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-11 03:26 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-11 03:26 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-11 03:26 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-11 03:26 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-11 03:26 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-11 03:26 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-11 03:26 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-11 03:26 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-11 03:26 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-11 03:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-11 03:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-11 03:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-11 03:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-11 03:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-11 03:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-11 03:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-11 03:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-11 03:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-11 03:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-11 03:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-11 03:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-11 03:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-11 03:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-11 03:24 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-11 03:24 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-11 03:24 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-11 03:24 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-11 03:24 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-11 03:24 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-09 14:27 - 2014-12-09 14:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 20:40 - 2012-07-25 13:33 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\BrowserCompanion 2015-01-07 20:31 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-07 20:31 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-07 20:29 - 2011-12-08 17:49 - 00001134 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA.job 2015-01-07 20:29 - 2010-01-07 17:04 - 01706068 _____ () C:\Windows\WindowsUpdate.log 2015-01-07 20:24 - 2011-05-09 21:31 - 00000000 ___RD () C:\Users\Lisa\Dropbox 2015-01-07 20:24 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Dropbox 2015-01-07 20:20 - 2009-11-27 04:01 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-07 20:18 - 2009-11-27 04:01 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-07 20:17 - 2014-10-06 10:12 - 00135316 _____ () C:\Windows\PFRO.log 2015-01-07 20:17 - 2014-10-03 10:48 - 00003696 _____ () C:\Windows\setupact.log 2015-01-07 20:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-07 20:16 - 2014-06-16 07:59 - 00000000 ____D () C:\AdwCleaner 2015-01-07 20:00 - 2012-11-20 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-07 17:56 - 2011-06-01 19:56 - 07732224 ___SH () C:\Users\Lisa\Desktop\Thumbs.db 2015-01-07 16:42 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-01-07 16:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-01-07 15:54 - 2010-01-07 17:17 - 00000000 __SHD () C:\Users\Lisa 2015-01-07 12:54 - 2014-06-12 12:24 - 00000000 ____D () C:\Users\Lisa\Desktop\Madrid 2015-01-07 12:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-01-07 12:09 - 2010-01-07 17:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB25F1A-BB3C-4A69-A37D-CE8C1215F895} 2015-01-07 12:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache 2015-01-06 11:01 - 2014-11-25 03:27 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6ZrCIYN 2015-01-06 11:01 - 2014-11-21 22:25 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\l1Vsnq1 2015-01-06 10:59 - 2010-04-17 20:38 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Skype 2015-01-05 23:29 - 2011-12-08 17:49 - 00001112 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core.job 2015-01-05 13:34 - 2014-10-11 14:24 - 00000000 ___RD () C:\Users\Lisa\Desktop\Dropbox 2015-01-05 13:09 - 2010-01-25 17:58 - 00000000 ____D () C:\Program Files (x86)\DivX 2014-12-30 22:05 - 2010-01-15 11:11 - 00000000 ____D () C:\Update 2014-12-30 22:02 - 2009-11-27 03:59 - 00000000 ____D () C:\Program Files (x86)\SONY 2014-12-30 22:01 - 2011-04-18 17:38 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation 2014-12-30 22:01 - 2009-11-27 04:18 - 00000000 ____D () C:\Program Files\Sony 2014-12-30 21:57 - 2014-06-03 22:20 - 00013792 _____ () C:\Windows\system32\Drivers\semav6thermal64ro.sys 2014-12-29 00:58 - 2010-09-27 21:36 - 00212992 ___SH () C:\Users\Lisa\Thumbs.db 2014-12-29 00:58 - 2010-02-06 18:15 - 00274944 ___SH () C:\Users\Lisa\Documents\Thumbs.db 2014-12-28 18:35 - 2009-11-27 12:52 - 05569300 _____ () C:\Windows\system32\perfh007.dat 2014-12-28 18:35 - 2009-11-27 12:52 - 01714936 _____ () C:\Windows\system32\perfc007.dat 2014-12-28 18:35 - 2009-07-14 06:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-28 18:21 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-19 04:34 - 2012-04-08 21:46 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Spotify 2014-12-18 14:28 - 2012-04-08 21:55 - 00000000 ____D () C:\Users\Lisa\AppData\Local\Spotify 2014-12-16 11:44 - 2014-08-21 13:36 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-16 11:44 - 2013-02-24 00:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-16 11:44 - 2013-02-24 00:06 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-15 22:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-15 11:47 - 2014-10-10 15:40 - 00001141 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk 2014-12-12 14:17 - 2014-11-23 19:39 - 00000002 _____ () C:\Users\Lisa\AppData\Local\recently-fix.db 2014-12-12 04:23 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-12 04:19 - 2014-06-15 18:59 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\wp_update 2014-12-12 04:00 - 2013-01-25 22:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-12 03:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-12 03:37 - 2009-11-27 04:07 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-12 03:34 - 2013-08-23 02:03 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-12 03:21 - 2010-04-07 22:25 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-10 16:00 - 2012-11-20 12:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-09 22:46 - 2011-12-24 00:49 - 00000000 ____D () C:\Users\Lisa\AppData\Local\Apple Computer 2014-12-09 22:01 - 2014-10-16 09:34 - 00000000 ____D () C:\Users\Lisa\Desktop\handy 10-2014 Some content of TEMP: ==================== C:\Users\Lisa\AppData\Local\Temp\avgnt.exe C:\Users\Lisa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpegljj2.dll C:\Users\Lisa\AppData\Local\Temp\Quarantine.exe C:\Users\Lisa\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 05:20 ==================== End Of Log ============================ --- --- --- |
|
08.01.2015, 07:27
| #10 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weissESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.01.2015, 16:11
| #11 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=f0d658bb07d0dc4ba01997155dcbef10 # engine=21866 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2015-01-08 12:15:56 # local_time=2015-01-08 01:15:56 (+0100, Mitteleuropäische Zeit ) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Avira Desktop' # compatibility_mode=1810 16777213 100 100 13813 165267934 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 64740 172349206 0 0 # compatibility_mode_1='' # compatibility_mode=7937 16777213 100 100 19963322 127681212 0 0 # scanned=347692 # found=91 # cleaned=91 # scan_time=9175 sh=C58417722C0B741EA8D55D06914E692180900885 ft=1 fh=f4976c33c2ff8570 vn="Win32/Toolbar.Conduit.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\appbarioDEToolbarHelper.exe.vir" sh=068A54F966DB6AC14BCA0E39E2A99E3F0027304D ft=1 fh=39f7a16b0423d981 vn="Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\hk64tbappb.dll.vir" sh=CC6AF3A384A61C1C621BA5AB43583E82FF281530 ft=1 fh=bbbd034bf7d0bf76 vn="Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\hktbappb.dll.vir" sh=9B3B44428CC80CC43F085AE514E7E16F7963EACC ft=1 fh=4c03fc1250fa29f9 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\ldrtbappb.dll.vir" sh=49F05B2770D4CAE7550D8268FDCF50E3BAEBB7CC ft=1 fh=f6f4f0e4f3b1176c vn="Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\prxtbappb.dll.vir" sh=33457E2F2405727124C107D6DEAF24C94E992463 ft=1 fh=e719e166edfd7994 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\appbarioDE\tbappb.dll.vir" sh=E6E5030CE503C21D099A641AA7D1883C64C76B4D ft=1 fh=4f33bb557a6fef8b vn="Variante von Win32/Toolbar.Widgi.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Application Updater\ApplicationUpdater.exe.vir" sh=650B8A3EE8E81EC2238BA1A0D3433FA0DD06B833 ft=1 fh=d6ebf5728f467ff4 vn="Win32/BrowserCompanion.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BrowserCompanion\jsloader.dll.vir" sh=D6C9AADF4998F5A84401C30B5F4E93F48D903794 ft=1 fh=0b972f7aa778831b vn="Win32/BrowserCompanion.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BrowserCompanion\tdataprotocol.dll.vir" sh=D4E707F12473B860EFC26AB446BFC3E6A1AC75B6 ft=1 fh=cc251c8346e403b7 vn="Win32/BrowserCompanion.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BrowserCompanion\toolbar.dll.vir" sh=79454306912F2B6EC4115260ED5612F12CCB103C ft=1 fh=9f42f3e157affa4c vn="Win32/BrowserCompanion.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll.vir" sh=7BA6B88A01305C75913525EA924AEBAFF6AD8366 ft=1 fh=b16139a7fd698cef vn="Win32/BrowserCompanion.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BrowserCompanion\widgetserv.exe.vir" sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir" sh=E8F29D7A5764101DD810D2DA898B9CAB2F37575A ft=1 fh=d72d025e343204f8 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe.vir" sh=BCBD0510CF35297226EC80C95CD0155397DC5390 ft=1 fh=fa792d0fae81d7ae vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.vir" sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir" sh=71B8F484BF5EAA7ACF749EB5714DA1AB6A19C61F ft=0 fh=0000000000000000 vn="Win32/Toolbar.Montiera.W evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\facemoods.crx.vir" sh=A7A358A1F2E7C85D2E73E424BCAA8B4F2F4D5A90 ft=1 fh=c71c0011905dfd23 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\facemoodsApp.dll.vir" sh=17E0A35D1955E6C5D71930153CB69C26AA2EB451 ft=1 fh=c71c001174c333ad vn="Win32/Toolbar.Montiera.U evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\facemoodsEng.dll.vir" sh=E1B8DB844C6D1876F8FAC760A847536048485EBF ft=1 fh=34edeb907fdc1fb5 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe.vir" sh=D089B122CE1A60E71A1704ACBB0E7809D101E2DC ft=1 fh=c71c00119d03c516 vn="Win32/Toolbar.Montiera.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll.vir" sh=B66A994A2E7E732C29779992319B297B74F3C736 ft=1 fh=c71c00114b5c327c vn="Variante von Win32/Toolbar.Montiera.W evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\facemoods.com\facemoods\1.4.17.3\bh\facemoods.dll.vir" sh=52E226E534EC9B8A279ED04F954D9956C3B16A5D ft=1 fh=83b9f7c036cbe7c0 vn="Win32/SpeedingUpMyPC.O Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptimizerPro.exe.vir" sh=ADDB4E66D46A81DBDB904A657B932A64406A3DDF ft=1 fh=4066cf42e6926943 vn="Variante von Win32/SProtector.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProCrash.dll.vir" sh=FB7DED585D152117D6BC04FCF4F980567D811386 ft=1 fh=36b3e63e710bc09b vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe.vir" sh=E988ADA1F88C4D228850E11F6503416B2B475816 ft=1 fh=fa78f74fb5f93ace vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\pdfforge Toolbar\WidgiHelper.exe.vir" sh=203301D21FA80631DC64C169AE27287B6D10EEB0 ft=1 fh=23998c4571c94c82 vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\pdfforge Toolbar\IE\4.4\pdfforgeToolbarIE.dll.vir" sh=D85EED3A3D8D986D51BFC3D7B16E39ADF9B1D282 ft=1 fh=f155ebb8bf865353 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.5.4\PriceGongIE.dll.vir" sh=10AB6F5BF2AE7B357A7E1BEE97AA30A6512DE7DE ft=1 fh=fc4a296bcfd5af48 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir" sh=BB6E4EFDCDDC5C876EF941A8E8FC8C37A558C6D3 ft=1 fh=5a3b188cd9c263c2 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir" sh=DF96804C0D2D07D7543728DF582C86ACD3BEF3CF ft=1 fh=8676e6337a543f91 vn="Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1390851981296.vir" sh=C8F8049916B0E5C1953670DB20F04E87791681F2 ft=1 fh=5f5f86e71335fd15 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1391169171662.vir" sh=C8F8049916B0E5C1953670DB20F04E87791681F2 ft=1 fh=5f5f86e71335fd15 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1391169171675.vir" sh=05C0A99ACE45CEFB680DF0D3D87C138A307D346A ft=1 fh=2e9dc85ff81fe5c7 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll_1391461151344.vir" sh=6E92E96780D7A012AEC66D81A04C1C1644989A7D ft=1 fh=42eab3640c7f75db vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir" sh=7F851F7F3AB08BB489A9E9553635ACFF24BD2F4F ft=1 fh=480bb73806aecf9e vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir" sh=ED0BB5C058DD66D8CF7FC430901119E5FA9460E8 ft=1 fh=493186a480a7c1be vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir" sh=3ECB52E629A307F1154A11FFC420FEABA8805651 ft=1 fh=7eaccb99bfbac335 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir" sh=3009704625F497D74601071243D3260D3C026D48 ft=1 fh=29c0ddfe71de86ad vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir" sh=3F252E848CE5BA3571A8FA3B9CE9FD8D7EE86634 ft=1 fh=af780bdc59dfdab5 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir" sh=68E215FD9A959DD28595B0DA25EC5100EFB98253 ft=1 fh=50730cf0e69141f8 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir" sh=EBB8454D4017FE184FD4B1A4D390C8CE099213C1 ft=1 fh=438201fe522fde58 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir" sh=1022729A03AE1EE7245404144A85076AA206B99C ft=1 fh=02c6b3b58a4624e4 vn="Variante von Win32/Toolbar.Besttoolbars.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\AddonsFramework.Typelib.dll.vir" sh=112C392B2803837A18EAE38D2AE7554F8A299A79 ft=1 fh=60abaa6b700cc78e vn="Win64/Toolbar.Besttoolbars.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\AddonsFramework.Typelib64.dll.vir" sh=D9AC66012AA2EB9AD9F95DAE569C563023CBAF74 ft=1 fh=f0ff556d3619374a vn="Variante von Win32/Toolbar.Besttoolbars.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\BackgroundHost.exe.vir" sh=69CBF3EBA00C795155FFE5787A23987DB5DE8C34 ft=1 fh=2e7ee03c6aed0bab vn="Variante von Win64/Toolbar.Besttoolbars.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\BackgroundHost64.exe.vir" sh=818FF91B61230E4C3EB0BC46F77F1CE0B4D92E3E ft=1 fh=2eabe045491068b1 vn="Variante von Win32/Toolbar.Besttoolbars.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\ScriptHost.dll.vir" sh=4FDF85D0459BEB65E652EB33DF68D2B2EA520F58 ft=1 fh=ba00c479d30efde5 vn="Variante von Win32/Toolbar.Besttoolbars.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Speed Test 127\ScriptHost64.dll.vir" sh=53F226B3D1D3828304E40C6C7A50667ADF23B42A ft=1 fh=e1ea10a5e9416a5c vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir" sh=0CB68F399D491465198E3E86F1D2923A211614E7 ft=1 fh=021f675753f993f2 vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir" sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir" sh=86EA851108D635D9ED47C01E86899845DFDA3EC7 ft=1 fh=90733a3b10b3e858 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir" sh=12EBF6FC8AD543662053CA101C2D5DA175137EB2 ft=1 fh=c71c00119e5c1a87 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir" sh=8F0ABE23DDA3F9DC04497B1A4F455AF8CE9D45B8 ft=1 fh=787e176d56997de7 vn="Win64/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir" sh=A8E3A9E6972C6F8B253EA0E1837AEEBF0A07B187 ft=1 fh=e2a5b168a3934371 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir" sh=30E2FB1C671B2808D2E80518D793575965AF2416 ft=1 fh=d06e6f3f3f60e357 vn="Variante von Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir" sh=AC11914CC02E023E2EF06A80DEE1701419A5473A ft=1 fh=4cb2d0bd10147652 vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir" sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir" sh=E97CBDBD7CFED2C58464C1ABF186520022DE5666 ft=1 fh=7a2ea5ecc33ad0e3 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir" sh=36F969E522FD53A189312D946C430EFD02D5A982 ft=1 fh=5d022c015afe1524 vn="Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe.vir" sh=D037F58CF4B36F3B437FAA0D9500720445B27D65 ft=1 fh=b07c7921935b766c vn="Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir" sh=4139F95644E13A650D4827C943BCC9F2F0F6AA93 ft=1 fh=3b96e1736604b8bc vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir" sh=79C9BD304C93AB8FD0544108656A899993DB14EF ft=1 fh=e6f80544d6e8089f vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll32.dll.vir" sh=96B85214CD9E4FF85AC6144E7EF3DDF9E0F215E6 ft=1 fh=098a6735f96a550a vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir" sh=4F1A1ECBC53648728576DC417328B2DD70532367 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\winservice86\1293297481.mxaddon.vir" sh=772C23155B151B353BD5EE53EE4AD431460F2ADE ft=1 fh=df496d4aeebd2a7b vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\winservice86\utils.exe.vir" sh=672C7517C7D0CC90B7CEA8E2C55C1E1004B346B8 ft=1 fh=6147f8d56ef8a2a5 vn="Win32/Toolbar.Besttoolbars.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\winservices\AddonsFramework.dll.vir" sh=3DC3EE1249CA6263C0AE0C00E8F5C87FF7112663 ft=1 fh=314100d5b1a7a585 vn="Variante von Win32/Toolbar.Besttoolbars.J evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\winservices\ScriptHost.dll.vir" sh=CBA30233A62CDA1FD82A515891AA91ACD9BD8986 ft=1 fh=2aedf263a8166fdc vn="Win32/Adware.Yontoo.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo Layers\YontooIEClient.dll.vir" sh=5FB95D21BE8CF2753FD8A42398ADD26E2B21409F ft=1 fh=0f2c5f177050d203 vn="Variante von Win32/Toolbar.Conduit.AJ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\Conduit\IE\CT3312331\UninstallerUI.exe.vir" sh=5FB95D21BE8CF2753FD8A42398ADD26E2B21409F ft=1 fh=0f2c5f177050d203 vn="Variante von Win32/Toolbar.Conduit.AJ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\Conduit\Multi\CT3312331\UninstallerUI.exe.vir" sh=246DDBC3A2C223A6B9072637D93DC2A2832D097A ft=1 fh=c71c0011b04f613a vn="Win32/Toolbar.Babylon.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink\DSearchLink.exe.vir" sh=36F969E522FD53A189312D946C430EFD02D5A982 ft=1 fh=5d022c015afe1524 vn="Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir" sh=FA128C5A0500EA7D2710C3A48D28CB483D3CFDF7 ft=1 fh=c71c001123b6085d vn="Variante von Win64/Adware.MultiPlug.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\SaaveRPrO\FQuCQSB.x64.dll.vir" sh=AF344D7C5D38ED21BE0CEEDCF4EFDA9E5E2130E7 ft=1 fh=26f8de7cec21fb12 vn="Variante von Win32/Adware.Yontoo.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir" sh=B895750CD8DA172165AEC7583FB543AF2C7E80B7 ft=1 fh=97245685ee9ce563 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir" sh=F04AFC29EC59B771627E557B7B89FF41E5203DEE ft=1 fh=e0180b488a12443f vn="Variante von Win32/AdWare.WinuSecu.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Lisa\AppData\Local\Microsoft\WinU\~kstmtgc.exe.vir" sh=F04AFC29EC59B771627E557B7B89FF41E5203DEE ft=1 fh=e0180b488a12443f vn="Variante von Win32/AdWare.WinuSecu.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Lisa\AppData\Local\Microsoft\WinU\~phkaorr.exe.vir" sh=FFF8149AF1904203F361484E583452828803B212 ft=1 fh=77b663e6e82848a7 vn="Variante von Win32/AdWare.WinuSecu.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Lisa\AppData\Local\Microsoft\WinU\~wtsxyfu.exe.vir" sh=57E5CDF3AB2B37471613FA343CD113870F26C75C ft=1 fh=893fe457d63eb0c6 vn="Win32/Adware.ToolPlugin Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Lisa\AppData\Roaming\toolplugin\toolbar.dll.vir" sh=2B9A1340BEC2FE2694C333ACD77F0E12EF9550D1 ft=1 fh=fcbeb3ad261a92d1 vn="Variante von Win32/Conduit.SearchProtect.P evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf\10.31.4.510_0\APISupport\APISupport.dll" sh=675526C1B3CB27C6635233B62EDB8ECEEBFE1556 ft=1 fh=8382eeac10eb278f vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe" sh=C0114483C9E2C1271B0D594AB6A6BF1E4F383D63 ft=1 fh=e2607344a0894545 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf\10.31.4.510_0\plugins\ChromeApiPlugin.dll" sh=FE62CBCCA14A4B64041E5200A28A5C2099F7C67F ft=1 fh=85d4ea5dc1ff713b vn="Variante von Win32/LiMo.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1J0PO1BW\ill_webssearches[2].exe" sh=47684BC9F96872C4134DD46689D013BD8E51A14A ft=1 fh=47ffb6bc73749a57 vn="Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Local\NativeMessaging\CT3312331\1_0_0_9\TBMessagingHost.exe" sh=E33473A547B46503C4F7D8D6095F084570496E0F ft=1 fh=3cc725458bf86889 vn="Win32/BrowserCompanion evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe" sh=3E34A96020F886FD82E1FE746938E167F6428930 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\Desktop\Alte Firefox-Daten\5li5ku9a.default-1411058060222\extensions\taylorralston@hotmail.com\extensionData\plugins\91.js" sh=EF1B9FFAC6F9C7017D5E053C36A644102D34E55B ft=1 fh=b2d48ddf18dd0936 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\Desktop\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer(1).exe" sh=B2407AE4A12A456C8B6BE188413C6AF75A2CCCF0 ft=1 fh=8b92f39c52509d3c vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\Desktop\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe" sh=294AB91288412DECB27232655ADD82FAF0B1C55D ft=1 fh=dabaed1395cd1d06 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\Videos\Veoh\1_VeohWebPlayerSetup_eng.exe" sh=294AB91288412DECB27232655ADD82FAF0B1C55D ft=1 fh=dabaed1395cd1d06 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Lisa\Videos\Veoh\VeohWebPlayerSetup_eng.exe" beim letzten Schritt Security Check geht leider seit über einer Std nichts vorwärts... Im Administrator Fenster erscheint nur "Performing System Health Check" Gruß |
|
08.01.2015, 18:50
| #12 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss lass Securitycheck weg und mach den Rest bitte. Und denk bitte an die Codetags.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.01.2015, 00:49
| #13 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weissFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015 Ran by Lisa (administrator) on LISA-VAIO on 09-01-2015 00:34:44 Running from C:\Users\Lisa\Desktop\Downloads Loaded Profile: Lisa (Available profiles: Lisa) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe (Spotify Ltd) C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHVE.EXE (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Dropbox, Inc.) C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe (SAMSUNG ELECTRONICS) C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe ((주)마크애니) C:\Program Files (x86)\MarkAny\ContentSafer\MaAgent.exe (Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.Exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (France Telecom SA) C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe (Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe (ALPS) C:\Program Files\Apoint\Apvfb.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe () C:\Users\Lisa\Desktop\Downloads\SecurityCheck.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Microsoft Corp.) C:\Windows\System32\Defrag.exe (Apple Inc.) C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Farbar) C:\Users\Lisa\Desktop\Downloads\FRST64(1).exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7938080 2009-09-17] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-09-17] (Realtek Semiconductor Corp.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-09-28] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation) HKLM-x32\...\Run: [SMSTray] => C:\Program Files (x86)\Samsung\Samsung Media Studio 5\SMSTray.exe [126976 2007-02-23] (SAMSUNG ELECTRONICS) HKLM-x32\...\Run: [MAAgent] => C:\Program Files (x86)\MarkAny\ContentSafer\MAAgent.exe [57344 2007-01-30] ((주)마크애니) HKLM-x32\...\Run: [SpywareTerminator] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2557440 2010-12-22] (Crawler.com) HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation) HKLM-x32\...\Run: [BEWINTERNET-SPSessionManager] => C:\Program Files (x86)\Orange\Internet Everywhere Pro\SessionManager\SessionManager.exe [140016 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [CardDetectorHUAWEI1752_1552] => C:\Program Files (x86)\CardDetector\HUAWEI1752_1552\CardDetector.exe [295664 2010-03-22] (France Telecom SA) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [522744 2012-06-07] (Cisco Systems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X] HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [SpywareTerminatorUpdate] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3318784 2010-12-22] (Crawler.com) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-04-22] (TomTom) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Lisa\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Spotify Web Helper] => C:\Users\Lisa\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-24] (Spotify Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHVE.EXE [241280 2012-07-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22040168 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk ShortcutTarget: tbhcn.lnk -> C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe (No File) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) BootExecute: autocheck autochk * sdnclean64.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1835249705-154528930-3876099220-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-1835249705-154528930-3876099220-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-1835249705-154528930-3876099220-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {2FD26EDA-EF2A-45B5-A77D-D648C80D1EC9} URL = hxxp://www.zinio.com/search/index.jsp?s={searchTerms}&rf=sonyie8search SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {9CAD618A-B558-4860-B4CE-D3F506049A16} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms} SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {E3E73F4E-4BC0-418D-9621-5F3FA6E19E9F} URL = hxxp://de.shopping.com/?linkin_id=8056363 SearchScopes: HKU\S-1-5-21-1835249705-154528930-3876099220-1000 -> {F7122350-F123-4217-931D-E620592DF091} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION) DPF: HKLM-x32 {55963676-2F5E-4BAF-AC28-CF26AA587566} https://asa03.lrz.de/CACHE/stc/1/binaries/vpnweb.cab DPF: HKLM-x32 {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553240000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {DAF7E6E6-D53A-439A-B28D-12271406B8A9} hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: ShellHook Class - {88485281-8b4b-4f8d-9ede-82e29a064277} - C:\Program Files (x86)\MarkAny\ContentSafer\MACSMANAGER.dll [192512 2004-11-23] (MarkAny Cooperation.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll No File FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc) FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1835249705-154528930-3876099220-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Lisa\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\searchplugins\google-maps.xml FF Extension: Adblock Edge - C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\vrpndxi8.default-1415983384885\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-11-14] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-09] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-11-16] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR Profile: C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avira Browserschutz) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-27] CHR Extension: (appbarioDE) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdneagjiboclldmglpjofpeipkbollcf [2014-10-27] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Lisa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-10-27] CHR HKU\S-1-5-21-1835249705-154528930-3876099220-1000\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [ncapomajoehhoogiooemilfafoicepmc] - C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor_air_chrome.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-10-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2010-03-22] (France Telecom SA) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.) R2 MySQL; C:\Program Files\MySQL\MySQL Server 5.1\my.ini [8919 2010-04-29] () [File not signed] S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions) S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [189984 2009-09-17] (Realtek Semiconductor) S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation) S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation) R2 sp_rssrv; C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe [948775 2010-12-22] (Crawler.com) [File not signed] R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.) R3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation) R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [845312 2010-08-11] (Sony Corporation) [File not signed] R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-23] (DT Soft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-09] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd) R2 risdptsk; C:\Windows\system32\drivers\risdsn64.sys [76288 2009-09-23] (REDC) S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2014-12-30] () R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [50696 2010-07-07] (Windows (R) Win 7 DDK provider) S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-08 14:04 - 2015-01-08 14:04 - 00000359 _____ () C:\Users\Lisa\Desktop\Papierkorb - Verknüpfung.lnk 2015-01-07 20:39 - 2015-01-07 20:39 - 00033587 _____ () C:\Users\Lisa\Desktop\JRT.txt 2015-01-07 20:30 - 2015-01-07 20:30 - 00000000 ____D () C:\Windows\ERUNT 2015-01-07 19:45 - 2015-01-07 19:45 - 00006858 _____ () C:\Users\Lisa\Desktop\suchlauf1.txt 2015-01-07 19:44 - 2015-01-07 19:44 - 00001204 _____ () C:\Users\Lisa\Desktop\suchlauf.txt 2015-01-07 16:41 - 2015-01-07 16:41 - 00034603 _____ () C:\ComboFix.txt 2015-01-07 13:59 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-01-07 13:59 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-01-07 13:59 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-01-07 13:59 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-01-07 13:55 - 2015-01-07 16:42 - 00000000 ____D () C:\Qoobox 2015-01-07 13:54 - 2015-01-07 16:38 - 00000000 ____D () C:\Windows\erdnt 2015-01-07 13:42 - 2015-01-07 13:42 - 00001264 _____ () C:\Users\Lisa\Desktop\Revo Uninstaller.lnk 2015-01-07 13:42 - 2015-01-07 13:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-07 12:48 - 2015-01-09 00:34 - 00000000 ____D () C:\FRST 2014-12-30 22:02 - 2014-12-30 22:02 - 00003130 _____ () C:\Windows\System32\Tasks\USER_ESRV_SVC 2014-12-30 22:01 - 2014-12-30 22:01 - 00002027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care.lnk 2014-12-30 22:01 - 2014-12-30 22:01 - 00000000 __RHD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care 2014-12-28 18:16 - 2014-12-28 18:16 - 00001054 _____ () C:\Users\Lisa\Desktop\scan.txt 2014-12-28 17:37 - 2015-01-09 00:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-28 14:08 - 2015-01-07 18:59 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-28 14:08 - 2015-01-07 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2015-01-07 18:59 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-28 14:08 - 2014-12-28 14:08 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-28 14:08 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-28 14:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-28 13:55 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-12-28 13:55 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\bBmz2SW 2014-12-23 18:08 - 2015-01-06 11:01 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6wPPpQF 2014-12-23 18:08 - 2014-12-23 18:08 - 00003278 _____ () C:\Windows\System32\Tasks\6yW3JnUcdFcSwI6 2014-12-23 18:08 - 2014-12-23 18:08 - 00003238 _____ () C:\Windows\System32\Tasks\0DpOX5082tGH1oL 2014-12-18 05:12 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 05:12 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-16 17:55 - 2014-12-16 17:55 - 00000000 ____D () C:\Users\Lisa\Desktop\Cal 2014-12-15 12:03 - 2015-01-07 16:06 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-15 12:03 - 2015-01-07 13:58 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-12-15 12:03 - 2014-12-15 12:03 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-12-12 03:14 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-12 03:14 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-12 03:14 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-12 03:14 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-12 03:14 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-12 03:14 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-12 03:14 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-11 03:26 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-11 03:26 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-11 03:26 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-11 03:26 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-11 03:26 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-11 03:26 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-11 03:26 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-11 03:26 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-11 03:26 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-11 03:26 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-11 03:26 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-11 03:26 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-11 03:26 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-11 03:26 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-11 03:26 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-11 03:26 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-11 03:26 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-11 03:26 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-11 03:26 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-11 03:26 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-11 03:26 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-11 03:26 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-11 03:26 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-11 03:26 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-11 03:26 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-11 03:26 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-11 03:26 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-11 03:25 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-11 03:25 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-11 03:25 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-11 03:25 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-11 03:25 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-11 03:25 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-11 03:25 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-11 03:25 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-11 03:25 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-11 03:25 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-11 03:25 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-11 03:25 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-11 03:25 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-11 03:25 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-11 03:25 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-11 03:25 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-11 03:25 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-11 03:25 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-11 03:24 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-11 03:24 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-11 03:24 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-11 03:24 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-11 03:24 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-11 03:24 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-11 03:24 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-11 03:24 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-09 00:34 - 2011-12-08 17:49 - 00001112 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000Core.job 2015-01-09 00:24 - 2012-11-20 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-09 00:24 - 2011-12-08 17:49 - 00001134 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1835249705-154528930-3876099220-1000UA.job 2015-01-09 00:24 - 2009-11-27 04:01 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-09 00:23 - 2010-04-17 20:38 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Skype 2015-01-08 17:20 - 2009-11-27 04:01 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-08 16:24 - 2010-01-07 17:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB25F1A-BB3C-4A69-A37D-CE8C1215F895} 2015-01-08 13:13 - 2012-07-25 13:33 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\BrowserCompanion 2015-01-08 12:20 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-01-08 12:13 - 2010-01-07 17:04 - 01749849 _____ () C:\Windows\WindowsUpdate.log 2015-01-08 11:54 - 2010-02-06 18:15 - 00274944 ___SH () C:\Users\Lisa\Documents\Thumbs.db 2015-01-08 10:38 - 2010-12-22 19:15 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Spyware Terminator 2015-01-08 10:34 - 2009-11-27 12:52 - 05584092 _____ () C:\Windows\system32\perfh007.dat 2015-01-08 10:34 - 2009-11-27 12:52 - 01719672 _____ () C:\Windows\system32\perfc007.dat 2015-01-08 10:34 - 2009-07-14 06:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-08 10:32 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-08 10:32 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-08 10:22 - 2011-05-09 21:31 - 00000000 ___RD () C:\Users\Lisa\Dropbox 2015-01-08 10:22 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Dropbox 2015-01-08 10:18 - 2014-10-03 10:48 - 00003752 _____ () C:\Windows\setupact.log 2015-01-08 10:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-07 20:17 - 2014-10-06 10:12 - 00135316 _____ () C:\Windows\PFRO.log 2015-01-07 20:16 - 2014-06-16 07:59 - 00000000 ____D () C:\AdwCleaner 2015-01-07 17:56 - 2011-06-01 19:56 - 07732224 ___SH () C:\Users\Lisa\Desktop\Thumbs.db 2015-01-07 16:42 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-01-07 16:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-01-07 15:54 - 2010-01-07 17:17 - 00000000 __SHD () C:\Users\Lisa 2015-01-07 12:54 - 2014-06-12 12:24 - 00000000 ____D () C:\Users\Lisa\Desktop\Madrid 2015-01-07 12:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SchCache 2015-01-06 11:01 - 2014-11-25 03:27 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\6ZrCIYN 2015-01-06 11:01 - 2014-11-21 22:25 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\l1Vsnq1 2015-01-05 13:34 - 2014-10-11 14:24 - 00000000 ___RD () C:\Users\Lisa\Desktop\Dropbox 2015-01-05 13:09 - 2010-01-25 17:58 - 00000000 ____D () C:\Program Files (x86)\DivX 2014-12-30 22:05 - 2010-01-15 11:11 - 00000000 ____D () C:\Update 2014-12-30 22:02 - 2009-11-27 03:59 - 00000000 ____D () C:\Program Files (x86)\SONY 2014-12-30 22:01 - 2011-04-18 17:38 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation 2014-12-30 22:01 - 2009-11-27 04:18 - 00000000 ____D () C:\Program Files\Sony 2014-12-30 21:57 - 2014-06-03 22:20 - 00013792 _____ () C:\Windows\system32\Drivers\semav6thermal64ro.sys 2014-12-29 00:58 - 2010-09-27 21:36 - 00212992 ___SH () C:\Users\Lisa\Thumbs.db 2014-12-28 18:21 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-19 04:34 - 2012-04-08 21:46 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Spotify 2014-12-18 14:28 - 2012-04-08 21:55 - 00000000 ____D () C:\Users\Lisa\AppData\Local\Spotify 2014-12-16 11:44 - 2014-08-21 13:36 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-16 11:44 - 2013-02-24 00:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-16 11:44 - 2013-02-24 00:06 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-15 22:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-15 11:47 - 2014-10-10 15:40 - 00001141 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk 2014-12-12 14:17 - 2014-11-23 19:39 - 00000002 _____ () C:\Users\Lisa\AppData\Local\recently-fix.db 2014-12-12 04:23 - 2011-05-09 21:29 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-12 04:19 - 2014-06-15 18:59 - 00000000 ____D () C:\Users\Lisa\AppData\Roaming\wp_update 2014-12-12 04:00 - 2013-01-25 22:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-12 03:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-12 03:37 - 2009-11-27 04:07 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-12 03:34 - 2013-08-23 02:03 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-12 03:21 - 2010-04-07 22:25 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-10 16:00 - 2012-11-20 12:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-10 16:00 - 2012-11-20 12:19 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater Some content of TEMP: ==================== C:\Users\Lisa\AppData\Local\Temp\avgnt.exe C:\Users\Lisa\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0u4jfv.dll C:\Users\Lisa\AppData\Local\Temp\Quarantine.exe C:\Users\Lisa\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 05:20 ==================== End Of Log ============================ |
|
09.01.2015, 09:24
| #14 |
| /// the machine /// TB-Ausbilder | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
ShortcutTarget: tbhcn.lnk -> C:\Users\Lisa\AppData\Roaming\BrowserCompanion\tbhcn.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1835249705-154528930-3876099220-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [kdneagjiboclldmglpjofpeipkbollcf] - C:\Users\Lisa\AppData\Local\CRE\kdneagjiboclldmglpjofpeipkbollcf.crx [Not Found]
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.01.2015, 17:57
| #15 |
| | Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss Der PC hat sich nach dem durchflauf vom fix neu gestartet und der Display bleibt schwarz ..nur oben links blinkt ein weißes eingabestrichchen. .. was nun? Gruß |
|
| Themen zu Bei Suchlauf mehrere Viren gemeldet, Laptop nach Start zunächst einige Sek. weiss |
| adware, antivir, bildschirm, desktop, ergebnisse, erschein, erscheint, funktionier, gemeldet, gen, langsam, laptop, laptops, nach start, normale, screenshot, sekunden, start, suchlauf, tr/agent, tr/rogue, trojaner, verständliche, viren, weisser bildschirm, zunächst |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
