| |
| |||||||
Log-Analyse und Auswertung: Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
10.04.2015, 12:39
| #1 | |
| |  Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Hallo zusammen, nach dem booten auf dem o.g. Betriebsystem erscheint die Fehlermeldung GDI+ avgnt. exe. Es öffnet sich beim Bestätigen mit OK dieses Fenster erneut 2-3 mal. In der Fehlermeldung erscheint ein Hinweis auf den Ordnerpfad, auf den sich die Fehlermeldung bezieht: C:\Programm Files\Common Files\Microsoft shares\ink\tiptsf.dll Für Eure Hilfe wäre ich sehr dankbar. Grüße Zitat:
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 09.04.2015 Suchlauf-Zeit: 18:19:51 Logdatei: MBAM.txt Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.04.09.06 Rootkit Datenbank: v2015.03.31.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Florian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 331739 Verstrichene Zeit: 33 Min, 16 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 3 PUP.Optional.Snapdo.T, HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, , [aedc64063852c96d062ba6cf0bf804fc], PUP.Optional.Snapdo.T, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, , [aedc64063852c96d062ba6cf0bf804fc], PUP.Optional.WeDownLoadManager.A, HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\WEDLMNGR, , [77130d5d2c5e10267e8532b309fa3bc5], Registrierungswerte: 1 PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, , [c2c81f4b503afd39c582e3fc5ca7b14f] Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 11 PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Application, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Common, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Common\iconsWide, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\10.213.1.15234, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\11.32.1.16055, , [98f22743e9a1082ef1ec691c28db41bf], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy, , [cfbbce9cc7c3af87d818fb8a4bb844bc], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\2119BAEEDE5C41CBB4A961DC0587803A, , [cfbbce9cc7c3af87d818fb8a4bb844bc], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\7B48B1318F8547E4B1BA84E51098227F, , [cfbbce9cc7c3af87d818fb8a4bb844bc], PUP.Optional.Datamngr.A, C:\Users\Florian\AppData\LocalLow\DataMngr, , [47434822c0ca43f37c11f596cf3407f9], Dateien: 4 PUP.Optional.MySearchDial.A, C:\Windows\System32\Tasks\MySearchDial, , [5832501a95f537ff3c0ef2fa2fd450b0], PUP.Optional.MySearchDial.A, C:\Windows\Tasks\MySearchDial.job, , [b5d5ce9c1c6efd39688417d6877c758b], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\2119BAEEDE5C41CBB4A961DC0587803A\WEB.DE_MailCheck_FF_Setup_3.0.1.1739-1.exe, , [cfbbce9cc7c3af87d818fb8a4bb844bc], PUP.Optional.Datamngr.A, C:\Users\Florian\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, , [47434822c0ca43f37c11f596cf3407f9], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Florian at 2015-04-09 18:05:45
Running from C:\Users\Florian\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ACD/Labs Software in C:\Program Files\ACDFREE12\ (HKLM\...\ACDLabs in C__Program_Files_ACDFREE12_) (Version: v12.00, FREE - ACD/Labs)
Adobe Acrobat XI Pro (HKLM\...\{AC76BA86-1033-FFFF-7760-000000000006}) (Version: 11.0.08 - Adobe Systems)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Photoshop Elements 5.0 (HKLM\...\Adobe Photoshop Elements 5) (Version: 5.0 - Adobe Systems, Inc.)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
Apple Application Support (32-Bit) (HKLM\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AppMon Utility (HKLM\...\{8C44C027-7B9F-46F1-8FD8-5767403A7CA5}) (Version: 2.0.00.11150 - Sony Corporation)
AV Mode Button Utility (HKLM\...\{1C70BE80-35E0-46DA-B81D-5BF5652F8D80}) (Version: 2.0.00.12140 - Sony Corporation)
Avira (HKLM\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter (HKLM\...\{EC37A846-53AC-4DA7-98FA-76A4E74AA900}) (Version: 2.3 - Sony Corporation)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Bonjour-Druckdienste (HKLM\...\{9D210D79-AEC5-453B-960C-4DD2C73931E1}) (Version: 2.0.2.0 - Apple Inc.)
Brother MFL-Pro Suite (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.00 - Brother Industries, Ltd.)
Browser Address Error Redirector (HKLM\...\{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
Chemie_Aber_Sicher Version 1.0 (HKLM\...\{0A64BFD0-0511-4C67-A3BF-D4C0C1055255}_is1) (Version: 1.0 - Marco Korn)
Click to DVD 2.0.05 Menu Data (HKLM\...\{9E407618-D9CD-4F39-9490-9ED45294073D}) (Version: 2.0.05 - Sony Corporation)
Click to DVD 2.6.00 (HKLM\...\{E809063C-51A3-4269-8984-D1EB742F2151}) (Version: 2.6.00 - Sony Corporation)
ClipGrab 3.4.9 (HKLM\...\{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1) (Version: - Philipp Schmieder Medien)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Der Kleine Turnierplaner 7.1.7.1 (HKLM\...\Der_Deploy_0) (Version: 7.1.7.1 - Der Kleine Turnierplaner)
D-Fend Reloaded 1.3.3 (deinstallieren) (HKLM\...\D-Fend Reloaded) (Version: 1.3.3 - Alexander Herzog)
D-GISS 2012-2013 (HKLM\...\{7795E195-15ED-4C27-8B43-D415669DE293}) (Version: 17.0 - Universum Verlag GmbH, Wiesbaden)
Dropbox (HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
DVgate Plus (HKLM\...\{685BCC47-B8EC-45EC-BBCE-77DF2451502C}) (Version: - Sony Corporation)
Epson Universal Laser P6 (HKLM\...\Epson Universal Laser P6) (Version: - )
ffdshow v1.3.4500 [2013-01-06] (HKLM\...\ffdshow_is1) (Version: 1.3.4500.0 - )
Free Video to Flash Converter version 5.0.30.1029 (HKLM\...\Free Video to Flash Converter_is1) (Version: 5.0.30.1029 - DVDVideoSoft Ltd.)
FreeCommander XE (HKLM\...\FreeCommander XE_is1) (Version: Preview - Marek Jasinski)
Garmin City Navigator Europe v8 (HKLM\...\{3879E12E-DA5B-4451-B973-DA0E2FEE7039}) (Version: 8.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin MapSource (HKLM\...\{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}) (Version: 6.16.3 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
HDAUDIO SoftV92 Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200) (Version: - )
Image Resizer for Windows (HKLM\...\{9dfff2f7-5cd7-4fd4-9b75-7d53b042d94b}) (Version: 3.0.4442.6002 - Brice Lambson)
Image Resizer for Windows (Version: 3.0.4442.6002 - Brice Lambson) Hidden
Intel(R) Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - )
Intel(R) PRO Network Connections Drivers (HKLM\...\PROSet) (Version: - )
iTunes (HKLM\...\{3A9FE6B1-EE7F-40AC-B831-AC7C9ABB58A0}) (Version: 12.1.1.4 - Apple Inc.)
Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LAN Setting Utility (HKLM\...\{5958CAC6-373E-402F-84FE-0A699AA920B9}) (Version: 1.1.00.11010 - Sony Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM\...\{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenMG Limited Patch 4.7-07-14-05-01 (HKLM\...\OpenMG HotFix4.7-07-13-22-01) (Version: - )
OpenMG Secure Module 4.7.00 (HKLM\...\InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}) (Version: 4.7.00.12140 - Sony Corporation)
OpenMG Secure Module 4.7.00 (Version: 4.7.00.12140 - Sony Corporation) Hidden
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PaukerPlaner (HKLM\...\PaukerPlaner) (Version: - )
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.213.1 - Tracker Software Products Ltd)
Polar ProTrainer (HKLM\...\{DF7DBA84-0A55-11D6-A0A6-6A7573736972}) (Version: 5.40.170 - )
PowerISO (HKLM\...\PowerISO) (Version: - )
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Roxio Easy Media Creator Home (HKLM\...\{B7FB0C86-41A4-4402-9A33-912C462042A0}) (Version: 9.0.148 - Roxio)
Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Setting Utility Series (HKLM\...\{59452470-A902-477F-9338-9B88101681BD}) (Version: 2.0.00.11230 - Sony Corporation)
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5102.0 - SigmaTel)
Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SMART Common Files (HKLM\...\{BBA07B40-F7C6-44F7-BF08-767F8835685F}) (Version: 11.4.194.0 - SMART Technologies ULC)
SMART German Language Pack (HKLM\...\{603E8F13-20D9-4367-81F2-CF6E22D05DA9}) (Version: 11.3.29.0 - SMART Technologies ULC)
SMART Ink (HKLM\...\{5ABC49B5-D0DC-428D-A082-4AEFF6490F04}) (Version: 2.0.723.0 - SMART Technologies ULC)
SMART Notebook (HKLM\...\{E57F6C8B-E159-477E-93BF-764759747BC4}) (Version: 11.3.857.0 - SMART Technologies ULC)
SMART Produkttreiber (HKLM\...\{589B09F5-0768-4BE9-B8C0-DD253E6B3643}) (Version: 11.3.550.0 - SMART Technologies ULC)
SonicStage 4.3 (HKLM\...\{A0EB195B-5876-48E6-879D-33D4B2102610}) (Version: 4.3 - Sony Corporation)
SonicStage Mastering Studio (HKLM\...\{6332AFF1-9D9A-429C-AA03-F82749FA4F49}) (Version: 2.3 - Sony Corporation)
SonicStage Mastering Studio Audio Filter (HKLM\...\{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}) (Version: 2.3 - Sony Corporation)
SonicStage Mastering Studio Plug-Ins (HKLM\...\{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}) (Version: 2.3 - Sony Corporation)
Sony Snymsico for Vista (HKLM\...\{17C7703E-0B2A-4593-9CB7-E2FE14B6F8EA}) (Version: 1.00.1109 - Sony Corporation)
Sony Utilities DLL (HKLM\...\{EF3D45BB-2260-4008-88EA-492E7744A9DF}) (Version: 7.0.00.11210 - Sony Corporation)
Sony Video Shared Library (HKLM\...\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}) (Version: 3.1.00 - Sony Corporation)
Startfenster (HKLM\...\Startfenster) (Version: - Startfenster)
Topo Deutschland v2 (HKLM\...\{641FE800-650B-4E99-A304-9D50E7235BAF}) (Version: 2.00 - Garmin Deutschland GmbH)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
VAIO Aqua Breeze Wallpaper (HKLM\...\{97BCD719-6ECB-458F-97D6-F38D2E07375E}) (Version: 1.0.11.10100 - Sony Corporation)
VAIO Camera Capture Utility (HKLM\...\{6D2576EC-A0E9-418A-A09A-409933A3B6F4}) (Version: 2.2.03.11150 - Sony Corporation)
VAIO Camera Utility (HKLM\...\{1417F599-1DBD-4499-9375-B2813E9F890C}) (Version: 2.0.00.11140 - Sony Corporation)
VAIO Control Center (HKLM\...\{FC37C108-821D-4EDE-8F40-D5B497586805}) (Version: 2.0.00.11060 - Sony Corporation)
VAIO Cozy Orange Wallpaper (HKLM\...\{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}) (Version: 1.0.11.10100 - Sony Corporation)
VAIO Entertainment Platform (HKLM\...\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}) (Version: 2.0.00.11021 - Sony Corporation)
VAIO Event Service (HKLM\...\{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}) (Version: 3.0.00.12140 - Sony Corporation)
VAIO Hardware Diagnostics (HKLM\...\{A947C2B3-7445-42C4-9063-EE704CACCB22}) (Version: - )
VAIO Information FLOW (HKLM\...\{24960AC2-C413-4A86-B1C1-E4CCADCA44D3}) (Version: 2.0.01.03230 - Sony Corporation)
VAIO Media (Version: 6.0.10 - Sony Corporation) Hidden
VAIO Media 6.0 (HKLM\...\{560F6B2E-F0DF-44E5-8190-A4A161F0E205}) (Version: 6.0.10 - Sony Corporation)
VAIO Media AC3 Decoder 1.0 (HKLM\...\{2063C2E8-3812-4BBD-9998-6610F80C1DD4}) (Version: - )
VAIO Media Content Collection 6.0 (HKLM\...\{500162A0-4DD5-460A-BAFD-895AAE48C532}) (Version: - Sony Corporation)
VAIO Media Integrated Server 6.0 (HKLM\...\{785EB1D4-ECEC-4195-99B4-73C47E187721}) (Version: - Sony Corporation)
VAIO Media Redistribution 6.0 (HKLM\...\{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}) (Version: 6.0.11 - Sony Corporation)
VAIO Media Registration Tool 6.0 (HKLM\...\{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}) (Version: 6.0.00 - Sony Corporation)
VAIO Original Screen Saver (HKLM\...\{1BEF9285-5530-426B-A5F1-5836B95C7EB1}) (Version: - )
VAIO Photo 2007 (HKLM\...\{5E343EF6-D27C-4CFC-9FAE-9AAFB541BCEE}) (Version: 1.0.00.10130 - Sony Corporation)
VAIO Power Management (HKLM\...\{9E319E96-ED8E-4B01-9775-C521A1869A25}) (Version: 2.0.00.11240 - Sony Corporation)
VAIO Tender Green Wallpaper (HKLM\...\{934A3213-1CB6-4264-84A2-EE080C017BCA}) (Version: 1.0.11.10180 - Sony Corporation)
VAIO Update (HKLM\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
Vista Codec Package (HKLM\...\{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}) (Version: 6.4.5 - Shark007)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VU5x86 (Version: 1.1.0 - Sony Corporation ) Hidden
WD My Cloud (HKLM\...\{642CACF0-75DB-4C23-BD16-706723E5F71F}) (Version: 1.0.7.5 - Western Digital Technologies, Inc.)
WD Quick View (HKLM\...\{BE1B25F9-5A51-4DB8-81FA-CE0CABC14D07}) (Version: 2.4.10.17 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{595F1FB4-BF8B-47EB-B8E1-C519E728F49D}) (Version: 2.4.10.17 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM\...\{647175e1-9944-4a82-bac1-102c95f0a99a}) (Version: 2.4.10.17 - Western Digital Technologies, Inc.)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinDVD for VAIO (HKLM\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B6.110 - InterVideo Inc.)
WinDVD for VAIO (Version: 8.0-B6.110 - InterVideo Inc.) Hidden
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wireless Switch Setting Utility (HKLM\...\{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}) (Version: 3.6.01.20140 - Sony Corporation)
Wisdom-soft AutoScreenRecorder 3.1 Free (HKLM\...\Wisdom-soft AutoScreenRecorder 3.1 Free) (Version: - Wisdom Software Inc.)
Zip Motion Block Video codec (Remove Only) (HKLM\...\ZMBV) (Version: - DOSBox Team)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-73519233-1098474327-2808829252-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {02F770A8-BCFA-48EB-AF8C-C4E1165B5E71} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {066579AD-5C90-4B06-BF5C-E0E157C9D3B2} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {2028996C-D9AE-4607-A2A1-3B5160A01BBB} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {34332F0F-801D-4DB8-9B7A-8A7D05DB99BA} - System32\Tasks\SONY\WSSU\WSSU => C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe [2007-06-15] (Sony Corporation)
Task: {582D0782-9109-4251-9D1C-B91DDCA00980} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2008-01-19] (Microsoft Corporation)
Task: {640BADB1-0C39-415C-917E-DA5042A97814} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {74165C08-C35C-42E2-9A5F-F6C50DF47D44} - System32\Tasks\Sony Corporation\VAIO Update\Launch Application => C:\Program Files\SONY\VAIO Update\ShellExeProxy.exe [2014-02-28] (Sony Corporation)
Task: {791645BF-F290-4B97-8F10-DF0AA1E80832} - System32\Tasks\{380FD17E-A21A-46F5-BF94-1054F3E2B9FF} => pcalua.exe -a C:\Windows\system32\nvcpl.cpl -c NVIDIA Control Panel
Task: {7CD44A80-D3C7-45A2-8DDA-FCC70F2EAA8C} - System32\Tasks\LaunchMCV => MyClubVAIO.exe
Task: {87093B8D-F26D-4FC6-9623-3A7ACA1E18A4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {B1AA9A85-E9B4-47A7-9641-513E368204A9} - System32\Tasks\{97BAACCC-D7FC-4711-ACA2-DBBE7B870DC3} => pcalua.exe -a C:\Users\Florian\Downloads\dxwebsetup0411.exe -d C:\Users\Florian\Downloads
Task: {B666532F-6395-4948-BC87-D0320E8AFED6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B758C86A-479B-4F20-B8F7-F7644FE8C8D0} - System32\Tasks\MySearchDial => C:\Users\Florian\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {ECFDA39B-8F36-4713-880A-6DF212DA7797} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-16] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Florian\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) ==============
2006-10-31 15:52 - 2006-12-22 08:31 - 00108712 _____ () C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2006-12-29 13:58 - 2006-12-14 16:06 - 00010752 _____ () C:\Program Files\Sony\VAIO Event Service\VESBasePS.dll
2006-12-29 13:58 - 2006-12-14 16:06 - 00009728 _____ () C:\Program Files\Sony\VAIO Event Service\VESMgrSubPS.dll
2012-09-23 21:43 - 2012-09-23 21:43 - 00010240 _____ () C:\Program Files\Adobe\Acrobat 11.0\Acrobat\locale\de_de\acrotray.deu
2013-01-09 12:32 - 2009-04-11 00:28 - 00368640 _____ () C:\Windows\system32\msjetoledb40.dll
2015-02-19 23:40 - 2015-02-19 23:40 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2012-12-18 21:08 - 2012-12-18 21:08 - 00131072 _____ () C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Locale\de_de\PDFMaker\PDFMOutlookAddin.DEU
2013-12-21 08:04 - 2013-12-21 08:04 - 03989888 _____ () C:\Program Files\Adobe\Acrobat 11.0\PDFMaker\Common\AdobePDFMakerX.dll
2012-12-18 21:08 - 2012-12-18 21:08 - 01446912 _____ () C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Locale\de_DE\PDFMaker\AdobePDFMakerX.DEU
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2010-10-20 17:08 - 2010-10-20 17:08 - 00122720 _____ () C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL
2015-03-16 23:53 - 2015-03-16 23:53 - 16858288 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_134.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img35.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Florian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Apoint => C:\Program Files\Apoint\Apoint.exe
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: sbsdk-server => "C:\Program Files\SMART Technologies\Education Software\sbsdk-server\NodeLauncher.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SMART Board Service => "C:\Program Files\SMART Technologies\Education Software\SMARTBoardService.exe" -d
MSCONFIG\startupreg: SMART Floating Tools => "C:\Program Files\SMART Technologies\Education Software\FloatingTools.exe"
MSCONFIG\startupreg: SMART Ink => "C:\Program Files\SMART Technologies\Education Software\SMARTInk.exe" -a
MSCONFIG\startupreg: SMART Tray Tools => "C:\Program Files\SMART Technologies\Education Software\SMARTTrayIcon.exe"
MSCONFIG\startupreg: SMARTNotification => "C:\Program Files\SMART Technologies\Education Software\SMARTNotification.exe"
MSCONFIG\startupreg: UnlockerAssistant => "C:\Program Files\Unlocker\UnlockerAssistant.exe"
MSCONFIG\startupreg: VAIOCameraUtility => "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-73519233-1098474327-2808829252-500 - Administrator - Disabled)
Florian (S-1-5-21-73519233-1098474327-2808829252-1003 - Administrator - Enabled) => C:\Users\Florian
Gast (S-1-5-21-73519233-1098474327-2808829252-501 - Limited - Disabled)
==================== Faulty Device Manager Devices =============
Name: 2-Bay Personal Cloud Storage
Description: 2-Bay Personal Cloud Storage
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/09/2015 04:45:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung WDBackupEngine.exe, Version 2.0.0.15, Zeitstempel 0x54dd494c, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18881, Zeitstempel 0x51da3e27, Ausnahmecode 0xc00000fd, Fehleroffset 0x00066d79,
Prozess-ID 0x%9, Anwendungsstartzeit WDBackupEngine.exe0.
Error: (04/09/2015 04:45:33 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/09/2015 04:41:07 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\CONFIG.MSI\9C824.RBS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/09/2015 04:38:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung WDBackupEngine.exe, Version 2.0.0.15, Zeitstempel 0x54dd494c, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18881, Zeitstempel 0x51da3e27, Ausnahmecode 0xc00000fd, Fehleroffset 0x0004a152,
Prozess-ID 0x%9, Anwendungsstartzeit WDBackupEngine.exe0.
Error: (04/09/2015 04:38:06 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/08/2015 08:29:30 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/08/2015 08:29:29 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (04/08/2015 08:24:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung WDBackupEngine.exe, Version 2.0.0.15, Zeitstempel 0x54dd494c, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18881, Zeitstempel 0x51da3e27, Ausnahmecode 0xc00000fd, Fehleroffset 0x000677d7,
Prozess-ID 0x%9, Anwendungsstartzeit WDBackupEngine.exe0.
Error: (04/08/2015 08:24:17 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/08/2015 08:18:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung WDBackupEngine.exe, Version 2.0.0.15, Zeitstempel 0x54dd494c, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18881, Zeitstempel 0x51da3e27, Ausnahmecode 0xc00000fd, Fehleroffset 0x0004a152,
Prozess-ID 0x%9, Anwendungsstartzeit WDBackupEngine.exe0.
System errors:
=============
Error: (04/09/2015 04:46:14 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/09/2015 04:39:38 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/09/2015 04:34:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (04/09/2015 04:31:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (04/09/2015 00:09:12 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (04/08/2015 08:24:40 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/08/2015 08:19:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/08/2015 08:13:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/08/2015 08:08:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: WD Backup101Neustart des Diensts
Error: (04/08/2015 08:02:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Microsoft Office Sessions:
=========================
Error: (04/09/2015 04:45:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: WDBackupEngine.exe2.0.0.1554dd494cntdll.dll6.0.6002.1888151da3e27c00000fd00066d79
Error: (04/09/2015 04:45:33 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/09/2015 04:41:07 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\CONFIG.MSI\9C824.RBS
Error: (04/09/2015 04:38:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: WDBackupEngine.exe2.0.0.1554dd494cntdll.dll6.0.6002.1888151da3e27c00000fd0004a152
Error: (04/09/2015 04:38:06 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/08/2015 08:29:30 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/08/2015 08:29:29 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (04/08/2015 08:24:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: WDBackupEngine.exe2.0.0.1554dd494cntdll.dll6.0.6002.1888151da3e27c00000fd000677d7
Error: (04/08/2015 08:24:17 PM) (Source: .NET Runtime) (EventID: 1027) (User: )
Description: Anwendung: WDBackupEngine.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Stapelüberlaufs beendet.
Error: (04/08/2015 08:18:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: WDBackupEngine.exe2.0.0.1554dd494cntdll.dll6.0.6002.1888151da3e27c00000fd0004a152
CodeIntegrity Errors:
===================================
Date: 2015-03-30 11:36:45.507
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:45.165
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:41.640
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\PROGRA~1\Sony\SONICS~2\AUDIOF~1\SSMSFI~4.DLL" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:41.117
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\PROGRA~1\Sony\SONICS~2\AUDIOF~1\SSMSFI~4.DLL" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:40.504
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:40.170
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:39.847
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:39.511
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:39.166
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-03-30 11:36:38.839
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Percentage of memory in use: 63%
Total physical RAM: 3069.45 MB
Available physical RAM: 1114.43 MB
Total Pagefile: 6357.16 MB
Available Pagefile: 4039.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.56 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:102.48 GB) (Free:2.83 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 111.8 GB) (Disk ID: 00CA4B28)
Partition 1: (Not Active) - (Size=9.3 GB) - (Type=27)
Partition 2: (Active) - (Size=102.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Florian (administrator) on VAIO on 09-04-2015 18:04:12
Running from C:\Users\Florian\Downloads
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Sony Corporation) C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(PowerISO Computing, Inc.) C:\Program Files\PowerISO\PWRISOVM.EXE
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [ISBMgr.exe] => C:\Program Files\Sony\ISB Utility\ISBMgr.exe [43128 2006-11-11] (Sony Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-09-29] (Intel Corporation)
HKLM\...\Run: [AppMon Utility] => C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe [415864 2006-11-15] (Sony Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [233472 2008-03-15] (PowerISO Computing, Inc.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-02-12] (Western Digital Technologies, Inc.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\VESWinlogon: C:\Windows\system32\VESWinlogon.dll (Sony Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [Polar Sync] => [X]
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5503768 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\MountPoints2: G - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL hxxp://www.ultimatebootcd.com/
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\MountPoints2: {6c60c475-0723-11e4-985e-0013a9830d29} - J:\LaunchU3.exe -a
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.de
SearchScopes: HKLM -> DefaultScope {B877A9E2-DB00-421D-9CB0-A07AC7209C00} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BojEj-gJ3eJVrO68GNwmQlMZvKF2ZdAVIttuFmnwzh8xXYQCHclDvebJNe4_3HGQ1gGZ7deal4tE4NZgg8gS2Gr2OShu7qAYRn2B8qpX9rbM6554vJnXF1XeaMPQeqoP&q={searchTerms}
SearchScopes: HKLM -> {B877A9E2-DB00-421D-9CB0-A07AC7209C00} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> DefaultScope {B877A9E2-DB00-421D-9CB0-A07AC7209C00} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BojEj-gJ3eJVrO68GNwmQlMZvKF2ZdAVIttuFmnwzh8xXYQCHclDvebJNe4_3HGQ1gGZ7deal4tE4NZgg8gS2Gr2OShu7qAYRn2B8qpX9rbM6554vJnXF1XeaMPQeqoL&q={searchTerms}
SearchScopes: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> {B877A9E2-DB00-421D-9CB0-A07AC7209C00} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll [2013-08-22] (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: CBrowserHelperObject Object -> {CA6319C0-31B7-401E-A518-A07C3DB8F777} -> C:\Program Files\Google BAE\BAE.dll [2006-06-23] (Your Company Name)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2006-06-23] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default
FF Homepage: hxxp://www.schneehoehen.de/skigebiete/deutschland/alpen-allgaeu
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-16] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=1.1.11 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin HKU\S-1-5-21-73519233-1098474327-2808829252-1003: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF user.js: detected! => C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\user.js [2014-03-27]
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\abs@avira.com [2015-04-05]
FF Extension: MWAddon Client - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\mwaddonclient@mwaddon.com [2015-04-06]
FF Extension: Flashblock - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-09]
FF Extension: Video DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-15]
FF Extension: Adblock Plus - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-15]
FF Extension: Greasemonkey - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-01-08]
FF Extension: QuickStores-Toolbar - C:\Program Files\Mozilla Firefox\extensions\quickstores@quickstores.de [2015-04-07]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-01-14]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-02-08]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor5.0; C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe [1074480 2014-06-30] (Flexera Software LLC)
R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-09-29] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S3 MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [45056 2006-12-14] (Sony Corporation) [File not signed]
R2 MSSQL$VAIO_VEDB; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] () [File not signed]
R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
S3 SonicStage Back-End Service; C:\Program Files\Common Files\Sony Shared\AvLib\SsBeSvc.exe [112184 2007-02-05] (Sony Corporation)
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation) [File not signed]
S3 SSScsiSV; C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe [75320 2007-02-05] (Sony Corporation)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2007-01-12] (Sony Corporation) [File not signed]
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [182392 2006-12-14] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2523136 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-Mobile-Gateway; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [491520 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [745472 2007-01-10] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
R3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [274432 2006-08-23] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1228336 2014-02-28] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [172032 2006-09-26] (Sony Corporation) [File not signed]
R2 VzFw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [135168 2006-09-26] (Sony Corporation) [File not signed]
R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-02-12] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [302968 2015-02-12] (Western Digital Technologies, Inc.)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AVerM115S; C:\Windows\System32\DRIVERS\AVerM115S.sys [784256 2006-12-19] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-03-28] (Malwarebytes Corporation)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36624 2006-10-17] (Sonic Solutions) [File not signed]
R1 SCDEmu; C:\Windows\system32\Drivers\SCDEmu.sys [46652 2008-03-14] (PowerISO Computing, Inc.) [File not signed]
R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [74672 2006-11-01] (Silicon Image, Inc.)
R0 SiFilter; C:\Windows\System32\drivers\siwinacc.sys [17328 2006-11-01] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\siremfil.sys [12464 2006-11-01] (Silicon Image, Inc.)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-10-18] (SMART Technologies)
R3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-10-18] (SMART Technologies ULC)
R3 SonyImgF; C:\Windows\System32\DRIVERS\SonyImgF.sys [30976 2006-09-06] (Sony Corporation) [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [227328 2006-11-06] (Texas Instruments)
R1 tStLibG; C:\Windows\System32\drivers\tStLibG.sys [55232 2014-03-27] (StdLib)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-09 18:04 - 2015-04-09 18:04 - 00028088 _____ () C:\Users\Florian\Downloads\FRST.txt
2015-04-09 18:04 - 2015-04-09 18:04 - 00000000 ____D () C:\FRST
2015-04-09 18:02 - 2015-04-09 18:03 - 00000476 _____ () C:\Users\Florian\Downloads\defogger_disable.log
2015-04-09 18:02 - 2015-04-09 18:02 - 00000000 _____ () C:\Users\Florian\defogger_reenable
2015-04-09 18:00 - 2015-04-09 18:00 - 01135104 _____ (Farbar) C:\Users\Florian\Downloads\FRST.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00380416 _____ () C:\Users\Florian\Downloads\Gmer-19357.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00050477 _____ () C:\Users\Florian\Downloads\Defogger.exe
2015-04-09 16:49 - 2015-04-09 16:52 - 00008192 _____ () C:\Windows\system32\WDPABKP.dat
2015-04-07 17:48 - 2015-04-07 17:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-29 09:53 - 2015-04-09 16:29 - 02594726 _____ () C:\Windows\PFRO.log
2015-03-28 19:27 - 2015-03-28 19:28 - 00008734 _____ () C:\Windows\DPINST.LOG
2015-03-28 19:19 - 2015-03-28 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-03-28 19:18 - 2015-03-28 19:18 - 04197696 _____ (Piriform Ltd) C:\Users\Florian\Downloads\ccsetup503_slim.exe
2015-03-21 11:50 - 2015-03-21 11:50 - 00001897 _____ () C:\Users\Florian\Downloads\2003.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001685 _____ () C:\Users\Florian\Downloads\2002.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001336 _____ () C:\Users\Florian\Downloads\2001.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00000977 _____ () C:\Users\Florian\Downloads\2000.csv
2015-03-18 02:44 - 2015-03-18 02:44 - 00004684 _____ () C:\Users\Florian\Documents\cc_20150318_014404.reg
2015-03-18 02:39 - 2015-03-18 02:39 - 00000000 ____D () C:\Windows\pss
2015-03-11 23:57 - 2015-01-29 03:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 23:56 - 2015-01-29 03:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 23:54 - 2015-02-26 02:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 23:36 - 2015-02-20 04:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 23:36 - 2015-02-20 02:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 23:33 - 2015-02-26 04:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-11 23:33 - 2015-02-26 04:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 23:33 - 2015-01-21 04:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 23:33 - 2015-01-09 04:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 23:33 - 2015-01-09 02:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 23:32 - 2015-03-06 06:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 23:31 - 2014-10-13 03:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-03-11 23:29 - 2015-02-18 04:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 17:54 - 2015-02-21 19:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-11 17:54 - 2015-02-21 19:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 17:54 - 2015-02-21 19:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 17:54 - 2015-02-21 19:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 17:54 - 2015-02-21 19:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 17:54 - 2015-02-21 19:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 17:54 - 2015-02-21 19:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-11 17:54 - 2015-02-21 19:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 17:54 - 2015-02-21 19:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 17:54 - 2015-02-21 19:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-11 17:54 - 2015-02-21 19:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 17:54 - 2015-02-21 19:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 17:54 - 2015-02-21 19:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 17:54 - 2015-02-21 19:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 17:54 - 2015-02-21 19:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 17:54 - 2015-02-21 19:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 17:54 - 2015-02-21 19:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-11 17:54 - 2015-02-21 19:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-11 17:54 - 2015-02-21 19:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-11 17:54 - 2015-02-21 19:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 17:53 - 2015-02-21 19:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 17:53 - 2015-02-21 19:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-09 18:02 - 2013-01-08 13:00 - 00000000 ____D () C:\Users\Florian
2015-04-09 17:29 - 2014-03-27 11:29 - 00000300 _____ () C:\Windows\Tasks\MySearchDial.job
2015-04-09 17:20 - 2013-01-08 11:44 - 02016442 _____ () C:\Windows\WindowsUpdate.log
2015-04-09 17:15 - 2013-01-09 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-09 16:41 - 2014-09-14 17:18 - 00000000 ___RD () C:\Users\Florian\Dropbox
2015-04-09 16:41 - 2013-11-21 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-09 16:41 - 2013-01-15 15:07 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-09 16:40 - 2013-11-21 15:51 - 00000000 ____D () C:\Program Files\Avira
2015-04-09 16:35 - 2014-09-14 17:15 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-09 16:35 - 2014-09-14 17:14 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Dropbox
2015-04-09 16:30 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-09 16:30 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-09 16:30 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-09 16:29 - 2013-01-08 21:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-09 01:26 - 2006-11-02 15:01 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-07 16:48 - 2013-11-21 15:58 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Avira
2015-04-07 16:46 - 2013-01-08 17:45 - 00000000 ____D () C:\ProgramData\Avira
2015-04-06 20:08 - 2013-06-09 14:48 - 00000000 ____D () C:\Users\Florian\AppData\Local\Deployment
2015-04-05 18:10 - 2006-11-02 12:33 - 01714784 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-30 12:32 - 2013-06-09 14:35 - 00000000 ____D () C:\Users\Florian\Documents\Rezepte
2015-03-29 14:17 - 2015-01-05 14:44 - 00000000 ____D () C:\Users\Florian\Documents\Steuer_2015
2015-03-28 19:26 - 2014-12-06 18:45 - 00000000 ____D () C:\Program Files\Common Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:04 - 00000000 ____D () C:\Program Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:02 - 00000000 ____D () C:\ProgramData\Western Digital
2015-03-28 19:19 - 2013-11-14 19:40 - 00000000 ____D () C:\Program Files\CCleaner
2015-03-26 18:40 - 2013-01-08 21:41 - 00000000 ____D () C:\Program Files\PaukerPlaner
2015-03-21 12:14 - 2013-02-05 14:17 - 00000000 ____D () C:\Users\Florian\DFB_Stuetzpunkt
2015-03-19 23:46 - 2013-02-21 23:09 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-03-18 23:52 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-03-16 23:53 - 2014-08-18 11:23 - 00000000 ____D () C:\Users\Florian\AppData\Local\Adobe
2015-03-16 23:53 - 2013-01-09 12:19 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-16 23:53 - 2013-01-09 12:19 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-12 14:51 - 2006-11-02 14:47 - 00446472 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 00:08 - 2013-04-18 00:20 - 00000000 ____D () C:\Program Files\Free FLV Converter
2015-03-11 23:57 - 2013-01-09 00:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 23:57 - 2006-11-02 12:23 - 00000240 _____ () C:\Windows\win.ini
2015-03-11 23:53 - 2013-09-09 16:17 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 23:39 - 2006-11-02 12:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2014-03-27 11:29 - 2014-03-27 11:29 - 0000042 _____ () C:\Users\Florian\AppData\Roaming\WB.CFG
2013-11-05 01:22 - 2013-11-05 01:22 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\wklnhst.dat
2013-01-08 13:00 - 2013-07-15 17:50 - 0002032 _____ () C:\Users\Florian\AppData\Local\d3d9caps.dat
2013-04-18 00:27 - 2015-02-07 17:44 - 0039936 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Files to move or delete:
====================
C:\Users\Florian\cc_20130109_232739.reg
C:\Users\Florian\cc_20130109_232806.reg
C:\Users\Florian\WDMyCloud_win.exe
Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\avgnt.exe
C:\Users\Florian\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0fsfwm.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-09 16:45
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:02 on 09/04/2015 (Florian)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER Logfile: |
|
10.04.2015, 14:27
| #2 |
| /// the machine /// TB-Ausbilder    | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe hi,
__________________Scan mit Combofix
__________________ |
|
10.04.2015, 16:39
| #3 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Die Meldung erscheint weiterhin und Avira meldet, dass die ComboFix.exe ein unerwünschtest Programm ist.
__________________Hier das Log File von ComboFix: Combofix Logfile: Code:
ATTFilter ComboFix 15-04-09.01 - Florian 10.04.2015 16:14:17.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3069.1865 [GMT 2:00]
ausgeführt von:: c:\users\Florian\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documentation\Documentation\CS\_desktop.ini
c:\documentation\Documentation\DE\_desktop.ini
c:\documentation\Documentation\EN\_desktop.ini
c:\documentation\Documentation\ES\_desktop.ini
c:\documentation\Documentation\FI\_desktop.ini
c:\documentation\Documentation\FR\_desktop.ini
c:\documentation\Documentation\GR\_desktop.ini
c:\documentation\Documentation\IT\_desktop.ini
c:\documentation\Documentation\NL\_desktop.ini
c:\documentation\Documentation\PO\_desktop.ini
c:\documentation\Documentation\RU\_desktop.ini
c:\documentation\Documentation\SV\_desktop.ini
c:\documentation\Leaflets\CS\_desktop.ini
c:\documentation\Leaflets\DE\_desktop.ini
c:\documentation\Leaflets\EN\_desktop.ini
c:\documentation\Leaflets\ES\_desktop.ini
c:\documentation\Leaflets\FI\_desktop.ini
c:\documentation\Leaflets\FR\_desktop.ini
c:\documentation\Leaflets\GR\_desktop.ini
c:\documentation\Leaflets\IT\_desktop.ini
c:\documentation\Leaflets\NL\_desktop.ini
c:\documentation\Leaflets\PO\_desktop.ini
c:\documentation\Leaflets\RU\_desktop.ini
c:\documentation\Leaflets\SV\_desktop.ini
c:\users\Florian\AppData\Local\assembly\tmp
c:\users\Florian\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Florian\Documents\FAP1C13.tmp
c:\users\Florian\Documents\FAP1C55.tmp
c:\users\Florian\Documents\FAP631F.tmp
c:\users\Florian\Documents\FAP643B.tmp
c:\users\Florian\Documents\FAP6537.tmp
c:\users\Florian\Documents\FAP6598.tmp
c:\users\Florian\Documents\FAP66C3.tmp
c:\users\Florian\Documents\FAP74AB.tmp
c:\users\Florian\Documents\FAP75A8.tmp
c:\users\Florian\Documents\FAP9ECD.tmp
c:\users\Florian\Documents\FAP9F7C.tmp
c:\users\Florian\Documents\FAPBD99.tmp
c:\users\Florian\Documents\FAPBDCB.tmp
c:\users\Florian\WDMyCloud_win.exe
c:\windows\system32\AdobePDF.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-10 bis 2015-04-10 ))))))))))))))))))))))))))))))
.
.
2015-04-10 14:31 . 2015-04-10 15:03 -------- d-----w- c:\users\Florian\AppData\Local\temp
2015-04-09 16:16 . 2015-03-17 04:15 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-04-09 16:16 . 2015-03-17 04:15 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-04-09 16:16 . 2015-03-17 04:15 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-04-09 16:16 . 2015-04-09 16:16 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2015-04-09 16:04 . 2015-04-09 16:07 -------- d-----w- C:\FRST
2015-03-11 21:57 . 2015-01-29 01:35 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-11 21:56 . 2015-01-29 01:35 975360 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-03-11 21:54 . 2015-02-26 00:18 2064384 ----a-w- c:\windows\system32\win32k.sys
2015-03-11 21:36 . 2015-02-20 02:03 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-03-11 21:36 . 2015-02-20 00:28 296960 ----a-w- c:\windows\system32\atmfd.dll
2015-03-11 21:33 . 2015-02-26 02:01 3604408 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-03-11 21:33 . 2015-01-09 02:04 49152 ----a-w- c:\windows\system32\csrsrv.dll
2015-03-11 21:33 . 2015-01-09 00:18 64000 ----a-w- c:\windows\system32\smss.exe
2015-03-11 21:33 . 2015-02-26 02:01 3552184 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-03-11 21:33 . 2015-01-21 02:02 807936 ----a-w- c:\windows\system32\msctf.dll
2015-03-11 21:32 . 2015-03-06 04:01 279040 ----a-w- c:\windows\system32\schannel.dll
2015-03-11 21:31 . 2014-10-13 01:12 2264064 ----a-w- c:\windows\system32\msi.dll
2015-03-11 15:53 . 2015-02-21 17:20 768512 ----a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-09 16:19 . 2014-03-28 08:25 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-16 21:53 . 2013-01-09 10:19 778928 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-03-16 21:53 . 2013-01-09 10:19 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-03-05 12:51 . 2013-11-21 13:51 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-03-05 12:51 . 2013-11-21 13:51 105864 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-02-17 14:26 . 2015-02-17 14:26 1217184 ----a-w- c:\windows\system32\FM20.DLL
2015-01-15 04:13 . 2015-02-11 02:03 440760 ----a-w- c:\windows\system32\drivers\ksecdd.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-02-19 5503768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"AppMon Utility"="c:\program files\Sony\AppMonUtil\AppMonUtility.exe" [2006-11-15 415864]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2014-02-27 558496]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe" [2014-05-08 3499896]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-02-13 60712]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-04-07 726320]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-03-14 233472]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"WD Quick View"="c:\program files\Western Digital\WD Quick View\WDDMStatus.exe" [2015-02-12 5564784]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
.
c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-4-2 43382072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-12-14 14:06 73728 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Florian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2006-09-11 07:23 118784 ----a-w- c:\program files\Apoint\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2007-03-12 13:51 663552 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-01-26 14:58 65536 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2015-02-13 06:55 157480 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2014-10-02 13:23 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sbsdk-server]
2013-08-22 17:44 62768 ----a-w- c:\program files\SMART Technologies\Education Software\sbsdk-server\NodeLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2014-07-24 16:26 21650016 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMART Board Service]
2013-10-18 14:34 1937200 ----a-w- c:\program files\SMART Technologies\Education Software\SMARTBoardService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMART Floating Tools]
2013-08-22 17:47 9221424 ----a-w- c:\program files\SMART Technologies\Education Software\FloatingTools.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMART Ink]
2014-02-11 08:15 147248 ----a-w- c:\program files\SMART Technologies\Education Software\SMARTInk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMART Tray Tools]
2013-10-18 14:36 754992 ----a-w- c:\program files\SMART Technologies\Education Software\SMARTTrayIcon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMARTNotification]
2013-10-18 14:36 208688 ----a-w- c:\program files\SMART Technologies\Education Software\SMARTNotification.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIOCameraUtility]
2006-11-14 09:46 411768 ----a-w- c:\program files\Sony\VAIO Camera Utility\VCUServe.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-09 21:53]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.startfenster.de
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: RSS-Support-Site zu VAIO Information FLOW hinzufügen - c:\program files\Sony\VAIO Information FLOW\aiesc.html
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.schneehoehen.de/skigebiete/deutschland/alpen-allgaeu
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
HKCU-Run-Polar Sync - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-04-10 17:03
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Polar Sync = ?:\program files\polar\polar sync\?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
Scanne versteckte Dateien...
.
.
c:\users\Florian\AppData\Local\Temp\catchme.dll 53248 bytes executable
c:\windows\TEMP\00000006-4C555612 5497344 bytes
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 2
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\SMART Technologies\Education Software\SMARTHelperService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Western Digital\WD Drive Manager\WDDriveService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Western Digital\WD SmartWare\WDBackupEngine.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\conime.exe
c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe
c:\program files\Sony\VAIO Update\VAIOUpdt.exe
c:\program files\Sony\VAIO Update\vuagent.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-10 17:09:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-10 15:08
.
Vor Suchlauf: 5.340.090.368 Bytes frei
Nach Suchlauf: 4.997.660.672 Bytes frei
.
- - End Of File - - 778CCD5F3E46F7FFDECFC95B6FDF5DB2
5C616939100B85E558DA92B899A0FC36 [/CODE] |
|
11.04.2015, 07:23
| #4 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.04.2015, 14:46
| #5 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exeCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 11.04.2015 Suchlauf-Zeit: 11:11:33 Logdatei: MBAM.txt Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.04.11.01 Rootkit Datenbank: v2015.03.31.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Florian Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 352147 Verstrichene Zeit: 33 Min, 16 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 3 PUP.Optional.Snapdo.T, HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [0746a0cbe9a15fd7289594e228db9868], PUP.Optional.Snapdo.T, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, In Quarantäne, [0746a0cbe9a15fd7289594e228db9868], PUP.Optional.WeDownLoadManager.A, HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\WEDLMNGR, In Quarantäne, [91bc9ad10e7c0a2c4483796dca397090], Registrierungswerte: 1 PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, In Quarantäne, [1e2fc7a46e1c68ce27e57071da29af51] Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 11 PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Application, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Common, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\Common\iconsWide, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\10.213.1.15234, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.SmartBar.A, C:\Users\Florian\AppData\Local\Smartbar\SnapDo.exe_StrongName_vuedtbpoockmp1sq45awfxuouevabx0i\11.32.1.16055, In Quarantäne, [92bb94d7becc40f699d1592e788be31d], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy, In Quarantäne, [3a131a515733072ff6872265a0632ad6], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\2119BAEEDE5C41CBB4A961DC0587803A, In Quarantäne, [3a131a515733072ff6872265a0632ad6], PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\7B48B1318F8547E4B1BA84E51098227F, In Quarantäne, [3a131a515733072ff6872265a0632ad6], PUP.Optional.Datamngr.A, C:\Users\Florian\AppData\LocalLow\DataMngr, In Quarantäne, [3419303b7f0b270fa872b8d5ea1926da], Dateien: 2 PUP.Optional.OpenCandy, C:\Users\Florian\AppData\Roaming\OpenCandy\2119BAEEDE5C41CBB4A961DC0587803A\WEB.DE_MailCheck_FF_Setup_3.0.1.1739-1.exe, In Quarantäne, [3a131a515733072ff6872265a0632ad6], PUP.Optional.Datamngr.A, C:\Users\Florian\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, In Quarantäne, [3419303b7f0b270fa872b8d5ea1926da], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 11/04/2015 um 13:11:12
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-08.1 [Server]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : Florian - VAIO
# Gestarted von : C:\Users\Florian\Downloads\AdwCleaner_4.201.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : tStLibG
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\ClickIT
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoConverter
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Ordner Gelöscht : C:\Users\Florian\AppData\Roaming\Systweak
Datei Gelöscht : C:\Windows\system32\drivers\tStLibG.sys
Datei Gelöscht : C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
Datei Gelöscht : C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\invalidprefs.js
Datei Gelöscht : C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\user.js
Datei Gelöscht : C:\Program Files\Mozilla Firefox\defaults\pref\itms.js
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKCU\Software\e6888ce56ebf48
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B877A9E2-DB00-421D-9CB0-A07AC7209C00}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B877A9E2-DB00-421D-9CB0-A07AC7209C00}
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Description
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchquSRTB
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{3A014A11-3D9E-44BD-9431-2DB67F752CB9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\bi_uninstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
***** [ Internetbrowser ] *****
-\\ Internet Explorer v9.0.8112.16633
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v37.0.1 (x86 de)
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.BackPageActive", true);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.Visibility", false);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageCounter", 0);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageDay", 28);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1395820708537");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.barcodeid", "127028");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.countryiso", "de");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.downloadprovider", "snapdoocybch");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\"],\\\"hxxpInjection\\\":\\\"hxxp:\\\\\\/\\\\\\/www.superfish.com\\\\\\/ws\\\\\\/[...]
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.fromautoupdate", "true");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.installationid", "4b2f0e73-f4a9-9547-b288-4c88f04efe96");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.installdate", "27/03/2014");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1395993497");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1395994740147");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.publisher", "snapdoocyb");
[64s1or7v.default\prefs.js] - Zeile Gelöscht : user_pref("plugin.state.npconduitfirefoxplugin", 2);
*************************
AdwCleaner[R0].txt - [6911 Bytes] - [11/04/2015 12:20:55]
AdwCleaner[S0].txt - [7004 Bytes] - [11/04/2015 13:11:12]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7063 Bytes] ##########
[/CODE] Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Florian on 11.04.2015 at 13:32:05,58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}"
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CA6319C0-31B7-401E-A518-A07C3DB8F777}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\flexnet"
~~~ FireFox
Successfully deleted: [Folder] "C:\Program Files\Mozilla Firefox\extensions\quickstores@quickstores.de"
Successfully deleted: [Folder] C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\64s1or7v.default\conduitcommon
Successfully deleted: [Folder] C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\64s1or7v.default\smartbar
Successfully deleted the following from C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\64s1or7v.default\prefs.js
user_pref("CT2438727_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1395938561946,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}
user_pref("extensions.helperbar.publisher", "snapdoocyb");
user_pref("plugin.state.npconduitfirefoxplugin", 2);
Emptied folder: C:\Users\Florian\AppData\Roaming\mozilla\firefox\profiles\64s1or7v.default\minidumps [405 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.04.2015 at 13:34:52,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Florian (administrator) on VAIO on 11-04-2015 15:38:56
Running from C:\Users\Florian\Downloads
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ISBMgr.exe] => C:\Program Files\Sony\ISB Utility\ISBMgr.exe [43128 2006-11-11] (Sony Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-09-29] (Intel Corporation)
HKLM\...\Run: [AppMon Utility] => C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe [415864 2006-11-15] (Sony Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [233472 2008-03-15] (PowerISO Computing, Inc.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-02-12] (Western Digital Technologies, Inc.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\VESWinlogon: C:\Windows\system32\VESWinlogon.dll (Sony Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5529880 2015-03-13] (Piriform Ltd)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll [2013-08-22] (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2006-06-23] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default
FF Homepage: hxxp://www.schneehoehen.de/skigebiete/deutschland/alpen-allgaeu
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-16] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=1.1.11 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin HKU\S-1-5-21-73519233-1098474327-2808829252-1003: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\abs@avira.com [2015-04-05]
FF Extension: MWAddon Client - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\mwaddonclient@mwaddon.com [2015-04-06]
FF Extension: Flashblock - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-09]
FF Extension: Video DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-15]
FF Extension: Adblock Plus - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-15]
FF Extension: Greasemonkey - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-01-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-01-14]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-02-08]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor5.0; C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-07] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe [1074480 2014-06-30] (Flexera Software LLC)
S2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-09-29] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [45056 2006-12-14] (Sony Corporation) [File not signed]
S2 MSSQL$VAIO_VEDB; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] () [File not signed]
S2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
S3 SonicStage Back-End Service; C:\Program Files\Common Files\Sony Shared\AvLib\SsBeSvc.exe [112184 2007-02-05] (Sony Corporation)
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation) [File not signed]
S3 SSScsiSV; C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe [75320 2007-02-05] (Sony Corporation)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2007-01-12] (Sony Corporation) [File not signed]
S2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [182392 2006-12-14] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2523136 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-Mobile-Gateway; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [491520 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [745472 2007-01-10] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
S3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [274432 2006-08-23] (Sony Corporation) [File not signed]
S3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1228336 2014-02-28] (Sony Corporation)
S2 VzCdbSvc; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [172032 2006-09-26] (Sony Corporation) [File not signed]
S2 VzFw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [135168 2006-09-26] (Sony Corporation) [File not signed]
R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-02-12] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [302968 2015-02-12] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AVerM115S; C:\Windows\System32\DRIVERS\AVerM115S.sys [784256 2006-12-19] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36624 2006-10-17] (Sonic Solutions) [File not signed]
R1 SCDEmu; C:\Windows\system32\Drivers\SCDEmu.sys [46652 2008-03-14] (PowerISO Computing, Inc.) [File not signed]
R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [74672 2006-11-01] (Silicon Image, Inc.)
R0 SiFilter; C:\Windows\System32\drivers\siwinacc.sys [17328 2006-11-01] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\siremfil.sys [12464 2006-11-01] (Silicon Image, Inc.)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-10-18] (SMART Technologies)
R3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-10-18] (SMART Technologies ULC)
R3 SonyImgF; C:\Windows\System32\DRIVERS\SonyImgF.sys [30976 2006-09-06] (Sony Corporation) [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [227328 2006-11-06] (Texas Instruments)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-11 13:34 - 2015-04-11 13:34 - 00001985 _____ () C:\Users\Florian\Desktop\JRT.txt
2015-04-11 13:32 - 2015-04-11 13:32 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-VAIO-Windows-Vista-(TM)-Home-Premium-(32-bit).dat
2015-04-11 13:32 - 2015-04-11 13:32 - 00000000 ____D () C:\RegBackup
2015-04-11 13:19 - 2015-04-11 13:19 - 00007143 _____ () C:\Users\Florian\Desktop\AdwCleaner[S0].txt
2015-04-11 12:20 - 2015-04-11 13:12 - 00000000 ____D () C:\AdwCleaner
2015-04-11 12:07 - 2015-04-11 13:17 - 00004150 _____ () C:\Windows\PFRO.log
2015-04-11 11:09 - 2015-04-11 11:09 - 00000943 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-11 10:16 - 2015-04-11 10:16 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Florian\Downloads\mbam-setup-2.1.4.1018(1).exe
2015-04-11 10:16 - 2015-04-11 10:16 - 02686959 _____ (Thisisu) C:\Users\Florian\Desktop\JRT.exe
2015-04-11 10:16 - 2015-04-11 10:16 - 02217984 _____ () C:\Users\Florian\Downloads\AdwCleaner_4.201.exe
2015-04-10 17:41 - 2015-04-10 17:41 - 05344528 _____ (Piriform Ltd) C:\Users\Florian\Downloads\ccsetup504.exe
2015-04-10 17:09 - 2015-04-10 17:09 - 00018928 _____ () C:\ComboFix.txt
2015-04-10 16:07 - 2015-04-10 17:10 - 00000000 ____D () C:\Qoobox
2015-04-10 16:07 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-10 16:07 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-10 16:07 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-10 16:06 - 2015-04-10 17:06 - 00000000 ____D () C:\Windows\erdnt
2015-04-10 15:52 - 2015-04-10 15:52 - 05617275 ____R () C:\Users\Florian\Desktop\ComboFix.exe
2015-04-09 20:46 - 2015-04-11 13:12 - 00008192 _____ () C:\Windows\system32\WDPABKP.dat
2015-04-09 20:33 - 2015-04-09 20:33 - 00004486 _____ () C:\Users\Florian\Desktop\GMER.log
2015-04-09 19:55 - 2015-04-11 12:17 - 00003753 _____ () C:\Users\Florian\Desktop\MBAM.txt
2015-04-09 18:16 - 2015-04-11 11:09 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-04-09 18:16 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-09 18:16 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-09 18:16 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-09 18:10 - 2015-04-09 18:10 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Florian\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-09 18:05 - 2015-04-09 18:07 - 00037439 _____ () C:\Users\Florian\Downloads\Addition.txt
2015-04-09 18:04 - 2015-04-11 15:39 - 00000000 ____D () C:\FRST
2015-04-09 18:04 - 2015-04-11 15:38 - 00023028 _____ () C:\Users\Florian\Downloads\FRST.txt
2015-04-09 18:02 - 2015-04-09 18:03 - 00000476 _____ () C:\Users\Florian\Downloads\defogger_disable.log
2015-04-09 18:02 - 2015-04-09 18:02 - 00000000 _____ () C:\Users\Florian\defogger_reenable
2015-04-09 18:00 - 2015-04-09 18:00 - 01135104 _____ (Farbar) C:\Users\Florian\Downloads\FRST.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00380416 _____ () C:\Users\Florian\Downloads\Gmer-19357.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00050477 _____ () C:\Users\Florian\Downloads\Defogger.exe
2015-04-07 17:48 - 2015-04-07 17:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-28 19:19 - 2015-03-28 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-03-28 19:18 - 2015-03-28 19:18 - 04197696 _____ (Piriform Ltd) C:\Users\Florian\Downloads\ccsetup503_slim.exe
2015-03-21 11:50 - 2015-03-21 11:50 - 00001897 _____ () C:\Users\Florian\Downloads\2003.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001685 _____ () C:\Users\Florian\Downloads\2002.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001336 _____ () C:\Users\Florian\Downloads\2001.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00000977 _____ () C:\Users\Florian\Downloads\2000.csv
2015-03-18 02:44 - 2015-03-18 02:44 - 00004684 _____ () C:\Users\Florian\Documents\cc_20150318_014404.reg
2015-03-18 02:39 - 2015-03-18 02:39 - 00000000 ____D () C:\Windows\pss
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-11 15:34 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-11 15:34 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-11 15:15 - 2013-01-09 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-11 13:27 - 2013-01-08 11:44 - 01121032 _____ () C:\Windows\WindowsUpdate.log
2015-04-11 13:23 - 2014-09-14 17:18 - 00000000 ___RD () C:\Users\Florian\Dropbox
2015-04-11 13:21 - 2014-09-14 17:14 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Dropbox
2015-04-11 13:18 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-11 13:16 - 2006-11-02 15:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-11 12:16 - 2014-03-28 10:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-11 12:07 - 2006-11-02 17:31 - 00000000 ____D () C:\Windows\de-DE
2015-04-10 17:41 - 2013-11-14 19:40 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-10 17:09 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2015-04-10 17:09 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2015-04-10 17:03 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2015-04-10 16:29 - 2013-01-08 13:00 - 00000000 ____D () C:\Users\Florian
2015-04-10 15:51 - 2006-11-02 12:33 - 01714784 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-10 08:49 - 2013-06-09 14:35 - 00000000 ____D () C:\Users\Florian\Documents\Rezepte
2015-04-09 16:41 - 2013-11-21 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-09 16:41 - 2013-01-15 15:07 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-09 16:40 - 2013-11-21 15:51 - 00000000 ____D () C:\Program Files\Avira
2015-04-09 16:35 - 2014-09-14 17:15 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-09 16:29 - 2013-01-08 21:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-07 16:48 - 2013-11-21 15:58 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Avira
2015-04-07 16:46 - 2013-01-08 17:45 - 00000000 ____D () C:\ProgramData\Avira
2015-04-06 20:08 - 2013-06-09 14:48 - 00000000 ____D () C:\Users\Florian\AppData\Local\Deployment
2015-03-29 14:17 - 2015-01-05 14:44 - 00000000 ____D () C:\Users\Florian\Documents\Steuer_2015
2015-03-28 19:26 - 2014-12-06 18:45 - 00000000 ____D () C:\Program Files\Common Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:04 - 00000000 ____D () C:\Program Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:02 - 00000000 ____D () C:\ProgramData\Western Digital
2015-03-26 18:40 - 2013-01-08 21:41 - 00000000 ____D () C:\Program Files\PaukerPlaner
2015-03-21 12:14 - 2013-02-05 14:17 - 00000000 ____D () C:\Users\Florian\DFB_Stuetzpunkt
2015-03-19 23:46 - 2013-02-21 23:09 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-03-18 23:52 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-03-16 23:53 - 2014-08-18 11:23 - 00000000 ____D () C:\Users\Florian\AppData\Local\Adobe
2015-03-16 23:53 - 2013-01-09 12:19 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-16 23:53 - 2013-01-09 12:19 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-12 14:51 - 2006-11-02 14:47 - 00446472 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 00:08 - 2013-04-18 00:20 - 00000000 ____D () C:\Program Files\Free FLV Converter
==================== Files in the root of some directories =======
2014-03-27 11:29 - 2014-03-27 11:29 - 0000042 _____ () C:\Users\Florian\AppData\Roaming\WB.CFG
2013-11-05 01:22 - 2013-11-05 01:22 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\wklnhst.dat
2013-01-08 13:00 - 2013-07-15 17:50 - 0002032 _____ () C:\Users\Florian\AppData\Local\d3d9caps.dat
2013-04-18 00:27 - 2015-02-07 17:44 - 0039936 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Files to move or delete:
====================
C:\Users\Florian\cc_20130109_232739.reg
C:\Users\Florian\cc_20130109_232806.reg
Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\temp\avgnt.exe
C:\Users\Florian\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbyzhh1.dll
C:\Users\Florian\AppData\Local\temp\Quarantine.exe
C:\Users\Florian\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-11 13:28
==================== End Of Log ============================
--- --- --- |
|
12.04.2015, 07:20
| #6 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe |
|
12.04.2015, 21:59
| #7 |
| | Hier die Log FilesCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6a1b4434483999439b29e1f7e8f49f86
# engine=23340
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-12 07:15:04
# local_time=2015-04-12 09:15:04 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 186720 266398831 0 0
# scanned=225033
# found=4
# cleaned=0
# scan_time=16448
sh=B88C0170E52EE6FA1B1293ACAE514968965C3C25 ft=1 fh=4f67d62772c2cef4 vn="Variante von Win32/RiskWare.NetFilter.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\drivers\tStLibG.sys.vir"
sh=106E1261CC5B1FA6F7006910A3CDC10ACAE52E6D ft=1 fh=ef62475443475fff vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Free FLV Converter\Helper.dll"
sh=B9D494F766572C502F97D7ECA2E6763E764E2986 ft=1 fh=712917cebdacb388 vn="Variante von Win32/InstalleRex.T evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{61C40493-0A86-48B7-AA5C-42A4BA272665}\_Setupx.dll"
sh=B9D494F766572C502F97D7ECA2E6763E764E2986 ft=1 fh=712917cebdacb388 vn="Variante von Win32/InstalleRex.T evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{61C40493-0A86-48B7-AA5C-42A4BA272665}\_Setupx.dll"
Code:
ATTFilter Results of screen317's Security Check version 1.00
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java 7 Update 71
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.134
Mozilla Firefox (37.0.1)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2015
Ran by Florian (administrator) on VAIO on 12-04-2015 22:56:38
Running from C:\Users\Florian\Desktop
Loaded Profiles: Florian (Available profiles: Florian)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Sony Corporation) C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(PowerISO Computing, Inc.) C:\Program Files\PowerISO\PWRISOVM.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Program Files\PaukerPlaner\paukerplaner.exe
(Marek Jasinski) C:\Program Files\FreeCommander XE\FreeCommander.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\Office\SMARTInk-SBSDKProxy.exe
() C:\Users\Florian\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ISBMgr.exe] => C:\Program Files\Sony\ISB Utility\ISBMgr.exe [43128 2006-11-11] (Sony Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [151552 2006-09-29] (Intel Corporation)
HKLM\...\Run: [AppMon Utility] => C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe [415864 2006-11-15] (Sony Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499896 2014-05-08] (Adobe Systems Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-02-12] (Western Digital Technologies, Inc.)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\VESWinlogon: C:\Windows\system32\VESWinlogon.dll (Sony Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5529880 2015-03-13] (Piriform Ltd)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\vaiomov.scr [53248 2004-12-27] (Sony Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-73519233-1098474327-2808829252-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll [2013-08-22] (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-21] (Oracle Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-73519233-1098474327-2808829252-1003 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2013-12-21] (Adobe Systems Incorporated)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_71-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2006-06-23] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default
FF Homepage: hxxp://www.schneehoehen.de/skigebiete/deutschland/alpen-allgaeu
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-16] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=1.1.11 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)
FF Plugin HKU\S-1-5-21-73519233-1098474327-2808829252-1003: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-11-08] (Tracker Software Products (Canada) Ltd.)
FF Extension: Avira Browser Safety - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\abs@avira.com [2015-04-05]
FF Extension: MWAddon Client - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\mwaddonclient@mwaddon.com [2015-04-06]
FF Extension: Flashblock - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-09]
FF Extension: Video DownloadHelper - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-15]
FF Extension: Adblock Plus - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-15]
FF Extension: Greasemonkey - C:\Users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\64s1or7v.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-01-08]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-01-14]
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2013-02-08]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-05-08]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor5.0; C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe [1074480 2014-06-30] (Flexera Software LLC)
R2 IAANTMON; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [81920 2006-09-29] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S3 MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [45056 2006-12-14] (Sony Corporation) [File not signed]
R2 MSSQL$VAIO_VEDB; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] () [File not signed]
R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
S3 SonicStage Back-End Service; C:\Program Files\Common Files\Sony Shared\AvLib\SsBeSvc.exe [112184 2007-02-05] (Sony Corporation)
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation) [File not signed]
S3 SSScsiSV; C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe [75320 2007-02-05] (Sony Corporation)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2007-01-12] (Sony Corporation) [File not signed]
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [182392 2006-12-14] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2523136 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-IntegratedServer-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-Mobile-Gateway; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [491520 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [745472 2007-01-10] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-01-08] (Sony Corporation) [File not signed]
S3 VAIOMediaPlatform-UCLS-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-01-16] (Sony Corporation) [File not signed]
R3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [274432 2006-08-23] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1228336 2014-02-28] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [172032 2006-09-26] (Sony Corporation) [File not signed]
R2 VzFw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [135168 2006-09-26] (Sony Corporation) [File not signed]
R2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-02-12] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [302968 2015-02-12] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 AVerM115S; C:\Windows\System32\DRIVERS\AVerM115S.sys [784256 2006-12-19] (AVerMedia TECHNOLOGIES, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36624 2006-10-17] (Sonic Solutions) [File not signed]
R1 SCDEmu; C:\Windows\system32\Drivers\SCDEmu.sys [46652 2008-03-14] (PowerISO Computing, Inc.) [File not signed]
R0 SI3132; C:\Windows\System32\DRIVERS\SI3132.sys [74672 2006-11-01] (Silicon Image, Inc.)
R0 SiFilter; C:\Windows\System32\drivers\siwinacc.sys [17328 2006-11-01] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\siremfil.sys [12464 2006-11-01] (Silicon Image, Inc.)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-10-18] (SMART Technologies)
R3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-10-18] (SMART Technologies ULC)
R3 SonyImgF; C:\Windows\System32\DRIVERS\SonyImgF.sys [30976 2006-09-06] (Sony Corporation) [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [227328 2006-11-06] (Texas Instruments)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-12 22:56 - 2015-04-12 22:56 - 00000810 _____ () C:\Users\Florian\Desktop\checkup.txt
2015-04-12 22:56 - 2015-04-12 22:56 - 00000000 ____D () C:\Users\Florian\Desktop\FRST-OlderVersion
2015-04-12 22:45 - 2015-04-12 22:45 - 00001555 _____ () C:\Users\Florian\Desktop\ESET.txt
2015-04-12 16:51 - 2015-04-12 16:51 - 00000000 ____D () C:\ProgramData\FLEXnet
2015-04-12 16:33 - 2015-04-12 16:33 - 02347384 _____ (ESET) C:\Users\Florian\Downloads\esetsmartinstaller_deu.exe
2015-04-12 16:31 - 2015-04-12 16:34 - 00035492 _____ () C:\Users\Florian\Desktop\Addition.txt
2015-04-12 16:30 - 2015-04-12 22:56 - 00025364 _____ () C:\Users\Florian\Desktop\FRST.txt
2015-04-12 09:38 - 2015-04-12 09:38 - 00852616 _____ () C:\Users\Florian\Desktop\SecurityCheck.exe
2015-04-11 13:34 - 2015-04-11 13:34 - 00001985 _____ () C:\Users\Florian\Desktop\JRT.txt
2015-04-11 13:32 - 2015-04-11 13:32 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-VAIO-Windows-Vista-(TM)-Home-Premium-(32-bit).dat
2015-04-11 13:32 - 2015-04-11 13:32 - 00000000 ____D () C:\RegBackup
2015-04-11 13:19 - 2015-04-11 13:19 - 00007143 _____ () C:\Users\Florian\Desktop\AdwCleaner[S0].txt
2015-04-11 12:20 - 2015-04-11 13:12 - 00000000 ____D () C:\AdwCleaner
2015-04-11 12:07 - 2015-04-11 13:17 - 00004150 _____ () C:\Windows\PFRO.log
2015-04-11 10:16 - 2015-04-11 10:16 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Florian\Downloads\mbam-setup-2.1.4.1018(1).exe
2015-04-11 10:16 - 2015-04-11 10:16 - 02686959 _____ (Thisisu) C:\Users\Florian\Desktop\JRT.exe
2015-04-11 10:16 - 2015-04-11 10:16 - 02217984 _____ () C:\Users\Florian\Downloads\AdwCleaner_4.201.exe
2015-04-10 17:41 - 2015-04-10 17:41 - 05344528 _____ (Piriform Ltd) C:\Users\Florian\Downloads\ccsetup504.exe
2015-04-10 17:09 - 2015-04-10 17:09 - 00018928 _____ () C:\ComboFix.txt
2015-04-10 16:07 - 2015-04-10 17:10 - 00000000 ____D () C:\Qoobox
2015-04-10 16:07 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-10 16:07 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-10 16:07 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-10 16:07 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-10 16:06 - 2015-04-10 17:06 - 00000000 ____D () C:\Windows\erdnt
2015-04-10 15:52 - 2015-04-10 15:52 - 05617275 ____R () C:\Users\Florian\Desktop\ComboFix.exe
2015-04-09 20:46 - 2015-04-12 09:20 - 00008192 _____ () C:\Windows\system32\WDPABKP.dat
2015-04-09 20:33 - 2015-04-09 20:33 - 00004486 _____ () C:\Users\Florian\Desktop\GMER.log
2015-04-09 19:55 - 2015-04-11 12:17 - 00003753 _____ () C:\Users\Florian\Desktop\MBAM.txt
2015-04-09 18:10 - 2015-04-09 18:10 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Florian\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-09 18:04 - 2015-04-12 22:56 - 00000000 ____D () C:\FRST
2015-04-09 18:02 - 2015-04-09 18:02 - 00000000 _____ () C:\Users\Florian\defogger_reenable
2015-04-09 18:00 - 2015-04-12 22:56 - 01135616 _____ (Farbar) C:\Users\Florian\Desktop\FRST.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00380416 _____ () C:\Users\Florian\Downloads\Gmer-19357.exe
2015-04-09 18:00 - 2015-04-09 18:00 - 00050477 _____ () C:\Users\Florian\Downloads\Defogger.exe
2015-04-07 17:48 - 2015-04-07 17:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-28 19:19 - 2015-03-28 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-03-28 19:18 - 2015-03-28 19:18 - 04197696 _____ (Piriform Ltd) C:\Users\Florian\Downloads\ccsetup503_slim.exe
2015-03-21 11:50 - 2015-03-21 11:50 - 00001897 _____ () C:\Users\Florian\Downloads\2003.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001685 _____ () C:\Users\Florian\Downloads\2002.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00001336 _____ () C:\Users\Florian\Downloads\2001.csv
2015-03-21 11:49 - 2015-03-21 11:49 - 00000977 _____ () C:\Users\Florian\Downloads\2000.csv
2015-03-18 02:44 - 2015-03-18 02:44 - 00004684 _____ () C:\Users\Florian\Documents\cc_20150318_014404.reg
2015-03-18 02:39 - 2015-03-18 02:39 - 00000000 ____D () C:\Windows\pss
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-12 22:53 - 2013-01-08 11:44 - 01157830 _____ () C:\Windows\WindowsUpdate.log
2015-04-12 21:18 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-12 21:18 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 19:15 - 2013-01-09 12:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-12 17:46 - 2006-11-02 12:33 - 01714784 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-12 13:09 - 2013-06-09 14:48 - 00000000 ____D () C:\Users\Florian\AppData\Local\Deployment
2015-04-12 12:26 - 2013-06-09 14:48 - 00000000 ____D () C:\Users\Florian\AppData\Local\Apps\2.0
2015-04-12 09:21 - 2014-09-14 17:18 - 00000000 ___RD () C:\Users\Florian\Dropbox
2015-04-12 09:21 - 2014-09-14 17:14 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Dropbox
2015-04-12 09:17 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-11 22:49 - 2006-11-02 15:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-11 12:07 - 2006-11-02 17:31 - 00000000 ____D () C:\Windows\de-DE
2015-04-10 17:41 - 2013-11-14 19:40 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-10 17:09 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default
2015-04-10 17:09 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public
2015-04-10 17:03 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini
2015-04-10 16:29 - 2013-01-08 13:00 - 00000000 ____D () C:\Users\Florian
2015-04-10 08:49 - 2013-06-09 14:35 - 00000000 ____D () C:\Users\Florian\Documents\Rezepte
2015-04-09 16:41 - 2013-11-21 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-09 16:41 - 2013-01-15 15:07 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-09 16:40 - 2013-11-21 15:51 - 00000000 ____D () C:\Program Files\Avira
2015-04-09 16:35 - 2014-09-14 17:15 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-09 16:29 - 2013-01-08 21:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-07 16:48 - 2013-11-21 15:58 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Avira
2015-04-07 16:46 - 2013-01-08 17:45 - 00000000 ____D () C:\ProgramData\Avira
2015-03-29 14:17 - 2015-01-05 14:44 - 00000000 ____D () C:\Users\Florian\Documents\Steuer_2015
2015-03-28 19:26 - 2014-12-06 18:45 - 00000000 ____D () C:\Program Files\Common Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:04 - 00000000 ____D () C:\Program Files\Western Digital
2015-03-28 19:26 - 2014-12-06 18:02 - 00000000 ____D () C:\ProgramData\Western Digital
2015-03-26 18:40 - 2013-01-08 21:41 - 00000000 ____D () C:\Program Files\PaukerPlaner
2015-03-21 12:14 - 2013-02-05 14:17 - 00000000 ____D () C:\Users\Florian\DFB_Stuetzpunkt
2015-03-19 23:46 - 2013-02-21 23:09 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2015-03-18 23:52 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-03-16 23:53 - 2014-08-18 11:23 - 00000000 ____D () C:\Users\Florian\AppData\Local\Adobe
2015-03-16 23:53 - 2013-01-09 12:19 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-16 23:53 - 2013-01-09 12:19 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-03-27 11:29 - 2014-03-27 11:29 - 0000042 _____ () C:\Users\Florian\AppData\Roaming\WB.CFG
2013-11-05 01:22 - 2013-11-05 01:22 - 0000000 _____ () C:\Users\Florian\AppData\Roaming\wklnhst.dat
2013-01-08 13:00 - 2013-07-15 17:50 - 0002032 _____ () C:\Users\Florian\AppData\Local\d3d9caps.dat
2013-04-18 00:27 - 2015-02-07 17:44 - 0039936 _____ () C:\Users\Florian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Files to move or delete:
====================
C:\Users\Florian\cc_20130109_232739.reg
C:\Users\Florian\cc_20130109_232806.reg
Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\temp\avgnt.exe
C:\Users\Florian\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp1vgejf.dll
C:\Users\Florian\AppData\Local\temp\Quarantine.exe
C:\Users\Florian\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-12 21:30
==================== End Of Log ============================
--- --- --- |
|
13.04.2015, 10:09
| #8 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files\Free FLV Converter
C:\ProgramData\InstallMate\{61C40493-0A86-48B7-AA5C-42A4BA272665}
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.04.2015, 23:49
| #9 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exeCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-04-2015
Ran by Florian at 2015-04-13 23:46:50 Run:1
Running from C:\Users\Florian\Desktop
Loaded Profiles: Florian (Available profiles: Florian)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files\Free FLV Converter
C:\ProgramData\InstallMate\{61C40493-0A86-48B7-AA5C-42A4BA272665}
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path Or update_url value
Emptytemp:
*****************
C:\Program Files\Free FLV Converter => Moved successfully.
C:\ProgramData\InstallMate\{61C40493-0A86-48B7-AA5C-42A4BA272665} => Moved successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj" => Key deleted successfully.
EmptyTemp: => Removed 527 MB temporary data.
The system needed a reboot.
==== End of Fixlog 23:49:14 ====
|
|
14.04.2015, 10:49
| #10 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe meine Frage?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.04.2015, 12:43
| #11 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Sorry, vergessen. Weiterhin Fhelermeldung bezüglich des dll-Pfades. Mit dem Hinweis, dass die Anwendung entweder einen Fehler enthält, oder nicht für Windows gemacht ist. Vorschlag bei der Meldung Neuinstallation oder Hilfe beim Admin suchen |
|
14.04.2015, 20:08
| #12 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Screenshot bitte von der Meldung.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.04.2015, 21:57
| #13 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Hier der gewünschte Screenshot der Meldung |
|
15.04.2015, 14:19
| #14 |
| /// the machine /// TB-Ausbilder | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Avira bitte komplett deinstallieren und neu installieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.04.2015, 15:48
| #15 |
| | Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe Perfekt, funktioniert wieder. Vielen Dank für die kompetente Hilfe. |
|
| Themen zu Vista 32bit: Nach dem booten erscheint im Startbildschirm Fehlermeldeung: GDI+ von avgnt.exe |
| .exe, 32bit, avg, avgnt.exe, betriebsystem, bildschirm, booten, ccsetup, common, erneut, erschein, erscheint, fehlermeldung, fenster, files, hallo zusammen, hilfe, hinweis, launch, microsoft, programm, startbildschirm, strong, tracker, vista, vista 32bit, zusammen, öffnet |
WARNUNG an die MITLESER: 
Linear-Darstellung
