| |
| |||||||
Log-Analyse und Auswertung: Chrome öffnet automatisch neue TabsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.01.2015, 15:21
| #1 |
 |  Chrome öffnet automatisch neue Tabs Hallo, wie der Betreff schon sagt, öffnet Chrome automatisch neue (leere) Tabs. Nach vorübergehender De-Installation von Chrome geschah das Gleiche beim Internet-Explorer. Im Rahmen meiner Suche (u.a. mit JRT, MBAM, adwcleander ) bin ich auf IMinent gestoßen und hab es so gut es ging, vom Rechner geschmissen. In einem der Logfiles habe ich aber immer noch einen Hinweis darauf gefunden, den ich nicht loswerde: CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4 Auch wird über einen PANDA-Eintrag (der Virenscanner war mal auf dem Rechner installiert) gemeckert, den ich nicht am angegeben Ort finde. Noch vorhandene Logfiles füge ich bei und geben euch hoffentlich mehr Auskunft als mir  Schon mal vielen Dank! Beste Grüße Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:04 on 24/01/2015 (Gregor)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-24 14:33:00
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002a Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: 52n0jlfl.exe; Driver: C:\Users\Gregor\AppData\Local\Temp\kwtdapob.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]
.text C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]
.text C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe[2620] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ffd64411f6a 4 bytes [41, 64, FD, 7F]
.text C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe[2620] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ffd64411f82 4 bytes [41, 64, FD, 7F]
.text C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [912:936] fffff960008ceb90
Thread C:\WINDOWS\explorer.exe [532:5724] 00007ffd5ca8d73c
---- Services - GMER 2.1 ----
Service C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe (*** hidden *** ) [AUTO] panda_url_filtering <-- ROOTKIT !!!
Service C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys (*** hidden *** ) [MANUAL] panda_url_filteringd <-- ROOTKIT !!!
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime 0x76 0xC4 0x87 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime 0x76 0xC4 0x87 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime 0xAC 0xC5 0x55 0x63 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime 0xAC 0xC5 0x55 0x63 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@de-DE 71
Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM566F184880_09_07D8_B1^638A8C2BB76C28D854675B699B927F6F@Timestamp 0x8A 0xFF 0xD1 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid 1016
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations \??\C:\ProgramData\DataMngr\stats.cfg??\??\C:\WINDOWS\RAVTC.TMP??\??\C:\WINDOWS\RAVDG.TMP??\??\C:\SMCLpav\PAVSMCL.dll??\??\C:\SMCLpav\SMCLPav.dll??\??\C:\SMCLpav\SMCLpav.exe??\??\C:\SMCLpav\DGNano.dll??\??\C:\Program Files (x86)\Panda Security\??\??\C:\SMCLpav??\??\C:\SMCLpav\??\??\C:\Users\Gregor\AppData\Local\Temp\_iu14D2N.tmp??
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber 4521651
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -957593797
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId 74
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime 433394455
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime 5869
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime 5247
Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID c3bd114e-e40e-4bea-8bec-100d087
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog@FileCounter 2
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger@FileCounter 4
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter 2
Reg HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Control\Print\Printers\Canon iP4700 series@PrinterOnLine 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\AVGIDSHA\Parameters@Reboot 75
Reg HKLM\SYSTEM\CurrentControlSet\Services\Avgmfx64\Parameters@Params 33795
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Type 16
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ImagePath C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe --
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@DisplayName panda_url_filtering Service
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Description Provides Anti-Phishing protection
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Start 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@ImagePath \??\C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@DisplayName panda_url_filteringd driver
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Tag 95
Reg HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 6428
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 3262
Reg HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence 73
Reg HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop 0
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer@GlobalAssocChangedCounter 292
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced@Hidden 2
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log@0 0x73 0x00 0x6F 0x00 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log@MRUListEx 0x00 0x00 0x00 0x00 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@PolicyDocumentLastRefresh 0xE8 0x1A 0x64 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsBandwidthBucketCounter 47112
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsRequestBucketCounter 119
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime 0x0E 0x69 0x72 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime 0x0E 0x69 0x72 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@OtherBandwidthBucketCounter 282
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@OtherRequestBucketCounter 198
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime 0x0E 0x69 0x72 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalBandwidthBucketCounter 125811
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalRequestBucketCounter 298
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime 0x0E 0x69 0x72 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastUploadTime 0x70 0xCB 0x74 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken LM%3d63557695680310%3bID%3dE4875D739E502A9A!106%3bLR%3d63557685929257%3bEP%3d4%3bTD%3dTrue
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest 0xF4 0xBA 0x49 0xEA ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce@Report C:\AdwCleaner\AdwCleaner[S3].txt
---- EOF - GMER 2.1 ----
FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01 Ran by Gregor (administrator) on USER-PC on 24-01-2015 14:33:11 Running from C:\Users\Gregor\Downloads Loaded Profiles: Gregor (Available profiles: Gregor & Administrator) Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe (Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe (Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8_64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (VMLite, Inc.) C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe (Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor) HKLM\...\Run: [CANON DR-P215 SVC] => rundll32.exe PHCSVC.DLL,EntryPointUserMessage HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133408 2012-09-11] (Intel Corporation) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [NWEReboot] => [X] HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH) HKLM-x32\...\Run: [P-215 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe [966656 2012-07-19] (Canon Electronics Inc.) HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.) HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2009-03-02] (Nuance Communications, Inc.) HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2009-03-02] (Nuance Communications, Inc.) HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.) HKLM-x32\...\Run: [iTunesHelper] => D:\Software\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-15] (Microsoft Corporation) HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd) HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef3d-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef5a-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk ShortcutTarget: Adobe Gamma Loader.exe.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) Startup: C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_280.dll () FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_280.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\Software\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> F:\FoxitReader\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll No File FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll () FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: ======= CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4 CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-13] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06] CHR Extension: (YouTube) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-13] CHR Extension: (Google-Suche) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-13] CHR Extension: (Google Wallet) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-13] CHR Extension: (Evernote Web Clipper) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-08-24] CHR Extension: (Google Mail) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-13] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.) R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [39936 2012-04-04] (EMC Corporation) [File not signed] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation) S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 Start8; C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe [143288 2014-06-18] (Stardock Software, Inc) R2 VMLiteService; C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology) S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) R1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.) R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.) R3 VBoxNetFlt; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.) R1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.) R3 vmlitestor; C:\Windows\system32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.) R1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) U3 kwtdapob; \??\C:\Users\Gregor\AppData\Local\Temp\kwtdapob.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-24 14:33 - 2015-01-24 14:33 - 00016964 _____ () C:\Users\Gregor\Downloads\FRST.txt 2015-01-24 14:33 - 2015-01-24 14:33 - 00015571 _____ () C:\Users\Gregor\Desktop\Gmer.txt 2015-01-24 13:44 - 2015-01-24 13:44 - 03494400 _____ () C:\Users\Gregor\Documents\QC_150124134449.bak 2015-01-24 13:08 - 2015-01-24 13:08 - 00380416 _____ () C:\Users\Gregor\Downloads\52n0jlfl.exe 2015-01-24 13:01 - 2015-01-24 13:01 - 00000000 ____D () C:\Users\Gregor\Downloads\FRST-OlderVersion 2015-01-24 13:00 - 2015-01-24 13:00 - 00000000 _____ () C:\Users\Gregor\defogger_reenable 2015-01-24 09:21 - 2015-01-24 09:21 - 00050477 _____ () C:\Users\Gregor\Downloads\Defogger.exe 2015-01-24 08:49 - 2015-01-24 08:54 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Nico Mak Computing 2015-01-24 08:49 - 2015-01-24 08:49 - 04917720 _____ (WinZip International LLC ) C:\Users\Gregor\Downloads\wzmp_8.exe 2015-01-24 08:48 - 2015-01-24 08:49 - 58043240 _____ () C:\Users\Gregor\Downloads\FREEAV1504.exe 2015-01-24 08:44 - 2015-01-24 12:22 - 11801792 ____R () C:\Users\Gregor\Money Backup 24.01.2015.mbf 2015-01-24 00:44 - 2015-01-24 00:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (2).exe 2015-01-24 00:44 - 2015-01-24 00:44 - 00001290 _____ () C:\Users\Gregor\Desktop\Revo Uninstaller.lnk 2015-01-23 23:40 - 2015-01-23 23:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-01-23 23:39 - 2015-01-24 13:55 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-23 23:39 - 2015-01-24 13:44 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-23 23:39 - 2015-01-23 23:39 - 00004098 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2015-01-23 23:39 - 2015-01-23 23:39 - 00003862 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2015-01-23 23:15 - 2015-01-23 23:15 - 04188536 _____ (Piriform Ltd) C:\Users\Gregor\Downloads\ccsetup501_slim.exe 2015-01-23 23:15 - 2015-01-23 23:15 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-01-23 23:15 - 2015-01-23 23:15 - 00000840 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\Program Files\CCleaner 2015-01-23 23:14 - 2015-01-24 00:44 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95.exe 2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (1).exe 2015-01-23 23:11 - 2015-01-24 14:33 - 00000000 ____D () C:\FRST 2015-01-23 23:11 - 2015-01-24 13:01 - 02129920 _____ (Farbar) C:\Users\Gregor\Downloads\FRST64.exe 2015-01-23 22:53 - 2015-01-24 13:55 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-23 22:53 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-01-23 22:53 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-01-23 22:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-01-23 22:52 - 2015-01-23 22:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Gregor\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-21 23:02 - 2015-01-21 23:21 - 00000213 _____ () C:\prefs.js 2015-01-21 23:02 - 2015-01-21 23:21 - 00000000 ____D () C:\searchplugins 2015-01-21 23:02 - 2015-01-21 23:02 - 00004648 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpService.ini 2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini 2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\system32\LavasoftTcpServiceOff.ini 2015-01-21 23:02 - 2015-01-21 23:02 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\LavasoftStatistics 2015-01-21 23:02 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll 2015-01-21 23:02 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll 2015-01-21 22:59 - 2015-01-21 23:21 - 00000000 ____D () C:\ProgramData\Lavasoft 2015-01-21 22:59 - 2015-01-21 22:59 - 01937320 _____ () C:\Users\Gregor\Downloads\AdAware115WebInstaller.exe 2015-01-20 20:18 - 2015-01-24 14:22 - 00000000 ____D () C:\AdwCleaner 2015-01-20 20:17 - 2015-01-20 20:17 - 02186752 _____ () C:\Users\Gregor\Downloads\adwcleaner_4.108.exe 2015-01-20 20:01 - 2015-01-20 20:01 - 00000000 ____D () C:\WINDOWS\ERUNT 2015-01-20 20:00 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Downloads\JRT.exe 2015-01-20 18:25 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll 2015-01-20 18:25 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll 2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\ProgramData\ZDSupport 2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\Program Files (x86)\Hostless Modem 2015-01-13 22:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-13 22:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-13 22:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-13 22:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-13 22:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-13 22:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-13 22:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-13 22:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-13 22:30 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-13 22:30 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2015-01-13 22:30 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-13 22:30 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-13 22:30 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-13 22:30 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-13 22:30 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-13 22:30 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-13 22:30 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-13 22:30 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2015-01-13 22:30 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2015-01-13 22:30 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2015-01-13 22:30 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-01-13 22:30 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2015-01-13 22:30 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-13 22:30 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2015-01-13 22:30 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-01-08 18:55 - 2015-01-08 18:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Avg 2015-01-02 18:45 - 2015-01-02 18:45 - 00000791 _____ () C:\Users\Gregor\Desktop\Soulful.lnk 2014-12-25 00:19 - 2014-12-25 00:19 - 00000000 __SHD () C:\Users\Gregor\AppData\Local\EmieBrowserModeList 2014-12-25 00:15 - 2014-12-25 00:43 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\CDTPL 2014-12-25 00:15 - 2014-12-25 00:15 - 00000000 ____D () C:\ProgramData\CDTPL ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-24 14:20 - 2013-12-11 14:47 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4223944866-4218211989-4134806692-1001 2015-01-24 14:15 - 2013-12-16 21:24 - 02610176 ___SH () C:\Users\Gregor\Desktop\Thumbs.db 2015-01-24 14:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-01-24 13:59 - 2013-11-14 08:26 - 01789004 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-01-24 13:59 - 2013-11-14 08:11 - 00768888 _____ () C:\WINDOWS\system32\perfh007.dat 2015-01-24 13:59 - 2013-11-14 08:11 - 00160706 _____ () C:\WINDOWS\system32\perfc007.dat 2015-01-24 13:55 - 2013-12-14 11:08 - 00000000 __RDO () C:\Users\Gregor\SkyDrive 2015-01-24 13:55 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-24 13:47 - 2014-11-29 12:18 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Deployment 2015-01-24 13:45 - 2014-11-29 12:20 - 06291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf 2015-01-24 13:45 - 2014-11-29 12:20 - 01572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf 2015-01-24 13:45 - 2013-12-11 15:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-01-24 13:44 - 2014-11-29 14:10 - 00022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml 2015-01-24 13:44 - 2014-11-29 14:10 - 00019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml 2015-01-24 13:44 - 2014-11-29 14:10 - 00012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml 2015-01-24 13:44 - 2014-11-29 12:20 - 00021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml 2015-01-24 13:44 - 2014-11-29 12:20 - 00004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini 2015-01-24 13:44 - 2014-11-29 12:19 - 00002970 _____ () C:\Users\Gregor\AppData\Local\QC.log 2015-01-24 13:38 - 2013-12-14 10:58 - 00000000 ____D () C:\Users\Gregor 2015-01-24 13:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-01-24 12:57 - 2014-08-27 18:20 - 00000174 _____ () C:\WINDOWS\setscan.ini 2015-01-24 12:22 - 2013-12-14 23:26 - 11798528 _____ () C:\Users\Gregor\Documents\Finanzen.mny 2015-01-24 12:09 - 2013-12-26 10:13 - 00000000 ____D () C:\Program Files (x86)\Chord Pro Manager 2015-01-24 11:15 - 2013-12-11 15:06 - 00000000 ____D () C:\ProgramData\MFAData 2015-01-24 09:45 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-01-24 09:00 - 2013-12-14 11:19 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{27D26F56-1E79-48C6-844C-D4E9DBC2810B} 2015-01-24 08:59 - 2013-12-14 11:42 - 00151032 _____ () C:\Users\Gregor\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-24 08:57 - 2013-08-22 15:44 - 00610976 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-01-24 01:12 - 2013-12-14 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2015-01-24 01:12 - 2013-12-14 11:24 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Samsung 2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Samsung 2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Samsung 2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2015-01-24 00:48 - 2013-12-11 14:57 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-24 00:27 - 2014-11-30 09:23 - 11801792 ____R () C:\Users\Gregor\Money Backup 30.11.2014.mbf 2015-01-24 00:14 - 2014-08-24 17:59 - 00000000 ____D () C:\Users\Gregor\Desktop\Evernote Sync 2015-01-24 00:00 - 2013-12-12 12:20 - 00000000 ____D () C:\ProgramData\Advanced 2015-01-23 23:40 - 2013-12-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Google 2015-01-23 23:17 - 2014-04-02 17:07 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\AIMP3 2015-01-23 23:17 - 2013-12-14 10:56 - 00000000 ___DC () C:\WINDOWS\Panther 2015-01-23 23:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Resources 2015-01-23 23:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance 2015-01-21 23:11 - 2013-12-11 16:09 - 01807894 _____ () C:\WINDOWS\SysWOW64\PerfStringBackup.INI 2015-01-21 22:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-01-21 22:20 - 2014-08-24 15:41 - 00000000 ____D () C:\Program Files (x86)\Evernote 2015-01-21 19:18 - 2014-08-24 16:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Skitch 2015-01-20 23:15 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-01-20 21:30 - 2014-01-04 20:18 - 00000000 ____D () C:\temp 2015-01-20 19:57 - 2013-12-11 15:12 - 00000000 ____D () C:\Users\Gregor\VMLites 2015-01-20 18:24 - 2013-12-11 15:46 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-01-20 18:23 - 2013-12-11 15:46 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-01-19 22:32 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-01-19 22:32 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-14 22:45 - 2013-12-11 15:05 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-01-10 23:18 - 2014-02-28 14:27 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\vlc 2015-01-08 18:56 - 2014-03-31 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-01-02 18:43 - 2013-12-17 22:06 - 00175104 ___SH () C:\Users\Gregor\Downloads\Thumbs.db ==================== Files in the root of some directories ======= 2014-05-02 18:11 - 2014-06-15 13:23 - 0560516 _____ () C:\Users\Gregor\AppData\Roaming\Scorch_Install.log 2013-12-27 15:14 - 2013-12-28 11:30 - 0001323 _____ () C:\Users\Gregor\AppData\Roaming\songpress.ini 2014-11-29 14:10 - 2015-01-24 13:44 - 0022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml 2014-11-29 14:10 - 2015-01-24 13:44 - 0019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml 2014-11-29 12:20 - 2015-01-24 13:44 - 0021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml 2014-11-29 14:10 - 2015-01-24 13:44 - 0012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml 2014-11-29 12:20 - 2015-01-24 13:44 - 0004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini 2014-11-29 12:19 - 2015-01-24 13:44 - 0002970 _____ () C:\Users\Gregor\AppData\Local\QC.log 2014-11-29 12:20 - 2015-01-24 13:45 - 6291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf 2014-11-29 12:20 - 2015-01-24 13:45 - 1572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf 2013-12-14 10:57 - 2013-12-14 10:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-21 20:02 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Gregor at 2015-01-24 14:33:31
Running from C:\Users\Gregor\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus 2014 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2014 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.280 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4257 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon driver for P-215 (x64) (HKLM\...\{CB884F7A-3B20-43EF-9B46-0663A28EDF1A}) (Version: 1.2.4706 - Canon Electronics Inc.)
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version: - )
CaptureOnTouch Evernote Plugin (HKLM-x32\...\{CE27CA2B-7663-4F6B-8E61-A455390AC71F}) (Version: 1.2.11005 - Canon Electronics Inc.)
CaptureOnTouch Google Docs(TM) Plugin (HKLM-x32\...\{31DAEBE6-4FF6-487F-8AB9-3BEFB9B863D1}) (Version: 1.3.4625 - Canon Electronics Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chord Pro Manager (HKLM-x32\...\ST6UNST #1) (Version: - )
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
DDBAC (HKLM-x32\...\{4C19650D-1BF8-4459-A904-06FB692B0F8E}) (Version: 5.3.24 - DataDesign)
DDBAC (HKLM-x32\...\{88A0F52F-A024-4268-977E-E75B1F9C67ED}) (Version: 5.3.28 - DataDesign)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version: - Steinberg Media Technologies GmbH)
Evernote v. 5.7.2 (HKLM-x32\...\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Finale Allegro 2005 (HKLM-x32\...\Finale Allegro 2005) (Version: - )
Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HBCI-Modul für Money 99 Version 2000 (HKLM-x32\...\{8A13EBF6-6249-4C0D-92BE-F8497C922311}_is1) (Version: 5.0.1.10 - Dr. Ulrich Amann)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Money 99 (HKLM-x32\...\MSMONEYV70) (Version: - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Communicator 2007 (HKLM-x32\...\{0FCA0973-24C0-48EA-8CF6-71B53C135C09}) (Version: 2.0.6362.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Money-Browser für Money 99 Version 2000 3.0.1.37 (HKLM-x32\...\{E9E9FCFC-9F1A-4EDC-8400-2EAB5A9DEB4F}_is1) (Version: 3.0.1.37 - Dr. Ulrich Amann)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
P-215 CaptureOnTouch (HKLM-x32\...\{551DCCF1-A5D6-4090-86A5-38EA6EB5AC18}) (Version: 2.3.212.727 - Canon Electronics Inc.)
P-215 UserManual (HKLM-x32\...\{B00EDF44-C4C7-4857-872D-4C8459AD589B}) (Version: 1.05.0000 - Canon Electronics Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PaperPort SharePoint Link (HKLM-x32\...\{8D09F3C8-C890-4118-B3CC-697BE7FA0421}) (Version: 12.000.0001 - Nuance Communications, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM-x32\...\{EA820D43-3E3F-4B16-BAA2-DCAB0D4E7F1A}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Setup-Loader für das HBCI-Modul für Money 99 Version 2000 3.4 (HKLM-x32\...\Setup-Loader für das HBCI-Modul für Money 99 Version 2000_is1) (Version: 3.4 - Dr. Ulrich Amann)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5349 - Zone Five Software)
Stardock Start8 (HKLM-x32\...\Stardock Start8) (Version: 1.45 - Stardock Software, Inc.)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Transcribe! 8.40 (HKLM-x32\...\Transcribe!_is1) (Version: 8.40 - Seventh String Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VMLite Workstation (HKLM\...\{197F2BEF-2705-406E-8CEB-8E404FFFE414}) (Version: 3.2.6 - VMLite)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{4F9EFA88-960A-41FA-B56C-FE993D861FA6}) (Version: 21.00.8480 - Buhl Data Service GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-01-2015 18:14:07 Geplanter Prüfpunkt
15-01-2015 18:25:52 Windows Update
18-01-2015 23:48:34 Windows Update
21-01-2015 22:22:28 Removed Google Earth.
24-01-2015 00:00:04 Removed Shark007 Advanced Codecs.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {021E431F-94F7-4185-9C82-8EFBA4DA5C1B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {161E825F-E2AA-4175-BC1F-4D03F9100354} - System32\Tasks\{ABD1FC5D-F115-4312-B835-5F72B0F06AF4} => pcalua.exe -a "C:\Users\Gregor\Downloads\4200fvst648620a_64de (1).exe" -d C:\Users\Gregor\Downloads
Task: {1A375487-EF08-4A15-8F70-1A4A42A70C3C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {25A85C4D-8964-40AF-8CEA-D0460D6289D0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {74650E97-E9EB-4BB7-9433-4ED6150CAFBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {7A45A7A8-4288-490C-8299-A7F713F83303} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {8313ECDA-A864-4051-999F-CAF2FFE9D945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {8B87EC0D-B85A-44B1-92CD-A450FAF8E1C2} - System32\Tasks\{719118DA-0CB0-4201-9147-FC0A6DF78DC1} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64en.exe -d C:\Users\Gregor\Downloads
Task: {ABA0824B-9509-4D54-8A2A-9ED32C299005} - System32\Tasks\{85AB14EB-242A-4810-BD1C-583A453A67DE} => pcalua.exe -a C:\Users\Gregor\Downloads\USBDrivers_231.exe -d C:\Users\Gregor\Downloads
Task: {B0EA0542-A73D-4B8E-A82B-BC7270F21CB5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-20] (Microsoft Corporation)
Task: {B1DF5B7B-A9B2-4C1B-884A-5EEC2C435BDA} - System32\Tasks\{A9C356FA-DEB4-4F61-9E59-27C969DEC297} => pcalua.exe -a E:\Scangear\German\SetupSG.exe -d E:\Scangear\German
Task: {C306D80E-A5E0-4838-B3B3-556019779A6A} - System32\Tasks\{090D3749-44DF-4ED3-80AB-291B6A2A604E} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64de\SetupSG.exe -d C:\Users\Gregor\Downloads\4200fvst648620a_64de
Task: {F73BD0F3-8AE0-4712-A9B3-3AF2DB03D345} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-01-10 17:45 - 2006-06-27 16:28 - 00322048 _____ () C:\WINDOWS\system32\CNQL3203.DLL
2010-08-11 14:18 - 2010-08-11 14:18 - 00202344 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxDDU.dll
2010-08-11 14:18 - 2010-08-11 14:18 - 02725480 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxRT.dll
2009-03-26 22:03 - 2009-03-26 22:03 - 01289728 _____ () C:\Program Files\VMLite\VMLite Workstation\LIBEAY32.dll
2013-10-07 14:52 - 2013-10-07 14:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 08:19 - 2013-08-22 07:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-04 18:54 - 2012-04-04 18:54 - 00015360 _____ () C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\SSLSupport.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00438336 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00320064 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2015-01-24 10:26 - 2015-01-24 10:26 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-12-11 15:01 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\Gregor\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "WISO Mein Steuer-Sparbuch heute.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "OpwareSE2"
HKLM\...\StartupApproved\Run32: => "OPSE reminder"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "Reminder"
========================= Accounts: ==========================
Administrator (S-1-5-21-4223944866-4218211989-4134806692-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-4223944866-4218211989-4134806692-501 - Limited - Disabled)
Gregor (S-1-5-21-4223944866-4218211989-4134806692-1001 - Administrator - Enabled) => C:\Users\Gregor
HomeGroupUser$ (S-1-5-21-4223944866-4218211989-4134806692-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Error: (01/24/2015 02:29:44 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:29:14 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:27:22 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:26:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:26:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:25:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:25:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:24:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:24:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/24/2015 02:23:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Microsoft Office Sessions:
=========================
Error: (12/31/2014 06:26:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 565 seconds with 120 seconds of active time. This session ended with a crash.
Error: (08/30/2014 01:19:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-3245 CPU @ 3.40GHz
Percentage of memory in use: 26%
Total physical RAM: 7873.64 MB
Available physical RAM: 5774.63 MB
Total Pagefile: 9089.64 MB
Available Pagefile: 7183.09 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:111.45 GB) (Free:63.49 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:465.11 GB) NTFS
Drive f: (Festplatte) (Fixed) (Total:698.64 GB) (Free:565.58 GB) NTFS
Drive g: (TREKSTOR) (Fixed) (Total:298.09 GB) (Free:109.19 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 7CA3E6EF)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: BF66C29B)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7CA3E6FA)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (Size: 298.1 GB) (Disk ID: 066667C0)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
| Themen zu Chrome öffnet automatisch neue Tabs |
| adware, antivirus, bonjour, browser, canon, ccsetup, cpu, desktop, down, excel, festplatte, flash player, homepage, mozilla, object, realtek, refresh, registry, rundll, scan, security, server, services.exe, shark, software, svchost.exe, system, windows xp |
Baum-Darstellung