| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.04.2015, 13:42
| #1 |
 |  Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Hallo, ich habe meinen Computer vor ein paar Wochen von Avira prüfen lassen. Avira hat auch einen Virus gefunden (siehe Anhang). Seit dem erscheint nun bei jedem Neustart ein Win 8 Fenster mit der Bitte ein Programm auszuwählen, mit dem ich eine Datei öffnen möchte. Mir ist es gelungen diese Datei zu speichern, indem ich den Internet Explorer auswählte und dieser mir die Option gab, die Datei im Ordner Downloads zu speichern. Diese Datei heißt lediglich Matthias. Aber es wird dabei noch DVDVideosoft ltd. als Autor angegeben. (Datei: S.Anhang) Also habe ich nach solch einem Problem gegoogelt und ein paar Hilfestellungen gefunden. Nach einer Solchen Hilfestellung habe ich von 3 Programmen meinen Computer scannen lassen. adwcleaner (kann ich keine Logdatei finden); Hitmanpro; malwarebytes anti-malware . (Logdateien sofern vorhanden: s. Anhang) Nachdem diese Programme nun auch Malware gefunden haben, dachte ich das Problem wäre bereinigt. Ist es aber nicht. Das Fenster taucht immer noch bei jedem Start auf. Vielen dank für alle Hilfe. Grüße, matmeis |
|
23.04.2015, 13:47
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Hi und
__________________ Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
23.04.2015, 13:55
| #3 |
| | Sorry. hier die Logdateien 1. Avira Antivirus
__________________Code:
ATTFilter
Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 15. April 2015 07:29
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 8.1 Pro
Windowsversion : (plain) [6.2.9200]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : MATTHIASMEISTER
Versionsinformationen:
BUILD.DAT : 15.0.9.504 94784 Bytes 24.03.2015 14:59:00
AVSCAN.EXE : 15.0.9.504 1027528 Bytes 01.04.2015 06:24:28
AVSCANRC.DLL : 15.0.9.460 64760 Bytes 01.04.2015 06:24:28
LUKE.DLL : 15.0.9.460 60664 Bytes 01.04.2015 06:24:47
AVSCPLR.DLL : 15.0.9.460 95536 Bytes 01.04.2015 06:24:28
REPAIR.DLL : 15.0.9.504 374064 Bytes 01.04.2015 06:24:27
REPAIR.RDF : 1.0.7.10 833990 Bytes 14.04.2015 13:56:27
AVREG.DLL : 15.0.9.460 273712 Bytes 01.04.2015 06:24:27
AVLODE.DLL : 15.0.9.504 596272 Bytes 01.04.2015 06:24:25
AVLODE.RDF : 14.0.4.64 79226 Bytes 13.04.2015 08:15:39
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:15:09
XBV00198.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00199.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00200.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00201.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00202.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00203.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00204.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00205.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:54
XBV00206.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00207.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00208.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00209.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00210.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00211.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00212.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00213.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00214.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00215.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00216.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00217.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00218.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00219.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00220.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00221.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00222.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00223.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00224.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00225.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00226.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00227.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00228.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00229.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00230.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00231.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00232.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00233.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00234.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:55
XBV00235.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00236.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00237.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00238.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00239.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00240.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00241.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00242.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00243.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00244.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00245.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00246.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00247.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00248.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00249.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00250.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00251.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00252.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00253.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00254.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00255.VDF : 8.11.219.166 2048 Bytes 25.03.2015 21:55:56
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 18:20:31
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 12:46:56
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 12:26:36
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 18:26:09
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 14:03:37
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 12:13:18
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 14:17:14
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 14:16:23
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 14:15:09
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 19:35:21
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14.10.2014 08:08:27
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11.11.2014 07:43:44
XBV00012.VDF : 8.11.190.32 1876992 Bytes 03.12.2014 16:16:38
XBV00013.VDF : 8.11.201.28 2973696 Bytes 14.01.2015 11:47:52
XBV00014.VDF : 8.11.206.252 2695680 Bytes 04.02.2015 19:27:17
XBV00015.VDF : 8.11.213.84 3175936 Bytes 03.03.2015 08:36:31
XBV00016.VDF : 8.11.213.176 212480 Bytes 05.03.2015 08:36:32
XBV00017.VDF : 8.11.219.166 2033664 Bytes 25.03.2015 21:55:48
XBV00042.VDF : 8.11.219.194 36864 Bytes 25.03.2015 21:55:48
XBV00043.VDF : 8.11.219.218 7168 Bytes 25.03.2015 21:55:48
XBV00044.VDF : 8.11.219.242 6144 Bytes 25.03.2015 21:55:48
XBV00045.VDF : 8.11.219.244 7680 Bytes 25.03.2015 21:55:48
XBV00046.VDF : 8.11.219.246 5632 Bytes 26.03.2015 21:55:48
XBV00047.VDF : 8.11.219.250 38400 Bytes 26.03.2015 21:55:48
XBV00048.VDF : 8.11.219.252 14336 Bytes 26.03.2015 21:55:48
XBV00049.VDF : 8.11.219.254 18432 Bytes 26.03.2015 21:55:48
XBV00050.VDF : 8.11.220.0 7680 Bytes 26.03.2015 21:55:48
XBV00051.VDF : 8.11.220.2 10240 Bytes 26.03.2015 21:55:48
XBV00052.VDF : 8.11.220.6 2048 Bytes 26.03.2015 21:55:49
XBV00053.VDF : 8.11.220.8 2560 Bytes 26.03.2015 21:55:49
XBV00054.VDF : 8.11.220.10 17408 Bytes 26.03.2015 21:55:49
XBV00055.VDF : 8.11.220.12 2048 Bytes 26.03.2015 21:55:49
XBV00056.VDF : 8.11.220.16 23040 Bytes 26.03.2015 21:55:49
XBV00057.VDF : 8.11.220.18 8704 Bytes 26.03.2015 21:55:49
XBV00058.VDF : 8.11.220.22 30720 Bytes 27.03.2015 21:55:49
XBV00059.VDF : 8.11.220.24 6144 Bytes 27.03.2015 21:55:49
XBV00060.VDF : 8.11.220.26 2048 Bytes 27.03.2015 21:55:49
XBV00061.VDF : 8.11.220.48 9728 Bytes 27.03.2015 21:55:49
XBV00062.VDF : 8.11.220.68 14848 Bytes 27.03.2015 21:55:49
XBV00063.VDF : 8.11.220.88 23552 Bytes 27.03.2015 21:55:49
XBV00064.VDF : 8.11.220.108 9216 Bytes 27.03.2015 21:55:49
XBV00065.VDF : 8.11.220.110 15360 Bytes 27.03.2015 21:55:49
XBV00066.VDF : 8.11.220.116 27648 Bytes 27.03.2015 21:55:49
XBV00067.VDF : 8.11.220.118 10752 Bytes 27.03.2015 21:55:49
XBV00068.VDF : 8.11.220.120 6144 Bytes 27.03.2015 21:55:49
XBV00069.VDF : 8.11.220.122 62976 Bytes 28.03.2015 21:55:49
XBV00070.VDF : 8.11.220.124 2048 Bytes 28.03.2015 21:55:49
XBV00071.VDF : 8.11.220.126 9728 Bytes 28.03.2015 21:55:50
XBV00072.VDF : 8.11.220.128 20992 Bytes 28.03.2015 21:55:50
XBV00073.VDF : 8.11.220.148 54784 Bytes 29.03.2015 21:55:50
XBV00074.VDF : 8.11.220.176 7680 Bytes 29.03.2015 21:55:50
XBV00075.VDF : 8.11.220.196 32768 Bytes 30.03.2015 21:55:50
XBV00076.VDF : 8.11.220.216 2048 Bytes 30.03.2015 21:55:50
XBV00077.VDF : 8.11.220.236 9728 Bytes 30.03.2015 21:55:50
XBV00078.VDF : 8.11.220.238 15360 Bytes 30.03.2015 21:55:50
XBV00079.VDF : 8.11.220.240 9216 Bytes 30.03.2015 21:55:50
XBV00080.VDF : 8.11.220.242 4608 Bytes 30.03.2015 21:55:50
XBV00081.VDF : 8.11.220.248 58368 Bytes 30.03.2015 21:55:50
XBV00082.VDF : 8.11.220.250 2048 Bytes 30.03.2015 21:55:50
XBV00083.VDF : 8.11.220.252 2048 Bytes 30.03.2015 21:55:50
XBV00084.VDF : 8.11.220.254 39424 Bytes 31.03.2015 06:24:53
XBV00085.VDF : 8.11.221.0 2048 Bytes 31.03.2015 06:24:53
XBV00086.VDF : 8.11.221.6 40960 Bytes 31.03.2015 06:24:53
XBV00087.VDF : 8.11.221.8 2048 Bytes 31.03.2015 06:24:53
XBV00088.VDF : 8.11.221.10 16896 Bytes 31.03.2015 06:24:53
XBV00089.VDF : 8.11.221.30 10240 Bytes 31.03.2015 06:24:53
XBV00090.VDF : 8.11.221.48 29184 Bytes 31.03.2015 06:24:53
XBV00091.VDF : 8.11.221.50 2048 Bytes 31.03.2015 06:24:53
XBV00092.VDF : 8.11.221.70 27648 Bytes 31.03.2015 06:24:53
XBV00093.VDF : 8.11.221.88 3584 Bytes 31.03.2015 06:24:53
XBV00094.VDF : 8.11.221.90 32256 Bytes 31.03.2015 06:24:53
XBV00095.VDF : 8.11.221.94 34816 Bytes 01.04.2015 06:24:53
XBV00096.VDF : 8.11.221.96 8704 Bytes 01.04.2015 08:31:28
XBV00097.VDF : 8.11.221.100 8704 Bytes 01.04.2015 12:37:35
XBV00098.VDF : 8.11.221.102 7680 Bytes 01.04.2015 12:37:35
XBV00099.VDF : 8.11.221.106 39936 Bytes 01.04.2015 08:55:27
XBV00100.VDF : 8.11.221.124 8704 Bytes 01.04.2015 08:55:27
XBV00101.VDF : 8.11.221.142 12288 Bytes 01.04.2015 08:55:27
XBV00102.VDF : 8.11.221.160 7168 Bytes 01.04.2015 08:55:28
XBV00103.VDF : 8.11.221.178 7168 Bytes 01.04.2015 08:55:28
XBV00104.VDF : 8.11.221.196 8192 Bytes 01.04.2015 08:55:28
XBV00105.VDF : 8.11.221.200 33280 Bytes 02.04.2015 08:55:28
XBV00106.VDF : 8.11.221.202 2048 Bytes 02.04.2015 08:55:28
XBV00107.VDF : 8.11.221.204 28160 Bytes 02.04.2015 21:39:54
XBV00108.VDF : 8.11.221.206 2048 Bytes 02.04.2015 21:39:54
XBV00109.VDF : 8.11.221.208 33792 Bytes 02.04.2015 21:39:54
XBV00110.VDF : 8.11.221.210 24576 Bytes 02.04.2015 21:39:54
XBV00111.VDF : 8.11.221.214 18944 Bytes 02.04.2015 21:39:54
XBV00112.VDF : 8.11.221.216 11264 Bytes 02.04.2015 08:37:06
XBV00113.VDF : 8.11.221.220 29696 Bytes 03.04.2015 08:37:06
XBV00114.VDF : 8.11.221.222 2048 Bytes 03.04.2015 08:37:06
XBV00115.VDF : 8.11.221.224 31232 Bytes 03.04.2015 15:23:46
XBV00116.VDF : 8.11.221.242 3584 Bytes 03.04.2015 15:23:46
XBV00117.VDF : 8.11.222.2 11776 Bytes 03.04.2015 15:23:46
XBV00118.VDF : 8.11.222.18 7168 Bytes 03.04.2015 09:36:37
XBV00119.VDF : 8.11.222.34 6656 Bytes 03.04.2015 09:36:37
XBV00120.VDF : 8.11.222.38 15360 Bytes 03.04.2015 09:36:37
XBV00121.VDF : 8.11.222.40 5632 Bytes 03.04.2015 09:36:37
XBV00122.VDF : 8.11.222.42 6144 Bytes 03.04.2015 09:36:37
XBV00123.VDF : 8.11.222.44 46592 Bytes 04.04.2015 11:36:43
XBV00124.VDF : 8.11.222.46 2048 Bytes 04.04.2015 11:36:43
XBV00125.VDF : 8.11.222.48 2048 Bytes 04.04.2015 11:36:43
XBV00126.VDF : 8.11.222.50 36864 Bytes 04.04.2015 17:01:11
XBV00127.VDF : 8.11.222.52 2048 Bytes 04.04.2015 17:01:11
XBV00128.VDF : 8.11.222.68 68096 Bytes 05.04.2015 14:36:27
XBV00129.VDF : 8.11.222.84 2048 Bytes 05.04.2015 14:36:27
XBV00130.VDF : 8.11.222.116 18432 Bytes 05.04.2015 14:36:27
XBV00131.VDF : 8.11.222.132 62464 Bytes 06.04.2015 06:00:16
XBV00132.VDF : 8.11.222.134 10752 Bytes 06.04.2015 06:00:16
XBV00133.VDF : 8.11.222.138 2048 Bytes 06.04.2015 06:00:16
XBV00134.VDF : 8.11.222.154 13312 Bytes 06.04.2015 06:00:17
XBV00135.VDF : 8.11.222.156 8704 Bytes 06.04.2015 06:00:17
XBV00136.VDF : 8.11.222.158 9216 Bytes 06.04.2015 06:00:17
XBV00137.VDF : 8.11.222.160 2048 Bytes 06.04.2015 06:00:17
XBV00138.VDF : 8.11.222.164 18432 Bytes 06.04.2015 06:00:17
XBV00139.VDF : 8.11.222.166 10752 Bytes 06.04.2015 06:00:17
XBV00140.VDF : 8.11.222.182 7168 Bytes 06.04.2015 06:00:17
XBV00141.VDF : 8.11.222.196 8704 Bytes 07.04.2015 06:00:17
XBV00142.VDF : 8.11.222.212 29696 Bytes 07.04.2015 06:00:17
XBV00143.VDF : 8.11.222.226 6656 Bytes 07.04.2015 06:00:17
XBV00144.VDF : 8.11.222.228 10752 Bytes 07.04.2015 06:00:17
XBV00145.VDF : 8.11.222.230 4096 Bytes 07.04.2015 06:00:17
XBV00146.VDF : 8.11.222.232 5120 Bytes 07.04.2015 06:00:17
XBV00147.VDF : 8.11.222.234 5632 Bytes 07.04.2015 06:00:17
XBV00148.VDF : 8.11.222.240 34816 Bytes 07.04.2015 06:00:17
XBV00149.VDF : 8.11.222.242 2048 Bytes 07.04.2015 06:00:17
XBV00150.VDF : 8.11.222.244 3584 Bytes 07.04.2015 06:00:17
XBV00151.VDF : 8.11.222.246 24576 Bytes 07.04.2015 06:00:17
XBV00152.VDF : 8.11.222.250 37888 Bytes 08.04.2015 06:00:18
XBV00153.VDF : 8.11.223.8 12800 Bytes 08.04.2015 08:15:39
XBV00154.VDF : 8.11.223.22 2048 Bytes 08.04.2015 08:15:39
XBV00155.VDF : 8.11.223.36 10752 Bytes 08.04.2015 08:15:39
XBV00156.VDF : 8.11.223.52 35328 Bytes 08.04.2015 08:15:39
XBV00157.VDF : 8.11.223.66 7168 Bytes 08.04.2015 08:15:39
XBV00158.VDF : 8.11.223.68 2048 Bytes 08.04.2015 08:15:39
XBV00159.VDF : 8.11.223.72 15360 Bytes 08.04.2015 08:15:40
XBV00160.VDF : 8.11.223.74 7168 Bytes 09.04.2015 08:15:40
XBV00161.VDF : 8.11.223.78 38400 Bytes 09.04.2015 08:15:40
XBV00162.VDF : 8.11.223.80 2048 Bytes 09.04.2015 08:15:40
XBV00163.VDF : 8.11.223.82 35328 Bytes 09.04.2015 08:15:40
XBV00164.VDF : 8.11.223.90 80896 Bytes 09.04.2015 08:15:40
XBV00165.VDF : 8.11.223.92 2048 Bytes 09.04.2015 08:15:40
XBV00166.VDF : 8.11.223.94 30208 Bytes 09.04.2015 08:15:40
XBV00167.VDF : 8.11.223.108 30208 Bytes 10.04.2015 08:15:40
XBV00168.VDF : 8.11.223.120 35840 Bytes 10.04.2015 08:15:40
XBV00169.VDF : 8.11.223.124 3072 Bytes 10.04.2015 08:15:40
XBV00170.VDF : 8.11.223.136 20480 Bytes 10.04.2015 08:15:41
XBV00171.VDF : 8.11.223.148 14848 Bytes 10.04.2015 08:15:41
XBV00172.VDF : 8.11.223.150 2048 Bytes 10.04.2015 08:15:41
XBV00173.VDF : 8.11.223.154 23552 Bytes 10.04.2015 08:15:41
XBV00174.VDF : 8.11.223.156 8192 Bytes 10.04.2015 08:15:41
XBV00175.VDF : 8.11.223.158 7680 Bytes 11.04.2015 08:15:41
XBV00176.VDF : 8.11.223.162 49152 Bytes 11.04.2015 08:15:41
XBV00177.VDF : 8.11.223.164 2048 Bytes 11.04.2015 08:15:41
XBV00178.VDF : 8.11.223.176 18944 Bytes 11.04.2015 08:15:41
XBV00179.VDF : 8.11.223.192 68096 Bytes 12.04.2015 08:15:41
XBV00180.VDF : 8.11.223.194 2048 Bytes 12.04.2015 08:15:41
XBV00181.VDF : 8.11.223.196 2048 Bytes 12.04.2015 08:15:41
XBV00182.VDF : 8.11.223.208 13312 Bytes 12.04.2015 08:15:41
XBV00183.VDF : 8.11.223.210 6144 Bytes 12.04.2015 08:15:41
XBV00184.VDF : 8.11.223.222 75776 Bytes 13.04.2015 13:31:42
XBV00185.VDF : 8.11.223.224 2048 Bytes 13.04.2015 13:31:42
XBV00186.VDF : 8.11.223.236 27648 Bytes 13.04.2015 13:31:42
XBV00187.VDF : 8.11.223.246 2048 Bytes 13.04.2015 13:31:42
XBV00188.VDF : 8.11.224.2 9728 Bytes 13.04.2015 07:54:38
XBV00189.VDF : 8.11.224.12 33792 Bytes 13.04.2015 07:54:38
XBV00190.VDF : 8.11.224.22 40448 Bytes 14.04.2015 07:54:38
XBV00191.VDF : 8.11.224.28 26112 Bytes 14.04.2015 11:56:19
XBV00192.VDF : 8.11.224.32 49152 Bytes 14.04.2015 17:56:31
XBV00193.VDF : 8.11.224.34 12288 Bytes 14.04.2015 21:04:35
XBV00194.VDF : 8.11.224.36 8704 Bytes 14.04.2015 21:04:35
XBV00195.VDF : 8.11.224.46 6656 Bytes 14.04.2015 05:26:29
XBV00196.VDF : 8.11.224.48 2048 Bytes 14.04.2015 05:26:29
XBV00197.VDF : 8.11.224.58 12288 Bytes 15.04.2015 05:26:29
LOCAL001.VDF : 8.11.224.58 127379456 Bytes 15.04.2015 05:26:46
Engineversion : 8.3.30.16
AEVDF.DLL : 8.3.1.6 133992 Bytes 07.09.2014 20:04:56
AESCRIPT.DLL : 8.2.2.58 560248 Bytes 23.03.2015 05:01:56
AESCN.DLL : 8.3.2.2 139456 Bytes 21.07.2014 14:44:02
AESBX.DLL : 8.2.20.34 1615784 Bytes 07.03.2015 08:36:02
AERDL.DLL : 8.2.1.20 731040 Bytes 11.02.2015 18:57:49
AEPACK.DLL : 8.4.0.62 793456 Bytes 22.02.2015 15:00:17
AEOFFICE.DLL : 8.3.1.16 359280 Bytes 30.03.2015 21:55:45
AEMOBILE.DLL : 8.1.7.0 281456 Bytes 10.03.2015 14:42:47
AEHEUR.DLL : 8.1.4.1634 8259496 Bytes 13.04.2015 08:15:38
AEHELP.DLL : 8.3.2.0 281456 Bytes 23.03.2015 05:01:51
AEGEN.DLL : 8.1.7.40 456608 Bytes 08.01.2015 14:37:01
AEEXP.DLL : 8.4.2.82 260968 Bytes 13.04.2015 08:15:39
AEEMU.DLL : 8.1.3.4 399264 Bytes 07.08.2014 14:15:06
AEDROID.DLL : 8.4.3.116 1050536 Bytes 10.03.2015 14:42:47
AECORE.DLL : 8.3.4.0 243624 Bytes 17.12.2014 19:24:17
AEBB.DLL : 8.1.2.0 60448 Bytes 07.08.2014 14:15:05
AVWINLL.DLL : 15.0.9.460 26872 Bytes 01.04.2015 06:24:21
AVPREF.DLL : 15.0.9.460 52984 Bytes 01.04.2015 06:24:27
AVREP.DLL : 15.0.9.460 220464 Bytes 01.04.2015 06:24:27
AVARKT.DLL : 15.0.9.460 228088 Bytes 01.04.2015 06:24:23
AVEVTLOG.DLL : 15.0.9.460 193328 Bytes 01.04.2015 06:24:25
SQLITE3.DLL : 15.0.9.460 455472 Bytes 01.04.2015 06:24:50
AVSMTP.DLL : 15.0.9.460 79096 Bytes 01.04.2015 06:24:28
NETNT.DLL : 15.0.9.460 15152 Bytes 01.04.2015 06:24:48
CommonImageRc.dll: 15.0.9.460 4355376 Bytes 01.04.2015 06:24:21
CommonTextRc.DLL: 15.0.9.476 70960 Bytes 01.04.2015 06:24:22
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Mittwoch, 15. April 2015 07:29
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ibmpmsvc.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '156' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '202' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnagent.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '12' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '107' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPHKLOAD.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcPrfMgrSvc.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcSvc.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '135' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVControlCenter32.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'BtwRSupportService.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'OfficeClickToRun.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'CxAudMsg64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'dashost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'SettingsService.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'MICMUTE.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'openvpnserv.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lservnt.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppSrv.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'ZeroConfigService.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMAgent.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'ICCProxy.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrYNSvc.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SvcGuiHlpr.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'loctaskmgr.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'PWMDBSVC.EXE' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'upeksvr.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'avfaudiosw.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '239' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhostex.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'tpnumlkd.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'TPOSD.EXE' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'SHTCTKY.EXE' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'LiveComm.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'skydrive.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'SettingSyncHost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'RuntimeBroker.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'fmapp.exe' - '13' Modul(e) wurden durchsucht
Durchsuche Prozess 'TpShocks.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'SYNTPHELPER.EXE' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPLpr.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'iCloudServices.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'iCloudDrive.exe' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'APSDaemon.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrStMonW.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'CSISYNCCLIENT.EXE' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'MsoSync.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'tpknrres.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'OUTLOOK.EXE' - '173' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '10' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'TiWorker.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'WinLogon.exe' - '25' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3428' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
C:\swapfile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\2001473a\FAX PAGE_0343.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\2001473b\FAX Mail_8109.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\20014742\FAX Dokumenten_4417.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
Beginne mit der Desinfektion:
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\20014742\FAX Dokumenten_4417.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5044b640.qua' verschoben!
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\2001473b\FAX Mail_8109.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48d399e7.qua' verschoben!
C:\Users\Matthias Meister\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm\c5b9c017eb7991e9\120712-0049\Att\2001473a\FAX PAGE_0343.doc
[FUND] Enthält Code des Word-Makrovirus WM/Dotty.gabfs.2
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1a8cc308.qua' verschoben!
Ende des Suchlaufs: Mittwoch, 15. April 2015 09:32
Benötigte Zeit: 2:01:41 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
54471 Verzeichnisse wurden überprüft
1188464 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
1188460 Dateien ohne Befall
14395 Archive wurden durchsucht
1 Warnungen
3 Hinweise
1229911 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Code:
ATTFilter HitmanPro 3.7.9.240
www.hitmanpro.com
Computer name . . . . : MATTHIASMEISTER
Windows . . . . . . . : 6.3.0.9600.X64/4
User name . . . . . . : MATTHIASMEISTER\Matthias Meister
UAC . . . . . . . . . : Enabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2015-04-23 10:11:06
Scan mode . . . . . . : Normal
Scan duration . . . . : 4m 10s
Disk access mode . . : Direct disk access (FsdHigh)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 1
Traces . . . . . . . : 2
Objects scanned . . . : 2.230.673
Files scanned . . . . : 83.976
Remnants scanned . . : 715.355 files / 1.431.342 keys
Malware _____________________________________________________________________
C:\Users\Matthias Meister\AppData\Roaming\OpenCandy\17A487145F3A4C4A8BE13E6AED4A2940\sp-downloader.exe -> Deleted
Size . . . . . . . : 145.928 bytes
Age . . . . . . . : 295.9 days (2014-07-01 13:30:22)
Entropy . . . . . : 7.8
SHA-256 . . . . . : C967920DC9349C9D963838391A29718B64ED2686A06D82C4AFE0363E462FB509
RSA Key Size . . . : 2048
Authenticode . . . : Valid
> Bitdefender . . . : Application.SearchProtect.Z
> Kaspersky . . . . : not-a-virus:WebToolbar.Win32.Agent.axo
Fuzzy . . . . . . : 107.0
Potential Unwanted Programs _________________________________________________
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}\ (Trovigo) -> Deleted
Code:
ATTFilter HitmanPro 3.7.9.240
www.hitmanpro.com
Computer name . . . . : MATTHIASMEISTER
Windows . . . . . . . : 6.3.0.9600.X64/4
User name . . . . . . : MATTHIASMEISTER\Matthias Meister
UAC . . . . . . . . . : Enabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2015-04-23 10:26:31
Scan mode . . . . . . : Normal
Scan duration . . . . : 3m 4s
Disk access mode . . : Direct disk access (FsdHigh)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 1
Objects scanned . . . : 2.232.979
Files scanned . . . . : 83.634
Remnants scanned . . : 715.367 files / 1.433.978 keys
Potential Unwanted Programs _________________________________________________
HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0\ (Sweetpacks) -> Deleted
Code:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/04/23 10:30:42 +0200</date>
<logfile>mbam-log-2015-04-23 (10-30-41).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.01.6.1022</version>
<malware-database>v2015.04.23.02</malware-database>
<rootkit-database>v2015.04.21.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>Matthias Meister</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>432546</objects>
<time>1324</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>1</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<file><path>C:\Windows\Installer\27c4b7.msi</path><vendor>PUP.Optional.SweetIM</vendor><action>success</action><hash>a45a620d3456d95d8a0c47e4be4811ef</hash></file>
</items>
</mbam-log>
Code:
ATTFilter <?xml version="1.0" encoding="UTF-8" ?>
<logs>
<record severity="debug" LoggingEventType="1" datetime="2015-04-23T10:10:14.722546+02:00" source="Manual" type="Update" username="SYSTEM" systemname="MATTHIASMEISTER" fromVersion="2015.3.9.1" last_modified_tag="f7df6f6e-7234-49ad-a0db-da62f68987ee" name="Remediation Database" toVersion="2015.4.22.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2015-04-23T10:10:14.787269+02:00" source="Manual" type="Update" username="SYSTEM" systemname="MATTHIASMEISTER" fromVersion="2015.2.25.1" last_modified_tag="17357ac0-7c0d-4c97-8ef7-03228e3afb2e" name="Rootkit Database" toVersion="2015.4.21.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2015-04-23T10:10:17.460891+02:00" source="Manual" type="Update" username="SYSTEM" systemname="MATTHIASMEISTER" fromVersion="2015.3.9.5" last_modified_tag="ea47eb8b-eb5c-4ca9-9a33-59f3f3d1e6ab" name="Malware Database" toVersion="2015.4.23.2"></record>
<record severity="debug" LoggingEventType="4" datetime="2015-04-23T10:24:23.006177+02:00" source="Protection" type="Error" username="SYSTEM" systemname="MATTHIASMEISTER" code="13" last_modified_tag="7764f091-5b6a-4884-b375-8f30a19849ab" message="IsLicensed"></record>
<record severity="debug" LoggingEventType="2" datetime="2015-04-23T10:24:23.021802+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="MATTHIASMEISTER" last_modified_tag="46b4e7e3-5280-4a13-a23f-59a9b1839876" result="Stopping" subtype="Malware Protection"></record>
<record severity="debug" LoggingEventType="2" datetime="2015-04-23T10:24:23.021802+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="MATTHIASMEISTER" last_modified_tag="8350de3b-9b91-4e3b-ba59-bfbc3bdda8b2" result="Stopped" subtype="Malware Protection"></record>
<record severity="debug" LoggingEventType="6" datetime="2015-04-23T10:52:57.457440+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="MATTHIASMEISTER" duration="1324" last_modified_tag="ab5f57a1-6686-42ae-ba0b-20fc80287c40" malwaredetections="0" nonmalwaredetections="1" scanresult="completed" scantype="threat" starttime="2015-04-23T10:30:42+02:00"></record>
</logs>
|
|
23.04.2015, 14:40
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.04.2015, 14:54
| #5 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Hier die geforderten Logdateien. frst.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2015 01
Ran by Matthias Meister (administrator) on MATTHIASMEISTER on 23-04-2015 15:49:18
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\avfaudiosw.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Dropbox, Inc.) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\tpknrres.exe
() C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\cammute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\tpknrsvc.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\vcamsvchlpr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenote.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows 8 Free Edition\apmwinsrv.exe [66768 2014-06-17] ()
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [480992 2014-08-28] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Google Update] => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [MusicManager] => C:\Users\Matthias Meister\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2015-04-01] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Skitch] => C:\Program Files (x86)\Evernote\Skitch\Skitch.exe [4851008 2014-05-01] (Evernote)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [OneDrive] => C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\OneDrive.exe [281248 2015-03-13] (Microsoft Corporation)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Spotify.exe [7021112 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify Web Helper] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1806904 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Sysinternals Desktops] => C:\Users\Matthias Meister\Documents\Systeminttools\Desktops.exe [116824 2015-04-13] (Sysinternals - www.sysinternals.com)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\RunOnce: [Adobe Speed Launcher] => 1429796410
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2013-05-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-11-28]
ShortcutTarget: Dropbox.lnk -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
DPF: HKLM-x32 {55A2C0CD-3DE8-4264-9637-A0B40B05714E} https://col0-sec.mail.live.com/mail/MailMigrationCabFileHolder.aspx?n=1616762545
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 134.2.200.1 134.2.200.2
FireFox:
========
FF ProfilePath: C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @microsoft.com/Office on Demand;version=1 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll [2012-11-10] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Matthias Meister\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-24] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\abs@avira.com [2014-08-06]
FF Extension: Reader - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{20068ab2-1901-4140-9f3c-81207d4dacc4} [2013-05-16]
FF Extension: DownloadHelper - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-07]
FF Extension: Ghostery - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\firefox@ghostery.com.xpi [2013-09-19]
FF Extension: Adblock Plus - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-04-23]
FF HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-04-23]
CHR Extension: (Writebox) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbehjmjchoiaglkeboicbgkpfafcmhij [2015-04-23]
CHR Extension: (MagicScroll Web Reader) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecldhagehndokdmaiaigoaecbmbnmfkc [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (feedly) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2015-04-23]
CHR Extension: (Google Play Music) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Ghostery) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-23]
CHR Extension: (Citavi Picker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-17]
CHR Extension: (AVG PrivacyFix) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
R3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S3 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [469720 2015-01-09] ()
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 Sentinel RMS License Manager; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe [884736 2010-10-20] (SafeNet, Inc.) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel(R) Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
S2 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [35024 2014-06-17] (Paragon Software Group)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [468752 2014-06-27] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-06-17] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [206032 2014-06-17] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-06-17] (Paragon Software Group)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42704 2014-06-17] (Paragon Software Group)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 NETwNs64; C:\Windows\system32\DRIVERS\Netwsw00.sys [11499008 2012-06-03] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44784 2013-05-29] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U3 idsvc; No ImagePath
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-23 15:49 - 2015-04-23 15:49 - 00031283 _____ () C:\Users\Matthias Meister\Desktop\FRST.txt
2015-04-23 15:49 - 2015-04-23 15:49 - 00000000 ____D () C:\FRST
2015-04-23 15:47 - 2015-04-23 15:47 - 02099712 _____ (Farbar) C:\Users\Matthias Meister\Desktop\FRST64.exe
2015-04-23 14:38 - 2015-04-23 14:38 - 03252699 _____ () C:\Users\Matthias Meister\Desktop\Trojaner Board.zip
2015-04-23 14:22 - 2015-04-23 14:38 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Trojaner Board
2015-04-23 14:07 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias (1)
2015-04-23 11:59 - 2015-04-23 12:53 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Citavi 5
2015-04-23 11:58 - 2015-04-23 11:58 - 00001977 _____ () C:\Users\Public\Desktop\Citavi 5.lnk
2015-04-23 11:58 - 2015-04-23 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 5
2015-04-23 11:57 - 2015-04-23 11:58 - 00000000 ____D () C:\Program Files (x86)\Citavi 5
2015-04-23 11:55 - 2015-04-23 11:55 - 97664248 _____ (Swiss Academic Software) C:\Users\Matthias Meister\Downloads\Citavi5Setup.exe
2015-04-23 10:57 - 2015-04-23 10:57 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022 (1).exe
2015-04-23 10:11 - 2015-04-23 10:11 - 00001917 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-23 10:10 - 2015-04-23 14:32 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-23 10:10 - 2015-04-23 10:16 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 10:10 - 2015-04-23 10:10 - 11028616 _____ (SurfRight B.V.) C:\Users\Matthias Meister\Downloads\HitmanPro_x64.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-23 10:08 - 2015-04-23 10:23 - 00000000 ____D () C:\AdwCleaner
2015-04-23 10:08 - 2015-04-23 10:08 - 02217984 _____ () C:\Users\Matthias Meister\Desktop\adwcleaner_4.201.exe
2015-04-23 09:05 - 2015-04-23 09:05 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2015-04-23 09:05 - 2015-04-23 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-04-22 11:26 - 2015-04-22 11:26 - 00000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-04-22 11:26 - 2015-04-22 11:26 - 00000000 __SHD () C:\Users\Matthias Meister\AppData\Local\EmieBrowserModeList
2015-04-22 11:26 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias
2015-04-17 10:45 - 2015-04-17 10:47 - 70176768 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.25.0.msi
2015-04-15 10:15 - 2015-04-23 14:06 - 00000539 _____ () C:\WINDOWS\setupact.log
2015-04-15 10:15 - 2015-04-23 10:24 - 00000722 _____ () C:\WINDOWS\PFRO.log
2015-04-15 10:15 - 2015-04-15 10:15 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-04-15 09:56 - 2015-04-15 21:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00002715 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 09:49 - 2014-11-17 22:17 - 00672984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2015-04-15 09:49 - 2014-11-17 22:17 - 00273240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2015-04-15 09:49 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-04-15 09:49 - 2014-11-14 08:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2015-04-15 09:49 - 2014-11-14 08:46 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2015-04-15 09:49 - 2014-11-14 08:39 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-04-15 09:45 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2015-04-15 09:45 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2015-04-15 09:45 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-04-15 09:45 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-04-15 09:45 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-04-15 09:45 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-04-15 09:45 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-04-15 09:45 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll
2015-04-15 09:45 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2015-04-15 09:45 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2015-04-15 09:45 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2015-04-15 09:44 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-04-15 09:44 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-04-15 09:44 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-04-15 09:44 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-04-15 09:44 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-04-15 09:44 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-04-15 09:44 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-04-15 09:44 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-04-15 09:44 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-04-15 09:44 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-04-15 09:44 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-04-15 09:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-04-15 09:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-04-15 09:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-04-15 09:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-04-15 09:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-04-15 09:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-04-15 09:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-04-15 09:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-04-15 09:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-04-15 09:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-04-15 09:44 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2015-04-15 09:44 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2015-04-15 09:44 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2015-04-14 16:18 - 2015-04-14 16:19 - 69980160 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.24.0.msi
2015-04-13 14:32 - 2015-04-13 14:33 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Systeminttools
2015-04-13 14:28 - 2015-04-13 14:28 - 13891254 _____ () C:\Users\Matthias Meister\Downloads\SysinternalsSuite.zip
2015-04-13 11:30 - 2015-04-13 14:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-13 11:16 - 2015-04-13 11:16 - 00000550 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ITA (liebenzell.intBereiche) (Z).lnk
2015-04-13 10:50 - 2015-04-23 14:14 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
2015-04-13 10:46 - 2015-04-23 14:07 - 00000000 ___RD () C:\Users\Matthias Meister\iCloudDrive
2015-04-13 10:46 - 2015-04-13 10:46 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Apple Inc
2015-04-13 10:39 - 2015-04-13 10:39 - 05344528 _____ (Piriform Ltd) C:\Users\Matthias Meister\Downloads\ccsetup504.exe
2015-04-13 10:36 - 2015-04-13 10:36 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-13 10:36 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\Program Files\iTunes
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files\iPod
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-13 10:27 - 2015-04-13 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-04-04 10:27 - 2015-04-04 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Spotify
2015-04-04 10:27 - 2015-04-04 10:27 - 00001913 _____ () C:\Users\Matthias Meister\Desktop\Spotify.lnk
2015-04-04 10:27 - 2015-04-04 10:27 - 00001899 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-04 10:26 - 2015-04-04 18:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Spotify
2015-04-04 10:26 - 2015-04-04 10:26 - 00138912 _____ (Spotify Ltd) C:\Users\Matthias Meister\Downloads\SpotifySetup.exe
2015-03-30 23:30 - 2015-03-30 23:30 - 00000000 ____D () C:\Program Files\IBM
2015-03-30 22:50 - 2015-03-30 23:26 - 812131760 _____ (IBM Corp) C:\Users\Matthias Meister\Downloads\SPSS_Statistics_22_win64.exe
2015-03-30 21:07 - 2015-03-30 21:07 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Unity
2015-03-30 21:03 - 2015-03-30 21:03 - 01081000 _____ (Unity Technologies ApS) C:\Users\Matthias Meister\Downloads\UnityWebPlayer.exe
2015-03-30 21:03 - 2015-03-30 21:03 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Unity
2015-03-28 20:48 - 2015-03-28 20:48 - 00159029 _____ () C:\Users\Matthias Meister\Downloads\FRITZ.Box Fon WLAN 7112 (UI) 87.04.88_01.01.00_1617.export
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-23 15:44 - 2013-10-17 16:40 - 00004002 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{79616768-A823-4D1A-A05A-496DB8C5B27C}
2015-04-23 15:31 - 2013-04-02 13:21 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-23 15:27 - 2013-03-12 20:24 - 00001196 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job
2015-04-23 15:15 - 2013-05-14 15:50 - 00005206 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister
2015-04-23 15:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-04-23 15:00 - 2012-11-28 17:56 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000
2015-04-23 14:56 - 2012-11-28 12:40 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-23 14:17 - 2014-06-05 19:16 - 01484336 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-23 14:11 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-23 14:11 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-04-23 14:11 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-04-23 14:07 - 2012-11-29 17:01 - 00000000 ___DO () C:\Users\Matthias Meister\SkyDrive
2015-04-23 14:07 - 2012-11-28 14:12 - 00000000 ___RD () C:\Users\Matthias Meister\Dropbox
2015-04-23 14:07 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Dropbox
2015-04-23 14:06 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-23 14:06 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI
2015-04-23 14:06 - 2013-04-02 13:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-23 12:43 - 2013-08-10 16:40 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Microsoft Help
2015-04-23 12:03 - 2014-02-03 15:34 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Swiss Academic Software
2015-04-23 12:02 - 2014-02-03 15:33 - 00000000 ____D () C:\Program Files (x86)\Citavi 4
2015-04-23 11:58 - 2014-02-03 15:33 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-04-23 11:56 - 2014-02-03 15:32 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Downloaded Installations
2015-04-23 09:27 - 2013-03-12 20:24 - 00001144 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job
2015-04-22 12:24 - 2013-02-26 18:57 - 00000678 _____ () C:\WINDOWS\BRCALIB.INI
2015-04-20 11:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-04-17 11:11 - 2015-01-11 12:07 - 00000942 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\Program Files\Calibre2
2015-04-17 09:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-04-16 13:23 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-04-16 11:12 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-04-16 10:30 - 2012-11-28 17:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Packages
2015-04-15 22:42 - 2012-12-05 18:07 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Outlook Files
2015-04-15 11:06 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2015-04-15 10:15 - 2012-11-28 12:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 10:14 - 2014-12-12 00:14 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-04-15 10:14 - 2014-07-09 10:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-04-15 10:14 - 2013-07-23 12:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-15 10:03 - 2012-11-28 10:27 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-15 09:49 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-04-15 09:42 - 2014-11-14 15:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll
2015-04-15 08:02 - 2013-10-29 15:16 - 00068145 _____ () C:\Users\Public\Documents\AcSvc.dmp
2015-04-15 08:02 - 2013-10-29 15:16 - 00012288 _____ () C:\Users\Public\Documents\AccConnAdvanced.dat
2015-04-14 20:14 - 2012-11-28 12:40 - 00003796 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-04-14 18:56 - 2014-07-16 10:54 - 00000000 ____D () C:\ProgramData\AccordanceFinalClean
2015-04-14 17:33 - 2015-01-11 12:08 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\calibre-cache
2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 11:31 - 2013-10-17 22:25 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Deployment
2015-04-13 11:00 - 2015-03-12 13:00 - 00002270 ____H () C:\Users\Matthias Meister\Documents\Default.rdp
2015-04-13 10:53 - 2012-11-28 14:38 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Apple Computer
2015-04-13 10:46 - 2013-10-17 16:15 - 00000000 ____D () C:\Users\Matthias Meister
2015-04-13 10:40 - 2013-08-22 17:31 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-13 10:40 - 2013-02-20 10:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-13 10:35 - 2012-11-28 14:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-13 10:18 - 2013-07-23 14:19 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-13 10:18 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-01 08:25 - 2012-12-18 13:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Avira
2015-04-01 08:25 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Avira
2015-03-30 23:57 - 2012-11-28 11:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-30 23:57 - 2012-11-28 11:05 - 00000000 ____D () C:\Program Files\Lenovo
2015-03-30 23:45 - 2014-05-08 21:52 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Kathrin SPSS
2015-03-30 23:29 - 2014-05-06 12:09 - 00000219 _____ () C:\WINDOWS\SysWOW64\lsprst7.tgz
2015-03-30 23:29 - 2014-05-06 12:09 - 00000205 _____ () C:\WINDOWS\SysWOW64\lsprst7.dll
2015-03-30 23:29 - 2014-05-06 12:09 - 00000016 ____H () C:\WINDOWS\SysWOW64\servdat.slm
==================== Files in the root of some directories =======
2014-01-29 18:12 - 2014-02-14 21:41 - 0000168 _____ () C:\Users\Matthias Meister\AppData\Local\270384221183696e666f
2014-01-29 18:12 - 2014-02-14 21:41 - 0000215 _____ () C:\Users\Matthias Meister\AppData\Local\75736572696e666f
2015-04-22 11:26 - 2015-04-22 11:26 - 0000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-06-04 16:40 - 2014-06-04 16:40 - 0000337 _____ () C:\Users\Matthias Meister\AppData\Local\Perfmon.PerfmonCfg
2014-07-29 08:17 - 2014-07-29 08:17 - 0001490 _____ () C:\Users\Matthias Meister\AppData\Local\recently-used.xbel
2012-12-05 13:15 - 2013-07-21 22:41 - 0007594 _____ () C:\Users\Matthias Meister\AppData\Local\resmon.resmoncfg
2013-02-13 12:45 - 2013-02-13 12:45 - 0009646 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114511.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009909 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114706.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009969 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114726.txt
2013-02-13 13:02 - 2013-02-13 13:02 - 0010292 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120230.txt
2013-02-13 13:02 - 2013-02-13 13:03 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120247.txt
2013-02-13 13:04 - 2013-02-13 13:04 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120402.txt
2013-02-20 10:46 - 2013-02-20 10:46 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094602.txt
2013-02-20 10:46 - 2013-02-20 10:47 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094618.txt
2013-02-20 10:47 - 2013-02-20 10:47 - 0010073 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094737.txt
2013-02-20 10:48 - 2013-02-20 10:48 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094812.txt
2013-03-05 17:55 - 2013-03-05 17:55 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130305.165512.txt
2013-03-12 15:29 - 2013-03-12 15:29 - 0010216 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130312.142910.txt
2013-04-02 09:46 - 2013-04-02 09:46 - 0010097 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130402.094618.txt
2013-04-03 21:03 - 2013-04-03 21:03 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130403.210334.txt
2013-04-17 16:09 - 2013-04-17 16:09 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130417.160933.txt
2013-04-30 14:49 - 2013-04-30 14:49 - 0010167 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130430.144903.txt
2013-05-06 17:32 - 2013-05-06 17:32 - 0010211 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173211.txt
2013-05-06 17:32 - 2013-05-06 17:33 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173226.txt
2013-06-03 18:31 - 2013-06-03 18:31 - 0010289 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183117.txt
2013-06-03 18:31 - 2013-06-03 18:32 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183133.txt
2013-07-23 12:44 - 2013-07-23 12:44 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.124408.txt
2013-07-23 14:14 - 2013-07-23 14:15 - 0009989 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.141452.txt
2013-07-23 14:23 - 2013-07-23 14:23 - 0009915 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.142335.txt
2013-10-17 14:33 - 2013-10-17 14:33 - 0014208 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20131017.143331.wdl
2014-01-11 15:24 - 2014-01-11 15:27 - 0014685 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140111.142447.wdl
2014-01-13 12:36 - 2014-01-13 12:36 - 0014684 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.113611.wdl
2014-01-13 12:46 - 2014-01-13 12:47 - 0016917 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.114653.txt
2014-01-14 22:06 - 2014-01-14 22:06 - 0016629 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140114.210628.wdl
2012-11-29 10:08 - 2012-11-29 10:08 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2012-12-05 11:14 - 2013-04-02 09:08 - 0009513 _____ () C:\ProgramData\MH_ErrorLog.txt
2012-11-30 22:55 - 2013-03-03 20:39 - 0000333 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
Files to move or delete:
====================
C:\Users\Matthias Meister\CTX.DAT
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpojhapc.dll
C:\Users\Matthias Meister\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-23 15:01
==================== End Of Log ============================
Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-04-2015 01
Ran by Matthias Meister at 2015-04-23 15:51:15
Running from C:\Users\Matthias Meister\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Accordance (HKLM-x32\...\{9B088535-6E1D-480E-A5F1-510E1DE6B572}_is1) (Version: 10.4.5 - Oaktree Software, Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 7.12.23 - )
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AutoHotkey 1.1.14.02 (HKLM\...\AutoHotkey) (Version: 1.1.14.02 - Lexikos)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.171.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bullzip PDF Printer 9.3.0.1516 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.3.0.1516 - Bullzip)
calibre 64bit (HKLM\...\{C5D7991D-5C4F-475D-BF58-89A068A2FF14}) (Version: 2.25.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.04 - Piriform)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05160 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05160 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.0.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.43.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.16151 - Landesfinanzdirektion Thüringen)
Evernote v. 5.8.5 (HKLM-x32\...\{5EDC25EC-D966-11E4-9E5C-00163E98E7D6}) (Version: 5.8.5.7193 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.240 - SurfRight B.V.)
HL-4150CDN (HKLM-x32\...\{123DE6D6-9566-4777-AC81-E6D86FFA95DA}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
Intel® PROSet/Wireless WiMAX Software (HKLM\...\{5F588B19-C575-4750-86FD-6ED2B76E61F1}) (Version: 7.50.0000 - Intel Corporation)
Interlinear Scripture Analyzer 2 basic (HKLM\...\{C8F753CF-C578-4138-A870-33149B689FFD}) (Version: 2.1.5.0 - Scripture4all Foundation)
IRISPen 7 (HKLM-x32\...\{699F407B-A9DE-4261-8C46-2C5C42E3172D}) (Version: 1.5.2.330 - Ihr Firmenname)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.4.0.5 - Lenovo Group Limited)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.6 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 2.3.0.84 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
LibreOffice 4.2.7.2 (HKLM-x32\...\{A313C39F-79A7-408B-97EE-8F958407D694}) (Version: 4.2.7.2 - The Document Foundation)
LyX 2.1.0 (HKLM-x32\...\LyX210) (Version: 2.1.0 - LyX Team)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office on Demand-Browser-Add-Ons (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Microsoft Office on Demand-Browser-Add-Ons) (Version: - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.5.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
Music Manager (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\MusicManager) (Version: - Google, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Pandoc 1.12.3 (HKLM-x32\...\{5DFB319D-1BD3-49AE-991A-95ED9E8BBCE8}) (Version: 1.12.3 - John MacFarlane)
Paragon HFS+ for Windows 8 Free Edition (HKLM-x32\...\{456534C0-51E7-11DF-B336-005056C00008}) (Version: 1.00 - Paragon Software)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH_Media_Driver_v2.22.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.22.18.01 - RICOH)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Scrivener (HKLM-x32\...\Scrivener 1710) (Version: 1710 - Literature and Latte)
Sentinel RMS License Manager 8.4.1 (HKLM-x32\...\{3213A8E3-81A3-417D-93B2-A116A60666C8}) (Version: 8.4.1 - SafeNet, Inc.)
Skitch (HKLM-x32\...\Skitch 2.3.1.163) (Version: 2.3.1.163 - Evernote Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Sophos SSL VPN Client 2.1 (HKLM-x32\...\Sophos SSL VPN Client) (Version: 2.1 - )
Spotify (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Spotify) (Version: 0.9.16.29.g0b5fcb05 - Spotify AB)
Telegram Desktop version 0.8.4 (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.8.4 - Telegram Messenger LLP)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.9 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.97 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{68D50088-CE92-4FF0-A220-D875E2E73151}) (Version: 6.0.0.8102 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Unity Web Player (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\UnityWebPlayer) (Version: 4.6.4f1 - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Windows Driver Package - Silicon Laboratories (silabenm) Ports (12/10/2012 6.6.1.0) (HKLM\...\F1D0CAF4C0DED9E19E7D560DEA76E9C03A9840DA) (Version: 12/10/2012 6.6.1.0 - Silicon Laboratories)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
XMind 2013 (v3.4.1) (HKLM-x32\...\XMind_is1) (Version: 3.4.1.201401221918 - XMind Ltd.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{225F8CFE-1B76-48E6-8E75-62CC471AFA28}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\RoamingOfficeActiveX.64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
23-04-2015 09:02:53 Installed Evernote v. 5.8.5
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
Task: {05CB891C-C430-44FB-A2E6-BBFD4CBB3BF1} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {05D33BDF-B8CC-45AA-92D3-D9002AD63BA8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {0CA2C72B-9776-481F-9294-2B023B5C3916} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {12E26CAC-355D-413E-8815-1F3D8E3DC4A6} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {16AC7163-24A3-4CC6-A4C5-B3DFD226F91C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {2057EB88-B9CB-48EB-AE5E-47B905FD54DD} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {23E3F989-8993-499C-B7E4-0CB50F135014} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-895578266-524488165-4032655203-1000
Task: {30622C2C-ABD3-42E3-869C-52CB71AAA599} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {3B54B7EB-6485-41D4-A696-A8BCBCE142D5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {454DB601-A28B-4668-81B4-097FA3E68187} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-03-13] (Piriform Ltd)
Task: {47318851-E293-4F05-B3A8-8A944EE0413A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {5A54D371-C499-41ED-8450-82862B2778BF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {6B3C7E23-AF30-4D60-8654-0D00BF1BBC2B} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {6D236B4F-EB9D-4105-ABC7-107FC05B5652} - System32\Tasks\{577DBEBF-24E0-4DE5-ADCA-0CA1C24DC512} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}\Setup.exe" -c -AddRemove
Task: {6DFB74AB-13CA-4EBF-A592-B6547565BB5C} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {6FB9E1DD-2FF2-4C7D-8215-5B0C3D176678} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6FBCF39A-3974-47BD-A7B5-98BD2088E4C6} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {71B27283-ADF6-4D11-A1E2-1C72ADB2FCD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {7C002A81-25B3-46B5-B50B-5FBF2C5115C7} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {7EE0D6E1-D550-47F2-9967-40EB282CDB2A} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {85DAE385-6CC4-4773-8D95-E19701EE0B3E} - System32\Tasks\{65D61D50-655A-4E16-AABB-B4DCEEB47EB6} => pcalua.exe -a "C:\Users\Matthias Meister\Desktop\83ts04ww.exe" -d "C:\Users\Matthias Meister\Desktop"
Task: {894F577B-8062-4C7F-ABEE-F5C484DEAADC} - System32\Tasks\{108EF52A-3187-4CAC-9F1F-2BB07316FD66} => pcalua.exe -a D:\GloAppInstaller\GloAppInstaller.exe -d D:\GloAppInstaller
Task: {99EE5FEC-783F-4ED8-9F14-7EB56177FA8C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {9B34940D-B95A-49D0-AE30-303BDD79C214} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {9C8D95FA-3DDC-41AF-8610-C79E58EBD09C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9FFC158D-DEEF-479E-8510-BE1594D8198C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {A6BC1F86-E80D-4983-B992-0B129A7E92F8} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {A9BA052B-F1B6-408F-B284-AD79DD856F7D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {A9E0DC59-4CF1-4003-85E9-E71028102D66} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {AA0925B4-5482-45AE-A8C2-A56168A3B7CD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {AB8ECDA1-3927-46FD-965C-E1C01114EE28} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {AD897FB0-A59A-4083-9BCE-DDB66D373347} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {B02DF302-AF51-4BD8-AE04-5F7E6C7DBB64} - System32\Tasks\{50A03D00-3269-4A49-BDB1-2CFA24F87A31} => pcalua.exe -a C:\PM\Setup.exe -d C:\PM
Task: {B42F2D24-7C93-40EE-823D-75BF8C9C39CC} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B4825007-B2A8-4703-8CC3-9D6623DEEA09} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {B8B4304A-7B6E-4898-A75C-10A9DE78ECB0} - System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {CCD3EB94-2E66-48C3-8EDA-CB164AFD3173} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {CF171EB8-9D40-4F8F-B63F-8CE4350AF4DA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {D2185F41-0AC0-4459-8E79-E25722541479} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {D95CB13D-D946-42BC-90E6-6F6EF921B25E} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-895578266-524488165-4032655203-1000 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {DA86BA23-AC45-444F-AC03-01DBBBB729F1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: {DB1C2689-BDCA-46B6-A55A-35BFD66756BE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DFDF3405-737A-493E-AA97-6BAE78F4875F} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E50237D5-168F-437E-B928-FCDAA6E20D81} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {E6D695C1-371F-409F-A8EB-4FFAE6B87AD2} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {E8F72B08-9E73-4F72-ADBA-C83EB155F071} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {EB07A24C-9C02-4FB0-9EFA-13F716A7BE8B} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {EED8DA22-AC11-47B9-B7DE-6B940B00285F} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {EF95BCC9-40DE-4BFC-9D0B-37256C2F70E6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {F196D4B9-21B8-496A-8E56-8EAA2A7D9C85} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {FE8BC4C2-EC58-4C1C-8FA9-FDB227D1BE65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) ==============
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2011-03-10 09:14 - 2012-12-19 11:58 - 00015360 _____ () C:\WINDOWS\System32\KOAZCA_L.DLL
2015-03-12 12:55 - 2011-04-11 07:26 - 00034304 _____ () C:\WINDOWS\System32\spe__l.dll
2011-06-22 11:44 - 2011-06-22 11:44 - 00034304 _____ () C:\WINDOWS\System32\sst2cl6.dll
2015-03-12 12:55 - 2013-09-13 09:29 - 01242112 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\spe__du.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-23 08:54 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-11-28 11:39 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-02-19 00:03 - 2015-01-09 16:40 - 00469720 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-01-11 16:36 - 2015-01-09 16:40 - 00013528 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2014-03-12 22:53 - 2014-03-12 22:53 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2015-04-13 11:30 - 2015-04-13 11:30 - 03348592 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-04-13 11:30 - 2015-04-13 11:30 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-04-13 11:30 - 2015-04-13 11:30 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-04-23 14:07 - 2015-04-23 14:07 - 00043008 _____ () c:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpojhapc.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2013-02-26 18:56 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-11-21 11:02 - 2014-11-21 11:02 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00799232 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\86865ced79f3180ebdfa736d895e5edb\Windows.Networking.ni.dll
2015-01-26 10:46 - 2015-01-26 10:46 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libglesv2.dll
2015-04-17 09:33 - 2015-04-13 23:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libegl.dll
2014-01-11 16:36 - 2015-01-07 10:29 - 02201088 _____ () C:\Program Files\Lenovo\Communications Utility\cxcore210.dll
2014-01-11 16:36 - 2015-01-07 10:29 - 02085888 _____ () C:\Program Files\Lenovo\Communications Utility\cv210.dll
2014-11-21 10:59 - 2014-11-21 10:59 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-03-17 10:45 - 2015-02-10 11:59 - 01032352 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2014-11-21 10:59 - 2014-11-21 10:59 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Matthias Meister\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\2015-03-24.jpg
DNS Servers: 134.2.200.1 - 134.2.200.2
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "MacDrive 9 application"
HKLM\...\StartupApproved\Run: => "LnvMobHotspotClient"
HKLM\...\StartupApproved\Run: => "SmartAudio"
HKLM\...\StartupApproved\Run: => "LenovoOptMouseUpdate"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "ApnUpdater"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SweetIM"
HKLM\...\StartupApproved\Run32: => "Sweetpacks Communicator"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "openvpn-gui"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "OneNote 2013 Screen Clipper and Launcher.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "MusicManager"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One Icon"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Skitch"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify Web Helper"
==================== Accounts: =============================
Administrator (S-1-5-21-895578266-524488165-4032655203-500 - Administrator - Disabled)
Gast (S-1-5-21-895578266-524488165-4032655203-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-895578266-524488165-4032655203-1004 - Limited - Enabled)
Matthias Meister (S-1-5-21-895578266-524488165-4032655203-1000 - Administrator - Enabled) => C:\Users\Matthias Meister
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/23/2015 03:01:04 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "(C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (04/23/2015 03:01:03 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1
System errors:
=============
Error: (04/23/2015 02:06:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2015 02:06:35 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.
Error: (04/23/2015 02:06:30 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat. Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".
Error: (04/23/2015 10:30:37 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/23/2015 10:24:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2015 10:24:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.
Error: (04/23/2015 10:24:19 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat. Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".
Error: (04/23/2015 10:23:47 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (04/23/2015 10:23:40 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (04/23/2015 10:23:40 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Microsoft Office Sessions:
=========================
Error: (04/23/2015 03:01:04 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: (C:)Falscher Parameter. (0x80070057)
Error: (04/23/2015 03:01:03 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900
Error: (04/23/2015 09:01:10 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221
CodeIntegrity Errors:
===================================
Date: 2015-04-15 11:06:07.958
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.833
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.739
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.551
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.442
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.348
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:06.458
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:06.114
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:02:08.759
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:02:08.556
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 60%
Total physical RAM: 3979.21 MB
Available physical RAM: 1556.75 MB
Total Pagefile: 8075.21 MB
Available Pagefile: 4827.17 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:119.14 GB) (Free:28.6 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 0001EDA7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
23.04.2015, 15:06
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. |
|
23.04.2015, 15:32
| #7 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Kleines Problem: Als ich die Logdatei von adwcleaner nach dem Neustart speichern wollte, ist mir seltsamerweise der editor abgestürzt und jetzt finde ich die Datei nicht wieder. Wo finde ich sie? |
|
23.04.2015, 15:34
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Steht doch in der Anleitung 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.04.2015, 15:52
| #9 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Oh sorry. Das habe ich im Eifer des Gefechts total überlesen. Hier die Logdateien: AdwCleaner Code:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 23/04/2015 um 16:16:56
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-22.1 [Server]
# Betriebssystem : Windows 8.1 Pro (x64)
# Benutzername : Matthias Meister - MATTHIASMEISTER
# Gestarted von : C:\Users\Matthias Meister\Desktop\AdwCleaner_4.201.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Ordner Gelöscht : C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Datei Gelöscht : C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage
Datei Gelöscht : C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage-journal
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v26.0 (de)
-\\ Google Chrome v42.0.2311.90
[C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : nmmhkkegccagdldgiimedpiccmgmieda
[C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : gighmmpiobklfepjocnamgkkbiglidom
*************************
AdwCleaner[R0].txt - [45630 Bytes] - [23/04/2015 10:18:02]
AdwCleaner[R1].txt - [1873 Bytes] - [23/04/2015 16:13:05]
AdwCleaner[S0].txt - [10969 Bytes] - [23/04/2015 10:22:51]
AdwCleaner[S1].txt - [1793 Bytes] - [23/04/2015 16:16:56]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1852 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.1 (04.23.2015:1)
OS: Windows 8.1 Pro x64
Ran by Matthias Meister on 23.04.2015 at 16:22:11,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [Folder] C:\Users\Matthias Meister\AppData\Roaming\mozilla\firefox\profiles\3uohh0jz.default\extensions\staged
Emptied folder: C:\Users\Matthias Meister\AppData\Roaming\mozilla\firefox\profiles\3uohh0jz.default\minidumps [28 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.04.2015 at 16:28:37,45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2015 01
Ran by Matthias Meister (administrator) on MATTHIASMEISTER on 23-04-2015 16:32:43
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows 8 Free Edition\apmwinsrv.exe [66768 2014-06-17] ()
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [480992 2014-08-28] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Google Update] => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [MusicManager] => C:\Users\Matthias Meister\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2015-04-01] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Skitch] => C:\Program Files (x86)\Evernote\Skitch\Skitch.exe [4851008 2014-05-01] (Evernote)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [OneDrive] => C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\OneDrive.exe [281248 2015-03-13] (Microsoft Corporation)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Spotify.exe [7021112 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify Web Helper] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1806904 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Sysinternals Desktops] => C:\Users\Matthias Meister\Documents\Systeminttools\Desktops.exe [116824 2015-04-13] (Sysinternals - www.sysinternals.com)
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2013-05-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-11-28]
ShortcutTarget: Dropbox.lnk -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
DPF: HKLM-x32 {55A2C0CD-3DE8-4264-9637-A0B40B05714E} https://col0-sec.mail.live.com/mail/MailMigrationCabFileHolder.aspx?n=1616762545
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 134.2.200.1 134.2.200.2
FireFox:
========
FF ProfilePath: C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @microsoft.com/Office on Demand;version=1 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll [2012-11-10] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Matthias Meister\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-24] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\abs@avira.com [2014-08-06]
FF Extension: Reader - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{20068ab2-1901-4140-9f3c-81207d4dacc4} [2013-05-16]
FF Extension: DownloadHelper - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-07]
FF Extension: Ghostery - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\firefox@ghostery.com.xpi [2013-09-19]
FF Extension: Adblock Plus - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-04-23]
FF HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-04-23]
CHR Extension: (Writebox) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbehjmjchoiaglkeboicbgkpfafcmhij [2015-04-23]
CHR Extension: (MagicScroll Web Reader) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecldhagehndokdmaiaigoaecbmbnmfkc [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (feedly) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2015-04-23]
CHR Extension: (Google Play Music) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Ghostery) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-23]
CHR Extension: (Citavi Picker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-17]
CHR Extension: (AVG PrivacyFix) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
S2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
S2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S3 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
S2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [469720 2015-01-09] ()
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
S2 Sentinel RMS License Manager; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe [884736 2010-10-20] (SafeNet, Inc.) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel(R) Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
S2 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [35024 2014-06-17] (Paragon Software Group)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [468752 2014-06-27] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-06-17] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [206032 2014-06-17] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-06-17] (Paragon Software Group)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42704 2014-06-17] (Paragon Software Group)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 NETwNs64; C:\Windows\system32\DRIVERS\Netwsw00.sys [11499008 2012-06-03] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44784 2013-05-29] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U3 idsvc; No ImagePath
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-23 16:28 - 2015-04-23 16:28 - 00001016 _____ () C:\Users\Matthias Meister\Desktop\JRT.txt
2015-04-23 16:22 - 2015-04-23 16:22 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-MATTHIASMEISTER-Windows-8.1-Pro-(64-bit).dat
2015-04-23 16:22 - 2015-04-23 16:22 - 00000000 ____D () C:\RegBackup
2015-04-23 16:10 - 2015-04-23 16:10 - 02685470 _____ (Thisisu) C:\Users\Matthias Meister\Desktop\JRT.exe
2015-04-23 16:09 - 2015-04-23 16:09 - 02217984 _____ () C:\Users\Matthias Meister\Desktop\AdwCleaner_4.201.exe
2015-04-23 15:51 - 2015-04-23 15:53 - 00048869 _____ () C:\Users\Matthias Meister\Desktop\Addition.txt
2015-04-23 15:49 - 2015-04-23 16:32 - 00027541 _____ () C:\Users\Matthias Meister\Desktop\FRST.txt
2015-04-23 15:49 - 2015-04-23 16:32 - 00000000 ____D () C:\FRST
2015-04-23 15:47 - 2015-04-23 15:47 - 02099712 _____ (Farbar) C:\Users\Matthias Meister\Desktop\FRST64.exe
2015-04-23 14:38 - 2015-04-23 14:38 - 03252699 _____ () C:\Users\Matthias Meister\Desktop\Trojaner Board.zip
2015-04-23 14:22 - 2015-04-23 14:38 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Trojaner Board
2015-04-23 14:07 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias (1)
2015-04-23 11:59 - 2015-04-23 12:53 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Citavi 5
2015-04-23 11:58 - 2015-04-23 11:58 - 00001977 _____ () C:\Users\Public\Desktop\Citavi 5.lnk
2015-04-23 11:58 - 2015-04-23 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 5
2015-04-23 11:57 - 2015-04-23 11:58 - 00000000 ____D () C:\Program Files (x86)\Citavi 5
2015-04-23 11:55 - 2015-04-23 11:55 - 97664248 _____ (Swiss Academic Software) C:\Users\Matthias Meister\Downloads\Citavi5Setup.exe
2015-04-23 10:57 - 2015-04-23 10:57 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022 (1).exe
2015-04-23 10:11 - 2015-04-23 10:11 - 00001917 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-23 10:10 - 2015-04-23 14:32 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-23 10:10 - 2015-04-23 10:16 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 10:10 - 2015-04-23 10:10 - 11028616 _____ (SurfRight B.V.) C:\Users\Matthias Meister\Downloads\HitmanPro_x64.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-23 10:08 - 2015-04-23 16:17 - 00000000 ____D () C:\AdwCleaner
2015-04-23 09:05 - 2015-04-23 09:05 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2015-04-23 09:05 - 2015-04-23 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-04-22 11:26 - 2015-04-22 11:26 - 00000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-04-22 11:26 - 2015-04-22 11:26 - 00000000 __SHD () C:\Users\Matthias Meister\AppData\Local\EmieBrowserModeList
2015-04-22 11:26 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias
2015-04-17 10:45 - 2015-04-17 10:47 - 70176768 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.25.0.msi
2015-04-15 10:15 - 2015-04-23 16:17 - 00000616 _____ () C:\WINDOWS\setupact.log
2015-04-15 10:15 - 2015-04-23 10:24 - 00000722 _____ () C:\WINDOWS\PFRO.log
2015-04-15 10:15 - 2015-04-15 10:15 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-04-15 09:56 - 2015-04-15 21:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00002715 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 09:49 - 2014-11-17 22:17 - 00672984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2015-04-15 09:49 - 2014-11-17 22:17 - 00273240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2015-04-15 09:49 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-04-15 09:49 - 2014-11-14 08:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2015-04-15 09:49 - 2014-11-14 08:46 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2015-04-15 09:49 - 2014-11-14 08:39 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-04-15 09:45 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2015-04-15 09:45 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2015-04-15 09:45 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-04-15 09:45 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-04-15 09:45 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-04-15 09:45 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-04-15 09:45 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-04-15 09:45 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll
2015-04-15 09:45 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2015-04-15 09:45 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2015-04-15 09:45 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2015-04-15 09:44 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-04-15 09:44 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-04-15 09:44 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-04-15 09:44 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-04-15 09:44 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-04-15 09:44 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-04-15 09:44 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-04-15 09:44 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-04-15 09:44 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-04-15 09:44 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-04-15 09:44 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-04-15 09:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-04-15 09:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-04-15 09:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-04-15 09:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-04-15 09:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-04-15 09:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-04-15 09:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-04-15 09:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-04-15 09:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-04-15 09:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-04-15 09:44 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2015-04-15 09:44 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2015-04-15 09:44 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2015-04-14 16:18 - 2015-04-14 16:19 - 69980160 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.24.0.msi
2015-04-13 14:32 - 2015-04-13 14:33 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Systeminttools
2015-04-13 14:28 - 2015-04-13 14:28 - 13891254 _____ () C:\Users\Matthias Meister\Downloads\SysinternalsSuite.zip
2015-04-13 11:30 - 2015-04-13 14:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-13 11:16 - 2015-04-13 11:16 - 00000550 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ITA (liebenzell.intBereiche) (Z).lnk
2015-04-13 10:50 - 2015-04-23 16:29 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
2015-04-13 10:46 - 2015-04-23 16:18 - 00000000 ___RD () C:\Users\Matthias Meister\iCloudDrive
2015-04-13 10:46 - 2015-04-13 10:46 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Apple Inc
2015-04-13 10:39 - 2015-04-13 10:39 - 05344528 _____ (Piriform Ltd) C:\Users\Matthias Meister\Downloads\ccsetup504.exe
2015-04-13 10:36 - 2015-04-13 10:36 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-13 10:36 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\Program Files\iTunes
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files\iPod
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-13 10:27 - 2015-04-13 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-04-04 10:27 - 2015-04-04 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Spotify
2015-04-04 10:27 - 2015-04-04 10:27 - 00001913 _____ () C:\Users\Matthias Meister\Desktop\Spotify.lnk
2015-04-04 10:27 - 2015-04-04 10:27 - 00001899 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-04 10:26 - 2015-04-04 18:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Spotify
2015-04-04 10:26 - 2015-04-04 10:26 - 00138912 _____ (Spotify Ltd) C:\Users\Matthias Meister\Downloads\SpotifySetup.exe
2015-03-30 23:30 - 2015-03-30 23:30 - 00000000 ____D () C:\Program Files\IBM
2015-03-30 22:50 - 2015-03-30 23:26 - 812131760 _____ (IBM Corp) C:\Users\Matthias Meister\Downloads\SPSS_Statistics_22_win64.exe
2015-03-30 21:07 - 2015-03-30 21:07 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Unity
2015-03-30 21:03 - 2015-03-30 21:03 - 01081000 _____ (Unity Technologies ApS) C:\Users\Matthias Meister\Downloads\UnityWebPlayer.exe
2015-03-30 21:03 - 2015-03-30 21:03 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Unity
2015-03-28 20:48 - 2015-03-28 20:48 - 00159029 _____ () C:\Users\Matthias Meister\Downloads\FRITZ.Box Fon WLAN 7112 (UI) 87.04.88_01.01.00_1617.export
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-23 16:31 - 2013-04-02 13:21 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-23 16:27 - 2013-03-12 20:24 - 00001196 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job
2015-04-23 16:18 - 2014-06-05 19:16 - 01519361 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-23 16:18 - 2013-05-14 15:50 - 00005208 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister
2015-04-23 16:18 - 2013-04-02 13:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-23 16:18 - 2012-11-29 17:01 - 00000000 ___DO () C:\Users\Matthias Meister\SkyDrive
2015-04-23 16:18 - 2012-11-28 14:12 - 00000000 ___RD () C:\Users\Matthias Meister\Dropbox
2015-04-23 16:18 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Dropbox
2015-04-23 16:17 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-23 16:17 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI
2015-04-23 16:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-04-23 15:56 - 2012-11-28 12:40 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-23 15:44 - 2013-10-17 16:40 - 00004002 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{79616768-A823-4D1A-A05A-496DB8C5B27C}
2015-04-23 14:11 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-23 14:11 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-04-23 14:11 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-04-23 12:43 - 2013-08-10 16:40 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Microsoft Help
2015-04-23 12:03 - 2014-02-03 15:34 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Swiss Academic Software
2015-04-23 12:02 - 2014-02-03 15:33 - 00000000 ____D () C:\Program Files (x86)\Citavi 4
2015-04-23 11:58 - 2014-02-03 15:33 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-04-23 11:56 - 2014-02-03 15:32 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Downloaded Installations
2015-04-23 09:27 - 2013-03-12 20:24 - 00001144 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job
2015-04-22 12:24 - 2013-02-26 18:57 - 00000678 _____ () C:\WINDOWS\BRCALIB.INI
2015-04-20 11:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-04-17 11:11 - 2015-01-11 12:07 - 00000942 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\Program Files\Calibre2
2015-04-17 09:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-04-16 13:23 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-04-16 11:12 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-04-16 10:30 - 2012-11-28 17:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Packages
2015-04-15 22:42 - 2012-12-05 18:07 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Outlook Files
2015-04-15 11:06 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2015-04-15 10:15 - 2012-11-28 12:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 10:14 - 2014-12-12 00:14 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-04-15 10:14 - 2014-07-09 10:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-04-15 10:14 - 2013-07-23 12:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-15 10:03 - 2012-11-28 10:27 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-15 09:49 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-04-15 09:42 - 2014-11-14 15:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll
2015-04-15 08:02 - 2013-10-29 15:16 - 00068145 _____ () C:\Users\Public\Documents\AcSvc.dmp
2015-04-15 08:02 - 2013-10-29 15:16 - 00012288 _____ () C:\Users\Public\Documents\AccConnAdvanced.dat
2015-04-14 20:14 - 2012-11-28 12:40 - 00003796 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-04-14 18:56 - 2014-07-16 10:54 - 00000000 ____D () C:\ProgramData\AccordanceFinalClean
2015-04-14 17:33 - 2015-01-11 12:08 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\calibre-cache
2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 11:31 - 2013-10-17 22:25 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Deployment
2015-04-13 11:00 - 2015-03-12 13:00 - 00002270 ____H () C:\Users\Matthias Meister\Documents\Default.rdp
2015-04-13 10:53 - 2012-11-28 14:38 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Apple Computer
2015-04-13 10:46 - 2013-10-17 16:15 - 00000000 ____D () C:\Users\Matthias Meister
2015-04-13 10:40 - 2013-08-22 17:31 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-13 10:40 - 2013-02-20 10:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-13 10:35 - 2012-11-28 14:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-13 10:18 - 2013-07-23 14:19 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-13 10:18 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-01 08:25 - 2012-12-18 13:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Avira
2015-04-01 08:25 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Avira
2015-03-30 23:57 - 2012-11-28 11:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-30 23:57 - 2012-11-28 11:05 - 00000000 ____D () C:\Program Files\Lenovo
2015-03-30 23:45 - 2014-05-08 21:52 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Kathrin SPSS
2015-03-30 23:29 - 2014-05-06 12:09 - 00000219 _____ () C:\WINDOWS\SysWOW64\lsprst7.tgz
2015-03-30 23:29 - 2014-05-06 12:09 - 00000205 _____ () C:\WINDOWS\SysWOW64\lsprst7.dll
2015-03-30 23:29 - 2014-05-06 12:09 - 00000016 ____H () C:\WINDOWS\SysWOW64\servdat.slm
==================== Files in the root of some directories =======
2014-01-29 18:12 - 2014-02-14 21:41 - 0000168 _____ () C:\Users\Matthias Meister\AppData\Local\270384221183696e666f
2014-01-29 18:12 - 2014-02-14 21:41 - 0000215 _____ () C:\Users\Matthias Meister\AppData\Local\75736572696e666f
2015-04-22 11:26 - 2015-04-22 11:26 - 0000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-06-04 16:40 - 2014-06-04 16:40 - 0000337 _____ () C:\Users\Matthias Meister\AppData\Local\Perfmon.PerfmonCfg
2014-07-29 08:17 - 2014-07-29 08:17 - 0001490 _____ () C:\Users\Matthias Meister\AppData\Local\recently-used.xbel
2012-12-05 13:15 - 2013-07-21 22:41 - 0007594 _____ () C:\Users\Matthias Meister\AppData\Local\resmon.resmoncfg
2013-02-13 12:45 - 2013-02-13 12:45 - 0009646 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114511.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009909 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114706.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009969 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114726.txt
2013-02-13 13:02 - 2013-02-13 13:02 - 0010292 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120230.txt
2013-02-13 13:02 - 2013-02-13 13:03 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120247.txt
2013-02-13 13:04 - 2013-02-13 13:04 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120402.txt
2013-02-20 10:46 - 2013-02-20 10:46 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094602.txt
2013-02-20 10:46 - 2013-02-20 10:47 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094618.txt
2013-02-20 10:47 - 2013-02-20 10:47 - 0010073 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094737.txt
2013-02-20 10:48 - 2013-02-20 10:48 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094812.txt
2013-03-05 17:55 - 2013-03-05 17:55 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130305.165512.txt
2013-03-12 15:29 - 2013-03-12 15:29 - 0010216 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130312.142910.txt
2013-04-02 09:46 - 2013-04-02 09:46 - 0010097 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130402.094618.txt
2013-04-03 21:03 - 2013-04-03 21:03 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130403.210334.txt
2013-04-17 16:09 - 2013-04-17 16:09 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130417.160933.txt
2013-04-30 14:49 - 2013-04-30 14:49 - 0010167 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130430.144903.txt
2013-05-06 17:32 - 2013-05-06 17:32 - 0010211 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173211.txt
2013-05-06 17:32 - 2013-05-06 17:33 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173226.txt
2013-06-03 18:31 - 2013-06-03 18:31 - 0010289 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183117.txt
2013-06-03 18:31 - 2013-06-03 18:32 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183133.txt
2013-07-23 12:44 - 2013-07-23 12:44 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.124408.txt
2013-07-23 14:14 - 2013-07-23 14:15 - 0009989 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.141452.txt
2013-07-23 14:23 - 2013-07-23 14:23 - 0009915 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.142335.txt
2013-10-17 14:33 - 2013-10-17 14:33 - 0014208 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20131017.143331.wdl
2014-01-11 15:24 - 2014-01-11 15:27 - 0014685 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140111.142447.wdl
2014-01-13 12:36 - 2014-01-13 12:36 - 0014684 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.113611.wdl
2014-01-13 12:46 - 2014-01-13 12:47 - 0016917 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.114653.txt
2014-01-14 22:06 - 2014-01-14 22:06 - 0016629 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140114.210628.wdl
2012-11-29 10:08 - 2012-11-29 10:08 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2012-12-05 11:14 - 2013-04-02 09:08 - 0009513 _____ () C:\ProgramData\MH_ErrorLog.txt
2012-11-30 22:55 - 2013-03-03 20:39 - 0000333 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
Files to move or delete:
====================
C:\Users\Matthias Meister\CTX.DAT
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8qbzht.dll
C:\Users\Matthias Meister\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-23 15:01
==================== End Of Log ============================
--- --- --- --- --- --- Da ich vorhin schon einmal einen Scan gemacht hatte, gibt es kein addition.txt. Beim letzten Neustart kam dieses seltsame Fenster übrigens nicht mehr. Ein erster Erfolg! Hi Cosinus, ich habe mich getäuscht. Das Fenster taucht immer noch nach Neustart auf. Es verschwindet nur wesentlich schneller wieder als vorher. Noch kein Erfolg  |
|
23.04.2015, 21:55
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.04.2015, 07:44
| #11 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Guten Morgen Cosinus, hier noch einmal Logdatei FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2015 01
Ran by Matthias Meister (administrator) on MATTHIASMEISTER on 24-04-2015 08:39:17
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SafeNet, Inc.) C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Corporation) C:\Program Files\Lenovo\Communications Utility\avfaudiosw.exe
() C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\backgroundTaskHost.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Lenovo Corporation) C:\Windows\SysWOW64\lmcfrundll.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Dropbox, Inc.) C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [384344 2014-02-17] (Lenovo.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [LnvMobHotspotClient] => C:\Program Files\Lenovo\Lenovo Mobile Hotspot\MobileHotspotclient.exe [938032 2014-03-05] (Lenovo)
HKLM\...\Run: [apmwinapp] => C:\Program Files (x86)\Paragon Software\HFS+ for Windows 8 Free Edition\apmwinsrv.exe [66768 2014-06-17] ()
HKLM\...\Run: [LMCSSTART1] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,InitSubsystemProcesses
HKLM\...\Run: [LMCSSTART2] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libstartstub2.dll,ProxyStart
HKLM\...\Run: [LMCSSTART3] => C:\WINDOWS\SysWOW64\lmcfrundll.exe C:\Program Files\Lenovo\Communications Utility\libmcsrdllb.dll,SetupCamplusDrop
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2014-03-12] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [480992 2014-08-28] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Google Update] => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [MusicManager] => C:\Users\Matthias Meister\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7475200 2015-04-01] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Skitch] => C:\Program Files (x86)\Evernote\Skitch\Skitch.exe [4851008 2014-05-01] (Evernote)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-13] (Google Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [OneDrive] => C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\OneDrive.exe [281248 2015-03-13] (Microsoft Corporation)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Spotify.exe [7021112 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Spotify Web Helper] => C:\Users\Matthias Meister\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1806904 2015-04-04] (Spotify Ltd)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Run: [Sysinternals Desktops] => C:\Users\Matthias Meister\Documents\Systeminttools\Desktops.exe [116824 2015-04-13] (Sysinternals - www.sysinternals.com)
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2013-05-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-11-28]
ShortcutTarget: Dropbox.lnk -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2013-08-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-04-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
DPF: HKLM-x32 {55A2C0CD-3DE8-4264-9637-A0B40B05714E} https://col0-sec.mail.live.com/mail/MailMigrationCabFileHolder.aspx?n=1616762545
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @microsoft.com/Office on Demand;version=1 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll [2012-11-10] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Matthias Meister\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-24] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-895578266-524488165-4032655203-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll [2013-01-23] (Amazon.com, Inc.)
FF Extension: Avira Browser Safety - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\abs@avira.com [2014-08-06]
FF Extension: Reader - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{20068ab2-1901-4140-9f3c-81207d4dacc4} [2013-05-16]
FF Extension: DownloadHelper - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-10-07]
FF Extension: Ghostery - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\firefox@ghostery.com.xpi [2013-09-19]
FF Extension: Adblock Plus - C:\Users\Matthias Meister\AppData\Roaming\Mozilla\Firefox\Profiles\3uohh0jz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-11-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-04-23]
FF HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-04-23]
CHR Extension: (Writebox) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbehjmjchoiaglkeboicbgkpfafcmhij [2015-04-23]
CHR Extension: (MagicScroll Web Reader) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecldhagehndokdmaiaigoaecbmbnmfkc [2015-04-23]
CHR Extension: (BetaFish Adblocker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-04-23]
CHR Extension: (Bookmark Manager) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-23]
CHR Extension: (feedly) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2015-04-23]
CHR Extension: (Google Play Music) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2015-04-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Ghostery) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-04-23]
CHR Extension: (Google Wallet) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-23]
CHR Extension: (Citavi Picker) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-17]
CHR Extension: (AVG PrivacyFix) - C:\Users\Matthias Meister\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-04-23]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [560584 2015-01-21] (Lenovo Corporation)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2016472 2015-01-23] (Lenovo Group Limited)
S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [626120 2015-01-21] (Lenovo Corporation)
S3 LnvHotSpotSvc; C:\Program Files\Lenovo\Lenovo Mobile Hotspot\LnvHotSpotSvc.exe [474160 2014-03-05] (Lenovo)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [469720 2015-01-09] ()
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [81024 2014-08-28] (The OpenVPN Project)
R2 Sentinel RMS License Manager; C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel RMS License Manager\WinNT\lservnt.exe [884736 2010-10-20] (SafeNet, Inc.) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel(R) Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2013-11-20] (Intel® Corporation)
S2 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [35024 2014-06-17] (Paragon Software Group)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [468752 2014-06-27] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-06-17] (Paragon Software Group)
S3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [206032 2014-06-17] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-06-17] (Paragon Software Group)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [42704 2014-06-17] (Paragon Software Group)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3346912 2013-10-31] (Intel Corporation)
S3 NETwNs64; C:\Windows\system32\DRIVERS\Netwsw00.sys [11499008 2012-06-03] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44784 2013-05-29] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 Tvti2c; C:\Windows\system32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52592 2014-03-12] (Cisco Systems, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
U3 idsvc; No ImagePath
S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X]
S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-23 17:09 - 2015-04-23 17:09 - 06480808 _____ (Piriform Ltd) C:\Users\Matthias Meister\Downloads\ccsetup505.exe
2015-04-23 16:28 - 2015-04-23 16:28 - 00001016 _____ () C:\Users\Matthias Meister\Desktop\JRT.txt
2015-04-23 16:22 - 2015-04-23 16:22 - 00000207 _____ () C:\WINDOWS\tweaking.com-regbackup-MATTHIASMEISTER-Windows-8.1-Pro-(64-bit).dat
2015-04-23 16:22 - 2015-04-23 16:22 - 00000000 ____D () C:\RegBackup
2015-04-23 16:10 - 2015-04-23 16:10 - 02685470 _____ (Thisisu) C:\Users\Matthias Meister\Desktop\JRT.exe
2015-04-23 16:09 - 2015-04-23 16:09 - 02217984 _____ () C:\Users\Matthias Meister\Desktop\AdwCleaner_4.201.exe
2015-04-23 15:51 - 2015-04-23 15:53 - 00048869 _____ () C:\Users\Matthias Meister\Desktop\Addition.txt
2015-04-23 15:49 - 2015-04-24 08:39 - 00030312 _____ () C:\Users\Matthias Meister\Desktop\FRST.txt
2015-04-23 15:49 - 2015-04-24 08:39 - 00000000 ____D () C:\FRST
2015-04-23 15:47 - 2015-04-23 15:47 - 02099712 _____ (Farbar) C:\Users\Matthias Meister\Desktop\FRST64.exe
2015-04-23 14:38 - 2015-04-23 14:38 - 03252699 _____ () C:\Users\Matthias Meister\Desktop\Trojaner Board.zip
2015-04-23 14:22 - 2015-04-23 14:38 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Trojaner Board
2015-04-23 14:07 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias (1)
2015-04-23 11:59 - 2015-04-23 12:53 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Citavi 5
2015-04-23 11:58 - 2015-04-23 11:58 - 00001977 _____ () C:\Users\Public\Desktop\Citavi 5.lnk
2015-04-23 11:58 - 2015-04-23 11:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citavi 5
2015-04-23 11:57 - 2015-04-23 11:58 - 00000000 ____D () C:\Program Files (x86)\Citavi 5
2015-04-23 11:55 - 2015-04-23 11:55 - 97664248 _____ (Swiss Academic Software) C:\Users\Matthias Meister\Downloads\Citavi5Setup.exe
2015-04-23 10:57 - 2015-04-23 10:57 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022 (1).exe
2015-04-23 10:11 - 2015-04-23 10:11 - 00001917 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-04-23 10:11 - 2015-04-23 10:11 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-23 10:10 - 2015-04-23 14:32 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-23 10:10 - 2015-04-23 10:16 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 10:10 - 2015-04-23 10:10 - 11028616 _____ (SurfRight B.V.) C:\Users\Matthias Meister\Downloads\HitmanPro_x64.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Matthias Meister\Downloads\mbam-setup-2.1.6.1022.exe
2015-04-23 10:09 - 2015-04-23 10:09 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-23 10:09 - 2015-04-23 10:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-23 10:09 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-23 10:09 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-23 10:08 - 2015-04-23 16:17 - 00000000 ____D () C:\AdwCleaner
2015-04-23 09:05 - 2015-04-23 09:05 - 00002523 _____ () C:\Users\Public\Desktop\Evernote.lnk
2015-04-23 09:05 - 2015-04-23 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2015-04-22 11:26 - 2015-04-22 11:26 - 00000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-04-22 11:26 - 2015-04-22 11:26 - 00000000 __SHD () C:\Users\Matthias Meister\AppData\Local\EmieBrowserModeList
2015-04-22 11:26 - 2015-03-11 21:24 - 03313208 _____ (DVDVideoSoft Ltd. ) C:\Users\Matthias Meister\Downloads\Matthias
2015-04-17 10:45 - 2015-04-17 10:47 - 70176768 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.25.0.msi
2015-04-15 09:56 - 2015-04-15 21:23 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-15 09:56 - 2015-04-15 09:58 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00002715 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Skype
2015-04-15 09:56 - 2015-04-15 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-15 09:49 - 2014-11-17 22:17 - 00672984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe
2015-04-15 09:49 - 2014-11-17 22:17 - 00273240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2015-04-15 09:49 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsDatabase.dll
2015-04-15 09:49 - 2014-11-14 08:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2015-04-15 09:49 - 2014-11-14 08:46 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2015-04-15 09:49 - 2014-11-14 08:39 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-04-15 09:45 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2015-04-15 09:45 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-04-15 09:45 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2015-04-15 09:45 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-04-15 09:45 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-04-15 09:45 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe
2015-04-15 09:45 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-04-15 09:45 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-04-15 09:45 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-04-15 09:45 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-04-15 09:45 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll
2015-04-15 09:45 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll
2015-04-15 09:45 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2015-04-15 09:45 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll
2015-04-15 09:44 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-04-15 09:44 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-04-15 09:44 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-04-15 09:44 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-04-15 09:44 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-04-15 09:44 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll
2015-04-15 09:44 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-04-15 09:44 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-04-15 09:44 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-04-15 09:44 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-04-15 09:44 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-04-15 09:44 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-04-15 09:44 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-04-15 09:44 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-04-15 09:44 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-04-15 09:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-04-15 09:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-04-15 09:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-04-15 09:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-04-15 09:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-04-15 09:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-04-15 09:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-04-15 09:44 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-04-15 09:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-04-15 09:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-04-15 09:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-04-15 09:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-04-15 09:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-04-15 09:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-04-15 09:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-04-15 09:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-04-15 09:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-04-15 09:44 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2015-04-15 09:44 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2015-04-15 09:44 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2015-04-14 16:18 - 2015-04-14 16:19 - 69980160 _____ () C:\Users\Matthias Meister\Downloads\calibre-64bit-2.24.0.msi
2015-04-13 14:32 - 2015-04-13 14:33 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Systeminttools
2015-04-13 14:28 - 2015-04-13 14:28 - 13891254 _____ () C:\Users\Matthias Meister\Downloads\SysinternalsSuite.zip
2015-04-13 11:30 - 2015-04-13 14:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-13 11:16 - 2015-04-13 11:16 - 00000550 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ITA (liebenzell.intBereiche) (Z).lnk
2015-04-13 10:50 - 2015-04-23 16:51 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
2015-04-13 10:46 - 2015-04-24 08:38 - 00000000 ___RD () C:\Users\Matthias Meister\iCloudDrive
2015-04-13 10:46 - 2015-04-13 10:46 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Apple Inc
2015-04-13 10:39 - 2015-04-13 10:39 - 05344528 _____ (Piriform Ltd) C:\Users\Matthias Meister\Downloads\ccsetup504.exe
2015-04-13 10:36 - 2015-04-13 10:36 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-13 10:36 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-13 10:35 - 2015-04-13 10:36 - 00000000 ____D () C:\Program Files\iTunes
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files\iPod
2015-04-13 10:35 - 2015-04-13 10:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-13 10:27 - 2015-04-13 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX
2015-04-04 13:47 - 2015-04-04 13:47 - 00000000 ___SD () C:\WINDOWS\system32\GWX
2015-04-04 10:27 - 2015-04-04 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Spotify
2015-04-04 10:27 - 2015-04-04 10:27 - 00001913 _____ () C:\Users\Matthias Meister\Desktop\Spotify.lnk
2015-04-04 10:27 - 2015-04-04 10:27 - 00001899 _____ () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-04 10:26 - 2015-04-04 18:56 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Spotify
2015-04-04 10:26 - 2015-04-04 10:26 - 00138912 _____ (Spotify Ltd) C:\Users\Matthias Meister\Downloads\SpotifySetup.exe
2015-03-30 23:30 - 2015-03-30 23:30 - 00000000 ____D () C:\Program Files\IBM
2015-03-30 22:50 - 2015-03-30 23:26 - 812131760 _____ (IBM Corp) C:\Users\Matthias Meister\Downloads\SPSS_Statistics_22_win64.exe
2015-03-30 21:07 - 2015-03-30 21:07 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Unity
2015-03-30 21:03 - 2015-03-30 21:03 - 01081000 _____ (Unity Technologies ApS) C:\Users\Matthias Meister\Downloads\UnityWebPlayer.exe
2015-03-30 21:03 - 2015-03-30 21:03 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Unity
2015-03-28 20:48 - 2015-03-28 20:48 - 00159029 _____ () C:\Users\Matthias Meister\Downloads\FRITZ.Box Fon WLAN 7112 (UI) 87.04.88_01.01.00_1617.export
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-24 08:39 - 2013-05-14 15:50 - 00005208 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister
2015-04-24 08:38 - 2014-06-05 19:16 - 01638158 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-24 08:38 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-04-24 08:38 - 2013-04-02 13:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-24 08:38 - 2012-11-29 17:01 - 00000000 __RDO () C:\Users\Matthias Meister\SkyDrive
2015-04-24 08:38 - 2012-11-28 14:12 - 00000000 ___RD () C:\Users\Matthias Meister\Dropbox
2015-04-24 08:38 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Dropbox
2015-04-23 17:10 - 2013-08-22 17:31 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-23 17:10 - 2013-02-20 10:34 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-23 16:56 - 2013-09-30 06:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-23 16:56 - 2013-09-30 05:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-04-23 16:56 - 2013-09-30 05:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-04-23 16:56 - 2012-11-28 12:40 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-23 16:50 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-23 16:50 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI
2015-04-23 16:31 - 2013-04-02 13:21 - 00001150 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-23 16:27 - 2013-03-12 20:24 - 00001196 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job
2015-04-23 15:44 - 2013-10-17 16:40 - 00004002 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{79616768-A823-4D1A-A05A-496DB8C5B27C}
2015-04-23 12:43 - 2013-08-10 16:40 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Microsoft Help
2015-04-23 12:03 - 2014-02-03 15:34 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Swiss Academic Software
2015-04-23 12:02 - 2014-02-03 15:33 - 00000000 ____D () C:\Program Files (x86)\Citavi 4
2015-04-23 11:58 - 2014-02-03 15:33 - 00000000 ____D () C:\ProgramData\Swiss Academic Software
2015-04-23 11:56 - 2014-02-03 15:32 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Downloaded Installations
2015-04-23 09:27 - 2013-03-12 20:24 - 00001144 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job
2015-04-22 12:24 - 2013-02-26 18:57 - 00000678 _____ () C:\WINDOWS\BRCALIB.INI
2015-04-20 11:17 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-04-17 11:11 - 2015-01-11 12:07 - 00000942 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2015-04-17 11:11 - 2015-01-11 12:07 - 00000000 ____D () C:\Program Files\Calibre2
2015-04-17 09:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-04-16 13:23 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-04-16 11:12 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-04-16 10:30 - 2012-11-28 17:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Packages
2015-04-15 22:42 - 2012-12-05 18:07 - 00000000 ____D () C:\Users\Matthias Meister\Documents\Outlook Files
2015-04-15 11:06 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2015-04-15 10:15 - 2012-11-28 12:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 10:14 - 2014-12-12 00:14 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-04-15 10:14 - 2014-07-09 10:28 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-04-15 10:14 - 2013-07-23 12:38 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-04-15 10:03 - 2012-11-28 10:27 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-04-15 09:49 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2015-04-15 09:42 - 2014-11-14 15:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaext.dll
2015-04-15 08:02 - 2013-10-29 15:16 - 00068145 _____ () C:\Users\Public\Documents\AcSvc.dmp
2015-04-15 08:02 - 2013-10-29 15:16 - 00012288 _____ () C:\Users\Public\Documents\AccConnAdvanced.dat
2015-04-14 20:14 - 2012-11-28 12:40 - 00003796 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-04-14 18:56 - 2014-07-16 10:54 - 00000000 ____D () C:\ProgramData\AccordanceFinalClean
2015-04-14 17:33 - 2015-01-11 12:08 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\calibre-cache
2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 11:31 - 2013-10-17 22:25 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Local\Deployment
2015-04-13 11:00 - 2015-03-12 13:00 - 00002270 ____H () C:\Users\Matthias Meister\Documents\Default.rdp
2015-04-13 10:53 - 2012-11-28 14:38 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Apple Computer
2015-04-13 10:46 - 2013-10-17 16:15 - 00000000 ____D () C:\Users\Matthias Meister
2015-04-13 10:35 - 2012-11-28 14:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-13 10:18 - 2013-07-23 14:19 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-13 10:18 - 2012-12-18 13:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-13 10:18 - 2012-11-28 14:11 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-01 08:25 - 2012-12-18 13:49 - 00000000 ____D () C:\Users\Matthias Meister\AppData\Roaming\Avira
2015-04-01 08:25 - 2012-12-18 13:44 - 00000000 ____D () C:\ProgramData\Avira
2015-03-30 23:57 - 2012-11-28 11:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-30 23:57 - 2012-11-28 11:05 - 00000000 ____D () C:\Program Files\Lenovo
2015-03-30 23:45 - 2014-05-08 21:52 - 00000000 ____D () C:\Users\Matthias Meister\Desktop\Kathrin SPSS
2015-03-30 23:29 - 2014-05-06 12:09 - 00000219 _____ () C:\WINDOWS\SysWOW64\lsprst7.tgz
2015-03-30 23:29 - 2014-05-06 12:09 - 00000205 _____ () C:\WINDOWS\SysWOW64\lsprst7.dll
2015-03-30 23:29 - 2014-05-06 12:09 - 00000016 ____H () C:\WINDOWS\SysWOW64\servdat.slm
==================== Files in the root of some directories =======
2014-01-29 18:12 - 2014-02-14 21:41 - 0000168 _____ () C:\Users\Matthias Meister\AppData\Local\270384221183696e666f
2014-01-29 18:12 - 2014-02-14 21:41 - 0000215 _____ () C:\Users\Matthias Meister\AppData\Local\75736572696e666f
2015-04-22 11:26 - 2015-04-22 11:26 - 0000398 _____ () C:\Users\Matthias Meister\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-06-04 16:40 - 2014-06-04 16:40 - 0000337 _____ () C:\Users\Matthias Meister\AppData\Local\Perfmon.PerfmonCfg
2014-07-29 08:17 - 2014-07-29 08:17 - 0001490 _____ () C:\Users\Matthias Meister\AppData\Local\recently-used.xbel
2012-12-05 13:15 - 2013-07-21 22:41 - 0007594 _____ () C:\Users\Matthias Meister\AppData\Local\resmon.resmoncfg
2013-02-13 12:45 - 2013-02-13 12:45 - 0009646 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114511.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009909 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114706.txt
2013-02-13 12:47 - 2013-02-13 12:47 - 0009969 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.114726.txt
2013-02-13 13:02 - 2013-02-13 13:02 - 0010292 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120230.txt
2013-02-13 13:02 - 2013-02-13 13:03 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120247.txt
2013-02-13 13:04 - 2013-02-13 13:04 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130213.120402.txt
2013-02-20 10:46 - 2013-02-20 10:46 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094602.txt
2013-02-20 10:46 - 2013-02-20 10:47 - 0010101 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094618.txt
2013-02-20 10:47 - 2013-02-20 10:47 - 0010073 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094737.txt
2013-02-20 10:48 - 2013-02-20 10:48 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130220.094812.txt
2013-03-05 17:55 - 2013-03-05 17:55 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130305.165512.txt
2013-03-12 15:29 - 2013-03-12 15:29 - 0010216 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130312.142910.txt
2013-04-02 09:46 - 2013-04-02 09:46 - 0010097 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130402.094618.txt
2013-04-03 21:03 - 2013-04-03 21:03 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130403.210334.txt
2013-04-17 16:09 - 2013-04-17 16:09 - 0010173 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130417.160933.txt
2013-04-30 14:49 - 2013-04-30 14:49 - 0010167 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130430.144903.txt
2013-05-06 17:32 - 2013-05-06 17:32 - 0010211 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173211.txt
2013-05-06 17:32 - 2013-05-06 17:33 - 0010032 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130506.173226.txt
2013-06-03 18:31 - 2013-06-03 18:31 - 0010289 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183117.txt
2013-06-03 18:31 - 2013-06-03 18:32 - 0010107 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130603.183133.txt
2013-07-23 12:44 - 2013-07-23 12:44 - 0010291 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.124408.txt
2013-07-23 14:14 - 2013-07-23 14:15 - 0009989 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.141452.txt
2013-07-23 14:23 - 2013-07-23 14:23 - 0009915 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20130723.142335.txt
2013-10-17 14:33 - 2013-10-17 14:33 - 0014208 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20131017.143331.wdl
2014-01-11 15:24 - 2014-01-11 15:27 - 0014685 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140111.142447.wdl
2014-01-13 12:36 - 2014-01-13 12:36 - 0014684 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.113611.wdl
2014-01-13 12:46 - 2014-01-13 12:47 - 0016917 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140113.114653.txt
2014-01-14 22:06 - 2014-01-14 22:06 - 0016629 _____ () C:\Users\Matthias Meister\AppData\Local\WiDiSetupLog.20140114.210628.wdl
2012-11-29 10:08 - 2012-11-29 10:08 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2012-12-05 11:14 - 2013-04-02 09:08 - 0009513 _____ () C:\ProgramData\MH_ErrorLog.txt
2012-11-30 22:55 - 2013-03-03 20:39 - 0000333 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
Files to move or delete:
====================
C:\Users\Matthias Meister\CTX.DAT
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\avgnt.exe
C:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmti0ne.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-23 15:01
==================== End Of Log ============================
Und hier Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-04-2015 01
Ran by Matthias Meister at 2015-04-24 08:40:08
Running from C:\Users\Matthias Meister\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Accordance (HKLM-x32\...\{9B088535-6E1D-480E-A5F1-510E1DE6B572}_is1) (Version: 10.4.5 - Oaktree Software, Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 7.12.23 - )
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AutoHotkey 1.1.14.02 (HKLM\...\AutoHotkey) (Version: 1.1.14.02 - Lexikos)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.171.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bullzip PDF Printer 9.3.0.1516 (HKLM\...\Bullzip PDF Printer_is1) (Version: 9.3.0.1516 - Bullzip)
calibre 64bit (HKLM\...\{C5D7991D-5C4F-475D-BF58-89A068A2FF14}) (Version: 2.25.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05160 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05160 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.0.0.11 - Swiss Academic Software)
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.43.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.16151 - Landesfinanzdirektion Thüringen)
Evernote v. 5.8.5 (HKLM-x32\...\{5EDC25EC-D966-11E4-9E5C-00163E98E7D6}) (Version: 5.8.5.7193 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Drive (HKLM-x32\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.240 - SurfRight B.V.)
HL-4150CDN (HKLM-x32\...\{123DE6D6-9566-4777-AC81-E6D86FFA95DA}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless Software (HKLM-x32\...\{440d014b-4444-4533-b96d-2910e1ca2bcf}) (Version: 16.7.0 - Intel Corporation)
Intel® PROSet/Wireless WiMAX Software (HKLM\...\{5F588B19-C575-4750-86FD-6ED2B76E61F1}) (Version: 7.50.0000 - Intel Corporation)
Interlinear Scripture Analyzer 2 basic (HKLM\...\{C8F753CF-C578-4138-A870-33149B689FFD}) (Version: 2.1.5.0 - Scripture4all Foundation)
IRISPen 7 (HKLM-x32\...\{699F407B-A9DE-4261-8C46-2C5C42E3172D}) (Version: 1.5.2.330 - Ihr Firmenname)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Lenovo Multimedia and Communications Core Runtime (HKLM\...\{033DC0E0-DA89-4C33-B66C-89B64D312CD1}_is1) (Version: 5.0.13.94 - Lenovo Corporation)
Lenovo Patch Utility (x32 Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.3.2.6 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.3.19.209 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.4.0.5 - Lenovo Group Limited)
Lenovo Settings - Power (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 7.49.4 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.3.3.6 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 2.3.0.84 - Lenovo)
Lenovo Settings Service (HKLM\...\{8C6F1EBA-17F1-4481-B688-9777E63E985F}_is1) (Version: 2.3.3.7 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.2.0.7 - Lenovo Group Limited)
LibreOffice 4.2.7.2 (HKLM-x32\...\{A313C39F-79A7-408B-97EE-8F958407D694}) (Version: 4.2.7.2 - The Document Foundation)
LyX 2.1.0 (HKLM-x32\...\LyX210) (Version: 2.1.0 - LyX Team)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office on Demand-Browser-Add-Ons (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Microsoft Office on Demand-Browser-Add-Ons) (Version: - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.5.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
Music Manager (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\MusicManager) (Version: - Google, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Pandoc 1.12.3 (HKLM-x32\...\{5DFB319D-1BD3-49AE-991A-95ED9E8BBCE8}) (Version: 1.12.3 - John MacFarlane)
Paragon HFS+ for Windows 8 Free Edition (HKLM-x32\...\{456534C0-51E7-11DF-B336-005056C00008}) (Version: 1.00 - Paragon Software)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH_Media_Driver_v2.22.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.22.18.01 - RICOH)
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.04.00 - Samsung Electronics Co., Ltd.)
Scrivener (HKLM-x32\...\Scrivener 1710) (Version: 1710 - Literature and Latte)
Sentinel RMS License Manager 8.4.1 (HKLM-x32\...\{3213A8E3-81A3-417D-93B2-A116A60666C8}) (Version: 8.4.1 - SafeNet, Inc.)
Skitch (HKLM-x32\...\Skitch 2.3.1.163) (Version: 2.3.1.163 - Evernote Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Sophos SSL VPN Client 2.1 (HKLM-x32\...\Sophos SSL VPN Client) (Version: 2.1 - )
Spotify (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\Spotify) (Version: 0.9.16.29.g0b5fcb05 - Spotify AB)
Telegram Desktop version 0.8.4 (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.8.4 - Telegram Messenger LLP)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.9 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.97 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{68D50088-CE92-4FF0-A220-D875E2E73151}) (Version: 6.0.0.8102 - Authentec Inc.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Unity Web Player (HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\UnityWebPlayer) (Version: 4.6.4f1 - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
Windows Driver Package - Silicon Laboratories (silabenm) Ports (12/10/2012 6.6.1.0) (HKLM\...\F1D0CAF4C0DED9E19E7D560DEA76E9C03A9840DA) (Version: 12/10/2012 6.6.1.0 - Silicon Laboratories)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
XMind 2013 (v3.4.1) (HKLM-x32\...\XMind_is1) (Version: 3.4.1.201401221918 - XMind Ltd.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{225F8CFE-1B76-48E6-8E75-62CC471AFA28}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\RoamingOfficeActiveX.64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-895578266-524488165-4032655203-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
23-04-2015 09:02:53 Installed Evernote v. 5.8.5
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01297DD5-ACC9-45C6-B050-7969EA08F41E} - System32\Tasks\{53107B12-F938-4A02-9F23-8DB6A9939CB9} => pcalua.exe -a "C:\Users\Matthias Meister\Downloads\Setup.exe" -d "C:\Users\Matthias Meister\Downloads"
Task: {05CB891C-C430-44FB-A2E6-BBFD4CBB3BF1} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {05D33BDF-B8CC-45AA-92D3-D9002AD63BA8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {0CA2C72B-9776-481F-9294-2B023B5C3916} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {12E26CAC-355D-413E-8815-1F3D8E3DC4A6} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {16AC7163-24A3-4CC6-A4C5-B3DFD226F91C} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe
Task: {2057EB88-B9CB-48EB-AE5E-47B905FD54DD} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {23E3F989-8993-499C-B7E4-0CB50F135014} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-895578266-524488165-4032655203-1000
Task: {30622C2C-ABD3-42E3-869C-52CB71AAA599} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {3B54B7EB-6485-41D4-A696-A8BCBCE142D5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {454DB601-A28B-4668-81B4-097FA3E68187} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)
Task: {47318851-E293-4F05-B3A8-8A944EE0413A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-02] (Google Inc.)
Task: {5A54D371-C499-41ED-8450-82862B2778BF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {6B3C7E23-AF30-4D60-8654-0D00BF1BBC2B} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe
Task: {6D236B4F-EB9D-4105-ABC7-107FC05B5652} - System32\Tasks\{577DBEBF-24E0-4DE5-ADCA-0CA1C24DC512} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}\Setup.exe" -c -AddRemove
Task: {6DFB74AB-13CA-4EBF-A592-B6547565BB5C} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {6FB9E1DD-2FF2-4C7D-8215-5B0C3D176678} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe
Task: {6FBCF39A-3974-47BD-A7B5-98BD2088E4C6} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe
Task: {71B27283-ADF6-4D11-A1E2-1C72ADB2FCD7} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe
Task: {7C002A81-25B3-46B5-B50B-5FBF2C5115C7} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe
Task: {7EE0D6E1-D550-47F2-9967-40EB282CDB2A} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {85DAE385-6CC4-4773-8D95-E19701EE0B3E} - System32\Tasks\{65D61D50-655A-4E16-AABB-B4DCEEB47EB6} => pcalua.exe -a "C:\Users\Matthias Meister\Desktop\83ts04ww.exe" -d "C:\Users\Matthias Meister\Desktop"
Task: {894F577B-8062-4C7F-ABEE-F5C484DEAADC} - System32\Tasks\{108EF52A-3187-4CAC-9F1F-2BB07316FD66} => pcalua.exe -a D:\GloAppInstaller\GloAppInstaller.exe -d D:\GloAppInstaller
Task: {99EE5FEC-783F-4ED8-9F14-7EB56177FA8C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe
Task: {9B34940D-B95A-49D0-AE30-303BDD79C214} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe
Task: {9C8D95FA-3DDC-41AF-8610-C79E58EBD09C} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9FFC158D-DEEF-479E-8510-BE1594D8198C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe
Task: {A6BC1F86-E80D-4983-B992-0B129A7E92F8} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe
Task: {A9BA052B-F1B6-408F-B284-AD79DD856F7D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {A9E0DC59-4CF1-4003-85E9-E71028102D66} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe
Task: {AA0925B4-5482-45AE-A8C2-A56168A3B7CD} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe
Task: {AB8ECDA1-3927-46FD-965C-E1C01114EE28} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {AD897FB0-A59A-4083-9BCE-DDB66D373347} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {B02DF302-AF51-4BD8-AE04-5F7E6C7DBB64} - System32\Tasks\{50A03D00-3269-4A49-BDB1-2CFA24F87A31} => pcalua.exe -a C:\PM\Setup.exe -d C:\PM
Task: {B42F2D24-7C93-40EE-823D-75BF8C9C39CC} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe
Task: {B4825007-B2A8-4703-8CC3-9D6623DEEA09} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {B8B4304A-7B6E-4898-A75C-10A9DE78ECB0} - System32\Tasks\Microsoft Office 15 Sync Maintenance for MATTHIASMEISTER-Matthias Meister MatthiasMeister => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {CCD3EB94-2E66-48C3-8EDA-CB164AFD3173} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe
Task: {CF171EB8-9D40-4F8F-B63F-8CE4350AF4DA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe
Task: {D2185F41-0AC0-4459-8E79-E25722541479} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {D95CB13D-D946-42BC-90E6-6F6EF921B25E} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-895578266-524488165-4032655203-1000 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {DA86BA23-AC45-444F-AC03-01DBBBB729F1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: {DB1C2689-BDCA-46B6-A55A-35BFD66756BE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DFDF3405-737A-493E-AA97-6BAE78F4875F} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E475CF33-BF93-4699-8837-AB8C96D460F6} - \Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000 No Task File <==== ATTENTION
Task: {E50237D5-168F-437E-B928-FCDAA6E20D81} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {E6D695C1-371F-409F-A8EB-4FFAE6B87AD2} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe
Task: {E8F72B08-9E73-4F72-ADBA-C83EB155F071} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {EB07A24C-9C02-4FB0-9EFA-13F716A7BE8B} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {EED8DA22-AC11-47B9-B7DE-6B940B00285F} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe
Task: {EF95BCC9-40DE-4BFC-9D0B-37256C2F70E6} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {F196D4B9-21B8-496A-8E56-8EAA2A7D9C85} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {FE8BC4C2-EC58-4C1C-8FA9-FDB227D1BE65} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000Core.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-895578266-524488165-4032655203-1000UA.job => C:\Users\Matthias Meister\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) ==============
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2011-03-10 09:14 - 2012-12-19 11:58 - 00015360 _____ () C:\WINDOWS\System32\KOAZCA_L.DLL
2015-03-12 12:55 - 2011-04-11 07:26 - 00034304 _____ () C:\WINDOWS\System32\spe__l.dll
2011-06-22 11:44 - 2011-06-22 11:44 - 00034304 _____ () C:\WINDOWS\System32\sst2cl6.dll
2015-03-12 12:55 - 2013-09-13 09:29 - 01242112 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\spe__du.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-23 08:54 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-02-19 00:03 - 2015-01-09 16:40 - 00469720 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-01-11 16:36 - 2015-01-09 16:40 - 00013528 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2014-06-16 12:08 - 2015-01-16 08:49 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-11-28 11:39 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-03-12 22:53 - 2014-03-12 22:53 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2012-09-06 20:18 - 2012-09-06 20:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2013-02-26 18:56 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00799232 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\86865ced79f3180ebdfa736d895e5edb\Windows.Networking.ni.dll
2015-01-26 10:46 - 2015-01-26 10:46 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll
2015-04-22 11:37 - 2015-04-22 11:37 - 00727040 _____ () C:\Users\Matthias Meister\AppData\Local\Packages\LenovoCorporation.LenovoSettings_4642shxvsv8s2\AC\Microsoft\CLR_v4.0_32\NativeImages\Lenovo_Comp257f541a#\13d9bfb35954eeddb925306b33539353\Lenovo_Components_MetricCollection.ni.dll
2015-01-26 10:46 - 2015-01-26 10:46 - 01131008 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.App640a3541#\72dff8d45b73e9b02b3838d29765607a\Windows.ApplicationModel.ni.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00239616 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Gloaae92e31#\94af4549db265c6f339c287c8675d234\Windows.Globalization.ni.dll
2015-01-26 10:47 - 2015-01-26 10:47 - 00808448 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Storage\7abff64c7c1ea1fae5bd170c8238b73e\Windows.Storage.ni.dll
2015-02-05 23:54 - 2015-02-05 23:54 - 00873472 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Web\5a696652396e3e6bc1b2f36a25751862\Windows.Web.ni.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-04-24 08:38 - 2015-04-24 08:38 - 00043008 _____ () c:\Users\Matthias Meister\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmti0ne.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Matthias Meister\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-11-21 11:02 - 2014-11-21 11:02 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2014-11-21 10:59 - 2014-11-21 10:59 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Matthias Meister\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-895578266-524488165-4032655203-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Matthias Meister\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\2015-03-24.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "MacDrive 9 application"
HKLM\...\StartupApproved\Run: => "LnvMobHotspotClient"
HKLM\...\StartupApproved\Run: => "SmartAudio"
HKLM\...\StartupApproved\Run: => "LenovoOptMouseUpdate"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "ApnUpdater"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "SweetIM"
HKLM\...\StartupApproved\Run32: => "Sweetpacks Communicator"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "openvpn-gui"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "OneNote 2013 Screen Clipper and Launcher.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_5382C8EB82E9B70BA085EAF9BDB27BD7"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "MusicManager"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One Icon"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Ubuntu One"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Skitch"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-895578266-524488165-4032655203-1000\...\StartupApproved\Run: => "Spotify Web Helper"
==================== Accounts: =============================
Administrator (S-1-5-21-895578266-524488165-4032655203-500 - Administrator - Disabled)
Gast (S-1-5-21-895578266-524488165-4032655203-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-895578266-524488165-4032655203-1004 - Limited - Enabled)
Matthias Meister (S-1-5-21-895578266-524488165-4032655203-1000 - Administrator - Enabled) => C:\Users\Matthias Meister
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=254, Autor-ID=311, Lieferant-ID=14122, Lieferant-Typ=1
Error: (04/23/2015 04:20:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm NOTEPAD.EXE, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 195c
Startzeit: 01d07dd068e52665
Endzeit: 0
Anwendungspfad: C:\WINDOWS\system32\NOTEPAD.EXE
Berichts-ID: d0d408e1-e9c3-11e4-bf22-ec55f9f53b46
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/23/2015 03:01:04 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "(C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (04/23/2015 03:01:03 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0
System errors:
=============
Error: (04/23/2015 04:50:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2015 04:50:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.
Error: (04/23/2015 04:50:21 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat. Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".
Error: (04/23/2015 04:49:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Lenovo Doze Mode Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (04/23/2015 04:49:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Bing Desktop Update service erreicht.
Error: (04/23/2015 04:49:03 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL "ACGina". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat. Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".
Error: (04/23/2015 04:48:36 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet:
%%1062
Error: (04/23/2015 04:48:34 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (04/23/2015 04:48:34 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (04/23/2015 04:48:34 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo PM Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900
Error: (04/24/2015 08:38:14 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path254311141221
Error: (04/23/2015 04:20:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: NOTEPAD.EXE6.3.9600.17415195c01d07dd068e526650C:\WINDOWS\system32\NOTEPAD.EXEd0d408e1-e9c3-11e4-bf22-ec55f9f53b46
Error: (04/23/2015 03:01:04 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: (C:)Falscher Parameter. (0x80070057)
Error: (04/23/2015 03:01:03 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900
Error: (04/23/2015 00:42:24 PM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900
CodeIntegrity Errors:
===================================
Date: 2015-04-15 11:06:07.958
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.833
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.739
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.551
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.442
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:07.348
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:06.458
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:06:06.114
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:02:08.759
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll that did not meet the Microsoft signing level requirements.
Date: 2015-04-15 11:02:08.556
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 46%
Total physical RAM: 3979.21 MB
Available physical RAM: 2126.65 MB
Total Pagefile: 8075.21 MB
Available Pagefile: 6003.48 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:119.14 GB) (Free:28.93 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 0001EDA7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
24.04.2015, 11:04
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Task: {E475CF33-BF93-4699-8837-AB8C96D460F6} - \Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000 No Task File <==== ATTENTION
C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
C:\ProgramData\DP45977C.lfl
C:\WINDOWS\SysWOW64\lsprst7.tgz
C:\WINDOWS\SysWOW64\lsprst7.dll
C:\WINDOWS\SysWOW64\servdat.slm
C:\Users\Matthias Meister\AppData\Local\270384221183696e666f
C:\Users\Matthias Meister\AppData\Local\75736572696e666f
C:\ProgramData\MH_ErrorLog.txt
C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
C:\Users\Matthias Meister\CTX.DAT
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.04.2015, 11:22
| #13 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Alles so ausgeführt, wie von dir beschrieben. Hier der Inhalt von fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-04-2015 01
Ran by Matthias Meister at 2015-04-24 12:16:54 Run:1
Running from C:\Users\Matthias Meister\Desktop
Loaded Profiles: Matthias Meister (Available profiles: Matthias Meister & Gast)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Task: {E475CF33-BF93-4699-8837-AB8C96D460F6} - \Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000 No Task File <==== ATTENTION
C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod
C:\ProgramData\DP45977C.lfl
C:\WINDOWS\SysWOW64\lsprst7.tgz
C:\WINDOWS\SysWOW64\lsprst7.dll
C:\WINDOWS\SysWOW64\servdat.slm
C:\Users\Matthias Meister\AppData\Local\270384221183696e666f
C:\Users\Matthias Meister\AppData\Local\75736572696e666f
C:\ProgramData\MH_ErrorLog.txt
C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
C:\Users\Matthias Meister\CTX.DAT
EmptyTemp:
*****************
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E475CF33-BF93-4699-8837-AB8C96D460F6} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-895578266-524488165-4032655203-1000" => Key deleted successfully.
C:\Users\Matthias Meister\AppData\Local\1A8F483F-CFB2-4BEC-BFAE-55393764F250.aplzod => Moved successfully.
C:\ProgramData\DP45977C.lfl => Moved successfully.
C:\WINDOWS\SysWOW64\lsprst7.tgz => Moved successfully.
C:\WINDOWS\SysWOW64\lsprst7.dll => Moved successfully.
C:\WINDOWS\SysWOW64\servdat.slm => Moved successfully.
C:\Users\Matthias Meister\AppData\Local\270384221183696e666f => Moved successfully.
C:\Users\Matthias Meister\AppData\Local\75736572696e666f => Moved successfully.
C:\ProgramData\MH_ErrorLog.txt => Moved successfully.
C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc => Moved successfully.
C:\Users\Matthias Meister\CTX.DAT => Moved successfully.
EmptyTemp: => Removed 350.3 MB temporary data.
The system needed a reboot.
==== End of Fixlog 12:17:07 ====
|
|
24.04.2015, 11:34
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.04.2015, 14:37
| #15 |
| | Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.04.2015 Suchlauf-Zeit: 14:05:10 Logdatei: Logdatei Malware.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.04.24.02 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Matthias Meister Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 433236 Verstrichene Zeit: 21 Min, 38 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 PUP.Optional.OpenCandy, C:\Users\Matthias Meister\Downloads\FreeFileSync_6.15_Windows_Setup.exe, In Quarantäne, [77eb1957f19958de6114be6f15f135cb], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6b1bf2a8d1a0a84ab9f1f82f86e7c364
# engine=23543
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-24 01:32:59
# local_time=2015-04-24 03:32:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 3775853 36450059 0 0
# scanned=319321
# found=13
# cleaned=13
# scan_time=3467
sh=106F591B2BD500597B72796DE6CF1882C4F19F0A ft=1 fh=4ffdf32f906db695 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\ClearHist.exe.vir"
sh=A50D4E8729EC3B275F6AFD9EE573E2A28546F01D ft=1 fh=b0987145db4c1583 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgcommon.dll.vir"
sh=851CA33721CF5E710133B4D36EAF921ACEB4CD50 ft=1 fh=15365fabb2edd5be vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgconfig.dll.vir"
sh=8B5C441500E865FC80A55583FC68036FAF7DAD06 ft=1 fh=c81a85374d8cfdb7 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelper.dll.vir"
sh=95581618E0DAA5F92543B429C7EB383C6D63B3AE ft=1 fh=0132ebbe85145cfb vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe.vir"
sh=41C2EC5BB47E9A40E309ABAA048BA1F742E43574 ft=1 fh=f7ee8c0d578659e0 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mghooking.dll.vir"
sh=E32CD33BD92D0676F8F81103174AF5E4E9E3F38E ft=1 fh=0e4e3ab2b3f109e4 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mglogger.dll.vir"
sh=F5348CC7962B088ACCCD2F67138D43FB88DF67F2 ft=1 fh=5a321158315b5fe9 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll.vir"
sh=26B6B3788EF0A2A83A43DFE5E13F51B3E491A6F4 ft=1 fh=073310618d11024b vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll.vir"
sh=10B68A9C897C5854EA80624B01EE8BECF7017F01 ft=1 fh=6858221c6d206eb6 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll.vir"
sh=B0C53EBE6A8C5B9B987F00F739D032767B291118 ft=1 fh=a07a814e5747bf62 vn="Variante von Win32/SweetIM.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll.vir"
sh=A9939D8847E1A9F17CC24F4261D08CE88414BB77 ft=1 fh=cd8964d1234e55c9 vn="Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopad.exe"
sh=CF1641B245F4C51F865778E62B608339489A905E ft=1 fh=a5f5c56dd5b11816 vn="Variante von Win32/Toolbar.Conduit.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Matthias Meister\Downloads\VideoPad\VideoPad\videopadsetup_v3.04.exe"
|
|
| Themen zu Win 8.1: Nach löschen von Virus mit Avira erscheint jedes Mal nach dem starten ein Fenster mit Auswahl, wie Datei geöffnet werden soll. |
| avira, computer, datei, explorer, gen, internet, internet explorer, logdatei, logdateien, löschen, malwarebytes, neustart, ordner, problem, programm, programme, prüfen, scan, scannen, speicher, speichern, starten, virus, win, öffnen |
Linear-Darstellung
