| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit AviraWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.04.2015, 08:04
| #1 |
| |  Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira Da ich leider so gar keine Ahnung von Viren, Trojanern und co habe, würde ich mich freuen wenn mir da jemand helfen könnte. Der Pc gehört meinem Freund und war jetzt seit nem 3/4 Jahr ca. nicht angeschlossen und ich dachte mir bevor er den doch noch ausm Fenster wirft  - weil der doch sehr langsam ist und nur Probleme macht - versuch ich mal die Fehler zu bereinigen.  Ich hab absolut keine Ahnung wie man ein Logfile erstellt bzw. wo und mit welchem Programm man das macht also wenn ihr mir da einen Tipp gebt hole ich das auf der Stelle nach  Schonmal vielen Dank im Vorraus! Edit: Was ich jetzt schonmal gemacht habe ist den AdwCleaner zu installieren und schonmal durchlaufen zu lassen mit folgendem Ergebnis. Code:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 24/04/2015 um 09:29:14
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-23.2 [Server]
# Betriebssystem : Windows (TM) Vista Ultimate Service Pack 2 (x64)
# Benutzername : Chrisz - CHRISZ-PC
# Gestarted von : C:\Users\Chrisz\Downloads\adwcleaner_4.201.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : Gambali
[#] Dienst Gelöscht : SCBackService
[#] Dienst Gelöscht : 5d9df4c6
***** [ Dateien / Ordner ] *****
[!] Ordner Gelöscht : C:\ProgramData\Babylon
[!] Ordner Gelöscht : C:\ProgramData\SecurityUtility
[!] Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WaNetEnhance
[!] Ordner Gelöscht : C:\Program Files (x86)\Wajam
[!] Ordner Gelöscht : C:\Program Files (x86)\ProductUI
[!] Ordner Gelöscht : C:\Program Files (x86)\WaNetEnhance
[!] Ordner Gelöscht : C:\Users\Chrisz\AppData\Local\Conduit
[!] Ordner Gelöscht : C:\Users\Chrisz\AppData\Roaming\Babylon
[!] Ordner Gelöscht : C:\Users\Chrisz\AppData\Roaming\dvdvideosoftiehelpers
[!] Ordner Gelöscht : C:\Users\Chrisz\AppData\Roaming\OpenCandy
Datei Gelöscht : C:\Windows\SysWOW64\conduitEngine.tmp
Datei Gelöscht : C:\Windows\SysWOW64\Gambali.dll
Datei Gelöscht : C:\Windows\SysWOW64\GambaliOff.ini
Datei Gelöscht : C:\Windows\System32\Gambali64.dll
Datei Gelöscht : C:\Windows\System32\GambaliOff.ini
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\invalidprefs.js
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\BrowserProtect.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\Mysearchdial.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\user.js
***** [ Geplante Tasks ] *****
Task Gelöscht : Optimizer Pro Schedule
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.FBServiceAPPEventsSink.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.OptionMenu
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.OptionMenu.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.Protocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.Protocol.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.VisualBookmark
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.VisualBookmark.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.WebObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STC.WebObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.BHOHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.FBServiceAPP.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.Protocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\STCHelper.Protocol.1
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKCU\Software\52ed7d0bc34ec41
Schlüssel Gelöscht : HKLM\SOFTWARE\d6f5cae3-9568-9c52-e9db-482998865245
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2645238
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{82A5CE4D-AF0C-45B6-8AF8-75625BE6A08D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B2B7E0CD-E169-43B3-A233-E129610EE314}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0DEC13F0-5C8C-4147-8329-6CDFAD9755B7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0F3DC9E0-C459-4A40-BCF8-747BD9322E10}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E97F0FA-3B44-4634-A87E-8B0D5CFD6365}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{951F5841-FD1E-4F1D-8607-67B174DBD753}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D1CCB0CC-DA45-4797-93D3-DEE7A13F8177}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DCE24E28-D8EF-49BE-BC01-A1DD3B58FCE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E4F7F1A5-490E-4884-A9E3-CBD6A25749E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E8E0178-00EF-413D-9324-E7B3E31572E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A1A533A8-E106-422B-AE29-D0025269AF83}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B1759D04-0EF9-472A-B5C3-C774997B5321}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0F3DC9E0-C459-4A40-BCF8-747BD9322E10}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E5680D1-BF44-4929-94AF-FD30D784AD1D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80ED3EBC-CC05-4336-ABCC-295798855718}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\BABSOLUTION
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\WajIEnhance
Schlüssel Gelöscht : HKCU\Software\Local AppWizard-Generated Applications
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ZoneAlarm Toolbar
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v9.0.8112.16636
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v37.0.2 (x86 de)
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2645238&SearchSource=13");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("CommunityToolbar.ConduitSearchList", "ZoneAlarm Security Customized Web Search");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwToBS8xCZWiH2UETgTV39veyxqpFvniuyqPBo1y7XNyfaMtGXpAISLmlcq_ud13MQPBbc-XzXbBJwJ9C7E_Wigv5JZeiAdAcx81b7h23W9[...]
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaultthis.engineName", "ZoneAlarm Security Customized Web Search");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2645238&SearchSource=3&q={searchTerms}");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.hiddenOneOffs", "Google,Yahoo,Amazon.de,Bing,Delta Search,DuckDuckGo,eBay,LEO Eng-Deu,Mysearchdial,Web Search,Wikipedia (de),ZoneAlarm Security Customized Web Search");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.admin", false);
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.aflt", "babsst");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.autoRvrt", "false");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.dfltLng", "en");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.excTlbr", false);
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.id", "9899880000000000000050e5495941ab");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.instlDay", "15821");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.instlRef", "sst");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.newTab", false);
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.prdct", "delta");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.prtnrId", "delta");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.rvrt", "false");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.smplGrp", "none");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.tlbrId", "base");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.vrsn", "1.8.16.16");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.16.161:11:13");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.delta.vrsni", "1.8.16.16");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.irmysearch.aflt", "dvd_14_18_ff");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzuyDtD0EyDyEzyyDzyyEtC0A0BzzzztDtDtN0D0Tzu0SzzyDtAtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyBzytAyDtB0D0CtAtG0ByBzz0Dt[...]
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.irmysearch.cr", "606694285");
[241m5cxe.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.irmysearch.instlRef", "140305_a");
-\\ Chromium v
*************************
AdwCleaner[R0].txt - [14918 Bytes] - [24/04/2015 09:25:54]
AdwCleaner[S0].txt - [12647 Bytes] - [24/04/2015 09:29:14]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12707 Bytes] ##########
Geändert von Oxytocin (24.04.2015 um 08:41 Uhr) |
|
24.04.2015, 10:43
| #2 |
| /// the machine /// TB-Ausbilder    | Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
24.04.2015, 11:18
| #3 |
| | Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira FRST.txt:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-04-2015 02
Ran by Chrisz (administrator) on CHRISZ-PC on 24-04-2015 12:11:14
Running from C:\Users\Chrisz\Downloads
Loaded Profiles: Chrisz (Available profiles: Chrisz)
Platform: Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Windows\System32\wpcumi.exe
(Steganos Software GmbH) C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe
() C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor.exe
() C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor_run.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
(Steganos Software GmbH) C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files (x86)\Tor\tor.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6600\Bin\HPNetworkCommunicatorCom.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11780712 2011-02-24] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [WPCUMI] => C:\Windows\system32\WpcUmi.exe [182784 2006-11-02] (Microsoft Corporation)
HKLM\...\Run: [smrt] => C:\Program Files (x86)\ProductUI\Startup.exe
HKLM-x32\...\Run: [P17RunE] => RunDll32 P17RunE.dll,RunDLLEntry
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-12-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Run: [HP Officejet 6600 (NET)] => C:\Program Files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Run: [OKAYFREEDOM_Agent] => C:\Program Files (x86)\OkayFreedom\OkayFreedomClient.exe [6553000 2015-02-18] (Steganos Software GmbH)
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\MountPoints2: I - I:\Run.exe
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\MountPoints2: {32e34adc-fdac-11e0-930d-806e6f6e6963} - E:\Autorun.exe
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\MountPoints2: {6fe010d2-7819-11e1-9f86-50e5495941ab} - J:\Startme.exe
AppInit_DLLs: C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\yggqqgwb.dll => C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\yggqqgwb.dll [254560 2015-04-24] (TODO: <Company name>)
AppInit_DLLs-x32: C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\bknwccx.dll => C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\bknwccx.dll [127280 2015-04-24] (TODO: <Company name>)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG111v3 Setup-Assistent.lnk [2015-04-10]
ShortcutTarget: NETGEAR WG111v3 Setup-Assistent.lnk -> C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe ()
Startup: C:\Users\Chrisz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk [2014-05-02]
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q={searchTerms}
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9gDzKu1CDExyiuzRdPug00ANy_bDqxoFixjWtuRhYGI0bvWcqU_j7FrAC3oia3CgGP6GPu4gNsRxg,,
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> {5040195B-84F3-4153-B140-B9DF5D963130} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
SearchScopes: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> {F59BDDDB-C346-4067-8877-85A44CA81408} URL = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A7941509802&ie=UTF-8&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A7941509802&q={searchTerms}
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-22] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-22] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
Toolbar: HKU\S-1-5-21-2073220060-3931782743-526888967-1000 -> No Name - {91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default
FF NewTab: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr97z9BG7Ts5du8z7r4VzVrW1S3y1TWN-J3fpp6gkFUZdiSJtODr5nHPgrZmNDb6ksNTqTK_tJOgeEg,,
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9gDzKu1CDExyiuzRdPug00ANy_bDqxoFixjWtuRhYGI0bvWcqU_j7FrAC3oia3CgGP6GPu4gNsRxg,,
FF Keyword.URL: hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-22] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-22] ()
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.116.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-22] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\searchplugins\Web Search.xml [2015-04-24]
FF Extension: Avira Browser Safety - C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\Extensions\abs@avira.com [2015-04-10]
FF Extension: ProxTube - Unblock YouTube - C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\Extensions\ich@maltegoetz.de [2014-05-02]
FF Extension: OkayFreedom - C:\Users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\Extensions\{DB981CCA-088E-4731-A4A2-2FE218703C0E}.xpi [2015-04-10]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-24]
FF HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\Chrisz\AppData\Roaming\08019
FF Extension: Java String Helper - C:\Users\Chrisz\AppData\Roaming\08019 [2012-03-25]
FF HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-02]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-12-05] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-10] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 CopyEditor; C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor.exe [85504 2015-03-26] () [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-10-23] (Creative Labs) [File not signed]
R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 OkayFreedom VPN Starter Service; C:\Program Files (x86)\OkayFreedom\OkayFreedomService.exe [326072 2015-02-18] (Steganos Software GmbH)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-09-22] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-08-26] () [File not signed] <==== ATTENTION
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-19] (Microsoft Corporation)
S2 SecurityUtility Service; C:\ProgramData\SecurityUtility\SecurityUtilitySrv.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
S3 hitmanpro36; C:\Windows\system32\drivers\hitmanpro36.sys [30496 2012-09-01] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 kbziyehc; \??\C:\Windows\system32\drivers\kbziyehc.sys [X]
S3 netr28ux; system32\DRIVERS\netr28ux.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-24 12:11 - 2015-04-24 12:11 - 00019870 _____ () C:\Users\Chrisz\Downloads\FRST.txt
2015-04-24 12:10 - 2015-04-24 12:11 - 00000000 ____D () C:\FRST
2015-04-24 12:10 - 2015-04-24 12:10 - 02099712 _____ (Farbar) C:\Users\Chrisz\Downloads\FRST64.exe
2015-04-24 11:14 - 2015-04-24 11:17 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-04-24 11:14 - 2015-04-24 11:14 - 00001230 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-04-24 11:14 - 2015-04-24 11:14 - 00001218 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-04-24 11:14 - 2015-04-24 11:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-04-24 11:14 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-04-24 11:06 - 2015-04-24 11:06 - 01203488 _____ () C:\Users\Chrisz\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-04-24 09:57 - 2015-04-24 09:57 - 02224640 _____ () C:\Users\Chrisz\Downloads\adwcleaner_4.202.exe
2015-04-24 09:25 - 2015-04-24 10:01 - 00000000 ____D () C:\AdwCleaner
2015-04-22 21:36 - 2015-04-22 21:36 - 00000888 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-22 19:52 - 2015-04-22 19:55 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\.minecraft
2015-04-22 19:52 - 2015-04-22 19:52 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\java
2015-04-22 15:22 - 2015-04-22 15:23 - 00000000 ____D () C:\Users\Chrisz\Desktop\ALG 1 - Widerspruch
2015-04-22 10:49 - 2015-04-22 10:48 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-22 10:48 - 2015-04-22 10:49 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-22 10:48 - 2015-04-22 10:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-22 10:48 - 2015-04-22 10:48 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-22 10:45 - 2015-04-22 10:45 - 00561576 _____ (Oracle Corporation) C:\Users\Chrisz\Downloads\jxpiinstall.exe
2015-04-22 10:32 - 2015-04-22 10:32 - 01124544 _____ (Adobe Systems Incorporated) C:\Users\Chrisz\Downloads\flashplayer17_ha_install.exe
2015-04-22 10:30 - 2015-04-22 21:36 - 00000900 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-22 10:29 - 2015-04-23 16:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-22 10:29 - 2015-04-22 21:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-22 10:28 - 2015-04-22 10:28 - 00001922 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2015-04-22 10:28 - 2015-04-22 10:28 - 00001804 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-04-22 10:28 - 2015-04-22 10:28 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-04-22 10:05 - 2015-04-22 10:08 - 00000000 ____D () C:\Users\Chrisz\Desktop\Bewerbungen 2015 - Fahrzeuglackierer
2015-04-22 09:59 - 2015-04-22 10:00 - 00000000 ____D () C:\Users\Chrisz\Desktop\Mutterschaftsdokumente
2015-04-22 09:31 - 2015-04-22 09:31 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Steganos Updates
2015-04-20 12:08 - 2015-04-24 07:44 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Spotify
2015-04-20 12:08 - 2015-04-20 12:08 - 00001755 _____ () C:\Users\Chrisz\Desktop\Spotify.lnk
2015-04-20 12:08 - 2015-04-20 12:08 - 00001741 _____ () C:\Users\Chrisz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-04-20 12:07 - 2015-04-24 07:44 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Spotify
2015-04-20 12:06 - 2015-04-20 12:06 - 00138912 _____ (Spotify Ltd) C:\Users\Chrisz\Downloads\SpotifySetup.exe
2015-04-15 12:46 - 2015-03-05 04:25 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 12:46 - 2015-03-05 03:58 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 12:45 - 2015-03-14 04:22 - 01585248 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 12:45 - 2015-03-14 04:22 - 01168080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 12:45 - 2015-03-13 03:44 - 04691384 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 12:45 - 2015-03-13 03:44 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 12:45 - 2015-03-13 03:44 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 12:45 - 2015-03-13 03:30 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 12:45 - 2015-03-13 03:30 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 12:45 - 2015-03-13 03:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 12:45 - 2015-03-13 03:30 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 12:45 - 2015-03-13 02:08 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 12:45 - 2015-03-13 02:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 12:45 - 2015-03-13 02:08 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 12:34 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-15 12:34 - 2015-03-05 04:14 - 00360384 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 12:34 - 2015-03-05 03:58 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 12:33 - 2015-03-09 03:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 12:33 - 2015-03-09 02:40 - 01869824 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 10:44 - 2015-03-10 02:31 - 17882112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 10:44 - 2015-03-10 02:19 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 10:44 - 2015-03-10 02:19 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 10:44 - 2015-03-10 02:18 - 10931200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 10:44 - 2015-03-10 02:14 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 10:44 - 2015-03-10 02:14 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 02157568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 10:44 - 2015-03-10 02:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 00598528 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-04-15 10:44 - 2015-03-10 02:13 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 10:44 - 2015-03-10 02:13 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 10:44 - 2015-03-10 02:12 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-04-15 10:44 - 2015-03-10 02:12 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-04-15 10:44 - 2015-03-10 02:12 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-04-15 10:44 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-15 10:44 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-15 10:44 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-15 10:44 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-15 10:44 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-15 10:44 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-15 10:44 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-15 10:44 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-15 10:44 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-04-15 10:44 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-15 10:44 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-04-15 10:44 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-15 10:44 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-15 10:44 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-04-15 10:44 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-04-15 10:44 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-04-13 00:33 - 2015-02-20 04:03 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-04-13 00:33 - 2015-02-20 03:44 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-04-13 00:33 - 2015-02-20 02:39 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-04-13 00:33 - 2015-02-20 02:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-04-13 00:32 - 2014-12-08 03:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-04-13 00:32 - 2014-12-08 03:37 - 00399360 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-04-13 00:27 - 2015-01-29 03:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-04-13 00:27 - 2015-01-29 03:33 - 01209856 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-04-13 00:26 - 2015-01-21 04:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-04-13 00:26 - 2015-01-21 03:42 - 01040896 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-13 00:26 - 2014-12-19 02:26 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-04-13 00:21 - 2015-02-26 02:31 - 02792960 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-04-13 00:21 - 2014-08-12 04:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2015-04-13 00:21 - 2014-08-12 04:11 - 00923136 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2015-04-13 00:15 - 2014-06-16 00:18 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2015-04-13 00:15 - 2014-06-16 00:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2015-04-13 00:15 - 2014-06-13 20:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2015-04-13 00:15 - 2014-06-13 20:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2015-04-13 00:15 - 2014-06-13 19:36 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2015-04-13 00:15 - 2014-06-13 19:36 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2015-04-13 00:14 - 2014-10-24 03:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-13 00:14 - 2014-10-24 02:39 - 00656384 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-13 00:13 - 2015-02-18 04:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-04-13 00:13 - 2015-02-18 03:42 - 12899840 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-04-13 00:02 - 2014-10-10 03:10 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2015-04-13 00:02 - 2014-10-10 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-13 00:02 - 2014-10-10 03:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-13 00:02 - 2014-10-10 01:53 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-13 00:02 - 2014-10-10 01:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-13 00:01 - 2014-10-18 03:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-04-13 00:01 - 2014-10-18 02:46 - 00847360 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-04-13 00:00 - 2014-10-03 03:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-04-13 00:00 - 2014-10-03 03:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-04-13 00:00 - 2014-10-03 03:17 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-04-13 00:00 - 2014-10-03 03:03 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-04-13 00:00 - 2014-10-03 03:02 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-04-13 00:00 - 2014-10-03 03:01 - 00474624 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-04-13 00:00 - 2014-10-03 03:01 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-04-13 00:00 - 2014-10-03 01:49 - 00088576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\audiodg.exe
2015-04-12 23:53 - 2015-04-16 19:48 - 00000715 _____ () C:\Windows\setupact.log
2015-04-12 23:53 - 2015-04-12 23:53 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-12 23:52 - 2015-01-29 03:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-04-12 23:52 - 2015-01-29 03:33 - 00449024 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-04-12 23:51 - 2014-12-06 05:14 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-04-12 23:51 - 2014-12-06 05:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-04-12 23:51 - 2014-12-06 04:54 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-04-12 23:51 - 2014-12-06 04:54 - 00178688 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-04-12 23:51 - 2014-12-06 04:54 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-04-12 23:51 - 2014-10-24 03:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2015-04-12 23:51 - 2014-10-24 02:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2015-04-12 23:51 - 2014-09-05 01:38 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2015-04-12 23:51 - 2014-08-27 02:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-12 23:51 - 2014-08-27 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-12 23:50 - 2015-01-09 03:41 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-12 23:50 - 2015-01-09 02:29 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-12 23:48 - 2015-01-15 08:53 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-12 23:47 - 2015-03-06 06:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-12 23:47 - 2015-03-06 05:35 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-12 23:47 - 2015-01-15 06:08 - 00516536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-12 23:47 - 2014-10-10 03:09 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-10 18:24 - 2015-04-10 18:24 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Apple Computer
2015-04-10 18:23 - 2015-04-12 23:32 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Apple Computer
2015-04-10 18:22 - 2015-04-10 18:22 - 00001756 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2015-04-10 18:22 - 2015-04-10 18:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-04-10 18:22 - 2015-04-10 18:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2015-04-10 18:22 - 2015-04-10 18:22 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2015-04-10 18:20 - 2015-04-10 18:20 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Apple
2015-04-10 18:19 - 2015-04-10 18:19 - 42096984 _____ (Apple Inc.) C:\Users\Chrisz\Downloads\QuickTimeInstaller.exe
2015-04-10 18:17 - 2015-04-10 18:32 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\InfraRecorder
2015-04-10 18:15 - 2015-04-10 18:15 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InfraRecorder
2015-04-10 18:15 - 2015-04-10 18:15 - 00000000 ____D () C:\Program Files\InfraRecorder
2015-04-10 18:14 - 2015-04-10 18:14 - 04153344 _____ () C:\Users\Chrisz\Downloads\ir053_x64(1).msi
2015-04-10 18:13 - 2015-04-10 18:13 - 04153344 _____ () C:\Users\Chrisz\Downloads\ir053_x64.msi
2015-04-10 15:37 - 2015-04-10 15:37 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack
2015-04-10 15:36 - 2015-04-24 10:04 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Steganos VPN
2015-04-10 15:36 - 2015-04-14 12:10 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Steganos
2015-04-10 15:36 - 2015-04-10 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OkayFreedom
2015-04-10 15:36 - 2015-04-10 15:36 - 00000000 ____D () C:\Program Files (x86)\OkayFreedom
2015-04-10 15:35 - 2015-04-10 15:36 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\5D515C96_stp
2015-04-10 15:35 - 2015-04-10 15:35 - 16561619 _____ () C:\Users\Chrisz\AppData\Local\784ED66F_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 00385602 _____ () C:\Users\Chrisz\AppData\Local\5D515C96_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 00192204 _____ () C:\Users\Chrisz\AppData\Local\38C2540F_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 00000442 _____ () C:\Users\Chrisz\AppData\Local\784ED66F_stp.CIS.part
2015-04-10 15:35 - 2015-04-10 15:35 - 00000290 _____ () C:\Users\Chrisz\AppData\Local\38C2540F_stp.CIS.part
2015-04-10 15:35 - 2015-04-10 15:35 - 00000220 _____ () C:\Users\Chrisz\AppData\Local\5D515C96_stp.CIS.part
2015-04-10 15:35 - 2015-04-10 15:35 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\784ED66F_stp
2015-04-10 15:34 - 2015-04-10 15:34 - 03309800 _____ (DVDVideoSoft Ltd. ) C:\Users\Chrisz\Downloads\FreeYouTubeToMP3Converter.exe
2015-04-10 14:26 - 2015-04-22 21:20 - 00140514 _____ () C:\Windows\PFRO.log
2015-04-10 14:26 - 2015-04-22 09:57 - 00256944 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-10 14:19 - 2015-04-10 14:19 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Avira
2015-04-10 14:13 - 2015-03-17 13:01 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-10 14:13 - 2015-03-17 13:01 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-10 14:13 - 2015-03-17 13:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-10 14:10 - 2015-04-10 14:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-10 14:10 - 2015-04-10 14:13 - 00000000 ____D () C:\ProgramData\Avira
2015-04-10 14:10 - 2015-04-10 14:13 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-10 14:10 - 2015-04-10 14:10 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-10 14:08 - 2015-04-10 14:08 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\dlg
2015-04-10 14:06 - 2015-04-10 14:06 - 00000000 ____D () C:\ProgramData\62d94c5d8454453aa99260d2139bc31b
2015-04-10 14:05 - 2015-04-24 12:03 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\CopyEditor
2015-04-10 14:05 - 2015-04-10 14:05 - 00000000 ____D () C:\ProgramData\Packer9dc087ae-908f-4f18-9cdf-58cd3413437f
2015-04-10 13:58 - 2015-04-10 13:58 - 00056088 _____ () C:\Users\Chrisz\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-10 12:55 - 2015-04-10 12:55 - 00000000 ____D () C:\OEMSettings
2015-04-10 12:54 - 2015-04-10 12:54 - 00001958 _____ () C:\Users\Public\Desktop\NETGEAR WG111v3 Setup-Assistent.lnk
2015-04-10 12:54 - 2015-04-10 12:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2015-04-10 12:54 - 2009-10-14 15:08 - 00418816 _____ (NETGEAR Inc. ) C:\Windows\system32\Drivers\wg111v3.sys
2015-04-10 12:53 - 2015-04-10 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WG111v3 Setup-Assistent
2015-04-10 12:51 - 2015-04-10 12:51 - 00000000 ____D () C:\Windows\Downloaded Installations
2015-04-08 19:01 - 2015-04-12 23:53 - 00001908 _____ () C:\Windows\diagwrn.xml
2015-04-08 19:01 - 2015-04-12 23:53 - 00001908 _____ () C:\Windows\diagerr.xml
2015-04-08 18:56 - 2015-04-08 18:56 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Skyrim
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-24 12:08 - 2006-11-02 17:21 - 00003952 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-24 12:08 - 2006-11-02 17:21 - 00003952 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-24 11:23 - 2011-10-27 19:08 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-04-24 11:07 - 2011-10-27 19:08 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2015-04-24 11:02 - 2006-11-02 17:26 - 01851718 _____ () C:\Windows\WindowsUpdate.log
2015-04-24 10:57 - 2011-11-05 06:02 - 00000000 ____D () C:\ProgramData\Splashtop
2015-04-24 10:57 - 2011-11-05 05:58 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Splashtop
2015-04-24 10:45 - 2011-10-25 16:36 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-04-24 10:02 - 2006-11-02 17:40 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-24 10:01 - 2006-11-02 17:40 - 00032560 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-24 09:48 - 2011-11-13 19:14 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-04-23 17:06 - 2011-11-09 21:05 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Microsoft Games
2015-04-22 10:35 - 2011-11-07 22:44 - 00000000 ____D () C:\Users\Chrisz\AppData\Local\Adobe
2015-04-22 10:34 - 2012-08-23 13:43 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-22 10:34 - 2011-10-24 09:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-22 10:28 - 2011-11-07 22:42 - 00000000 ____D () C:\ProgramData\Adobe
2015-04-22 10:20 - 2011-12-04 22:46 - 00000000 ____D () C:\ProgramData\Skype
2015-04-20 10:15 - 2011-12-04 22:47 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\Skype
2015-04-16 19:51 - 2006-11-02 21:15 - 00671212 _____ () C:\Windows\system32\perfh007.dat
2015-04-16 19:51 - 2006-11-02 21:15 - 00144186 _____ () C:\Windows\system32\perfc007.dat
2015-04-16 19:51 - 2006-11-02 14:46 - 01559094 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-15 12:44 - 2012-04-27 23:06 - 01538164 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 12:37 - 2013-08-16 13:21 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 12:34 - 2006-11-02 14:35 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-04-14 12:26 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\rescache
2015-04-12 23:54 - 2011-10-27 19:02 - 00002155 _____ () C:\Windows\epplauncher.mif
2015-04-12 23:54 - 2011-10-27 19:01 - 00001826 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-04-12 23:53 - 2011-10-27 19:01 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-04-12 23:53 - 2011-10-27 19:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-04-10 18:18 - 2011-12-11 20:32 - 00005120 _____ () C:\Users\Chrisz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-10 15:38 - 2013-04-27 01:10 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2015-04-10 15:38 - 2012-01-21 18:20 - 00000000 ____D () C:\Users\Chrisz\AppData\Roaming\DVDVideoSoft
2015-04-10 15:37 - 2013-04-27 01:10 - 00001367 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2015-04-10 15:37 - 2012-01-21 18:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-04-10 13:39 - 2011-12-01 22:07 - 00000000 ____D () C:\ProgramData\Origin
2015-04-10 13:31 - 2011-10-23 21:40 - 00000000 ____D () C:\Users\Chrisz
2015-04-10 13:26 - 2012-06-13 16:19 - 00000000 ____D () C:\Users\Chrisz\Documents\My Games
2015-04-10 13:15 - 2014-05-02 20:08 - 00000000 ____D () C:\ProgramData\Ralink Driver
2015-04-10 13:15 - 2011-10-23 22:55 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-10 13:11 - 2011-10-24 10:48 - 00000000 ____D () C:\Program Files (x86)\Realtek
==================== Files in the root of some directories =======
2012-03-25 23:41 - 2012-03-28 11:30 - 0000065 _____ () C:\Users\Chrisz\AppData\Roaming\AcroIEHelpe.txt
2012-03-25 23:41 - 2012-03-25 23:41 - 0000136 _____ () C:\Users\Chrisz\AppData\Roaming\srvblck2.tmp
2014-06-30 22:56 - 2014-06-30 22:56 - 0000045 _____ () C:\Users\Chrisz\AppData\Roaming\WB.CFG
2015-04-10 15:35 - 2015-04-10 15:35 - 0192204 _____ () C:\Users\Chrisz\AppData\Local\38C2540F_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 0000290 _____ () C:\Users\Chrisz\AppData\Local\38C2540F_stp.CIS.part
2015-04-10 15:35 - 2015-04-10 15:35 - 0385602 _____ () C:\Users\Chrisz\AppData\Local\5D515C96_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 0000220 _____ () C:\Users\Chrisz\AppData\Local\5D515C96_stp.CIS.part
2015-04-10 15:35 - 2015-04-10 15:35 - 16561619 _____ () C:\Users\Chrisz\AppData\Local\784ED66F_stp.CIS
2015-04-10 15:35 - 2015-04-10 15:35 - 0000442 _____ () C:\Users\Chrisz\AppData\Local\784ED66F_stp.CIS.part
2011-10-25 22:17 - 2012-01-06 18:50 - 0001100 _____ () C:\Users\Chrisz\AppData\Local\d3d8caps.dat
2011-10-24 09:53 - 2014-06-16 21:20 - 0002032 _____ () C:\Users\Chrisz\AppData\Local\d3d9caps.dat
2011-10-23 21:40 - 2011-11-05 06:36 - 0001460 _____ () C:\Users\Chrisz\AppData\Local\d3d9caps64.dat
2011-12-11 20:32 - 2015-04-10 18:18 - 0005120 _____ () C:\Users\Chrisz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-07-04 20:31 - 2012-07-04 20:31 - 0355016 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistMSI29AD.txt
2012-01-19 20:30 - 2012-01-19 20:31 - 0418396 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistMSI303E.txt
2011-12-01 23:05 - 2011-12-01 23:06 - 0435482 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistMSI32F8.txt
2011-11-05 06:10 - 2011-11-05 06:11 - 0414026 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistMSI3A5E.txt
2012-07-04 20:31 - 2012-07-04 20:31 - 0011178 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistUI29AD.txt
2012-01-19 20:30 - 2012-01-19 20:31 - 0011656 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistUI303E.txt
2011-12-01 23:05 - 2011-12-01 23:06 - 0011466 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistUI32F8.txt
2011-11-05 06:10 - 2011-11-05 06:11 - 0011464 _____ () C:\Users\Chrisz\AppData\Local\dd_vcredistUI3A5E.txt
2014-05-02 21:27 - 2014-05-02 21:27 - 0000057 _____ () C:\ProgramData\Ament.ini
Some content of TEMP:
====================
C:\Users\Chrisz\AppData\Local\Temp\avgnt.exe
C:\Users\Chrisz\AppData\Local\Temp\Quarantine.exe
C:\Users\Chrisz\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-24 10:10
==================== End Of Log ============================
und Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-04-2015 02
Ran by Chrisz at 2015-04-24 12:12:05
Running from C:\Users\Chrisz\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2073220060-3931782743-526888967-500 - Administrator - Disabled)
Chrisz (S-1-5-21-2073220060-3931782743-526888967-1000 - Administrator - Enabled) => C:\Users\Chrisz
Gast (S-1-5-21-2073220060-3931782743-526888967-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{BE882A12-5A45-3DFF-9FD0-306DE65EB8A5}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 3.12 - Piriform)
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.98 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.98 - Etron Technology) Hidden
Free YouTube to MP3 Converter version 3.12.57.324 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.57.324 - DVDVideoSoft Ltd.)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 6600 - Grundlegende Software für das Gerät (HKLM\...\{F58934BD-F483-43EB-B307-CFFD88B18455}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6600 Hilfe (HKLM-x32\...\{2FA81482-5570-4CF0-9A10-D61D2F164916}) (Version: 140.0.2.2 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.9572 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
InfraRecorder 0.53 (x64 edition) (HKLM\...\{2C22EA92-CB30-4932-0053-000001000000}) (Version: 0.53.00.00 - Christian Kindahl)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 37.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
NETGEAR WG111v3 wireless USB 2.0 adapter (HKLM-x32\...\InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}) (Version: 1.01.10 - NETGEAR)
NETGEAR WG111v3 wireless USB 2.0 adapter (x32 Version: 1.01.10 - NETGEAR) Hidden
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OkayFreedom (HKLM-x32\...\{3F3FB10C-7175-4D38-9335-3488B89C12AF}) (Version: 1.4.3 - Steganos Software GmbH)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
RAGE (HKLM-x32\...\Steam App 9200) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 6.244.1111.2010 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6316 - Realtek Semiconductor Corp.)
SecurityUtility Service (HKLM-x32\...\SecurityUtility Service) (Version: - )
Spotify (HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\Spotify) (Version: 0.9.16.29.g0b5fcb05 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Studie zur Verbesserung von HP Officejet 6600 Produkten (HKLM\...\{E1A11879-5771-4E52-BA2E-CD5DD65BF970}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
23-04-2015 17:59:31 Geplanter Prüfpunkt
24-04-2015 09:48:19 Windows Live Mesh ActiveX control for remote connections wird entfernt
24-04-2015 10:21:55 Removed Apple Application Support
24-04-2015 10:24:06 Removed Apple Software Update
24-04-2015 10:55:58 Removed Splashtop Connect IE.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {06CF8505-C576-4493-B004-1D690021DB92} - \Adobe Flash Player Updater No Task File <==== ATTENTION
Task: {107F619B-CC33-41EF-A7BC-CA292216A4D1} - System32\Tasks\{930479D1-F735-4AB2-B299-683C6F534968} => pcalua.exe -a C:\Users\Chrisz\AppData\Local\Temp\Temp2_pbsetup_3.4.zip\pbsetup.exe
Task: {217C3853-0723-4140-A07C-06426E5C3591} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {2EB86958-4E3D-4FA2-9B7F-7D0C330C9955} - System32\Tasks\{7F86B468-8F5F-4834-BB20-7D67902EC6EB} => pcalua.exe -a C:\Users\Chrisz\AppData\Local\Temp\Temp1_pbsetup_3.4.zip\pbsetup.exe
Task: {3EE680BB-9322-4B40-A2BC-95ACAA0C6736} - System32\Tasks\{A81CDA1E-2C33-47D1-8950-21E051D83B14} => pcalua.exe -a C:\Users\Chrisz\Downloads\epson373032eu.exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {66F3DABD-54A9-4D14-8AD5-6443513BC88C} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {838464C1-B3D5-4286-93D9-FCA3E20A3686} - System32\Tasks\HP AR Program Upload - 9ce188ef5c094540a831c2df8244f696822377d463b641349cea4c61e995982f => C:\Program Files\HP\HP Officejet 6600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {901E7721-9DEE-4B53-BF60-21269887A857} - System32\Tasks\{2587C6B4-3906-4D35-85FA-F4DD8B50B99F} => pcalua.exe -a C:\Users\Chrisz\Desktop\pbsetup.exe -d C:\Users\Chrisz\Desktop
Task: {928ACF37-7C95-46F6-8FBB-99C782DFC640} - System32\Tasks\HPCustParticipation HP Officejet 6600 => C:\Program Files\HP\HP Officejet 6600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {9FCD6000-9255-4A88-A627-969CB55E4789} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-09-08 18:51 - 2011-12-06 04:10 - 00045056 _____ () C:\Windows\system32\atitmp64.dll
2009-11-06 14:41 - 2009-11-06 14:41 - 02080768 _____ () C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
2011-12-05 23:15 - 2011-12-05 23:15 - 00211968 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2011-08-07 11:06 - 2011-08-07 11:06 - 00624128 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2011-08-07 11:06 - 2011-08-07 11:06 - 03641344 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2011-12-05 23:15 - 2011-12-05 23:15 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-03-26 15:40 - 2015-03-26 15:40 - 00085504 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor.exe
2015-03-26 15:40 - 2015-03-26 15:40 - 01051136 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor_run.exe
2011-10-28 21:30 - 2012-09-22 15:00 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-26 16:19 - 2013-08-26 16:19 - 03233806 _____ () C:\Program Files (x86)\Tor\tor.exe
2011-12-05 23:15 - 2011-12-05 23:15 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-12-05 23:10 - 2011-12-05 23:10 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2009-03-04 09:52 - 2009-03-04 09:52 - 00372736 _____ () C:\Program Files (x86)\NETGEAR\WG111v3\WlanDll.dll
2008-12-29 17:13 - 2008-12-29 17:13 - 00204800 _____ () C:\Program Files (x86)\NETGEAR\WG111v3\KJLog.dll
2015-03-26 15:40 - 2015-03-26 15:40 - 02199552 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\CopyEditor_run.dll
2015-04-10 14:06 - 2015-04-10 14:06 - 06225408 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\gzostra.dll
2015-03-26 15:40 - 2015-03-26 15:40 - 01819136 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\trpjmvp.dll
2015-04-10 14:05 - 2015-04-24 10:02 - 00063644 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\bvhxap.dll
2015-04-10 14:05 - 2015-04-24 10:02 - 01018240 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\difd.dll
2015-04-10 14:05 - 2015-04-24 10:02 - 00005120 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\yojypzxd.dll
2011-10-23 22:55 - 2009-02-06 18:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2011-10-23 22:55 - 2009-07-10 09:07 - 00166912 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2015-04-10 14:05 - 2015-04-24 10:02 - 00509120 _____ () C:\Users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\bgquxf.dll
2015-04-22 10:34 - 2015-04-22 10:34 - 16863920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll
2015-04-24 11:14 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-04-24 11:14 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-04-24 11:14 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-04-24 11:14 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-04-24 11:14 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\sony.com -> sony.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2073220060-3931782743-526888967-1000\...\123simsen.com -> www.123simsen.com
There are 7694 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2073220060-3931782743-526888967-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Chrisz\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
HKU\{0681BE68-E785-40a9-A931-86DCCE20A56F}\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\img24.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Chrisz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: STCAgent => "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe"
MSCONFIG\startupreg: Steam => "D:\Steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: trustGTX14 => "C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe" showhide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
MSCONFIG\startupreg: ZyngaGamesAgent => "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/24/2015 09:30:05 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/24/2015 09:30:05 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/24/2015 09:30:03 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING-TO_DELETE> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/24/2015 07:50:37 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll4
Error: (04/23/2015 04:21:29 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/23/2015 04:21:27 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: EmdCache4
Error: (04/22/2015 09:24:43 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll4
Error: (04/22/2015 09:34:48 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/22/2015 09:34:45 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: EmdCache4
Error: (04/21/2015 04:34:32 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5,0xc0000000,0x00000003,...)". hr = 0x80070005.
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
System errors:
=============
Error: (04/24/2015 10:13:20 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWFailureCommand%%5
Error: (04/24/2015 10:12:18 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWStart%%5
Error: (04/24/2015 10:03:08 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Avira Service Host
Error: (04/24/2015 10:02:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: SecurityUtility Service%%3
Error: (04/24/2015 10:01:03 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Windows Presentation Foundation-Schriftartcache 3.0.0.02
Error: (04/24/2015 10:01:02 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: OkayFreedom VPN Starter Service101Neustart des Diensts
Error: (04/24/2015 10:01:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Presentation Foundation-Schriftartcache 3.0.0.0101Neustart des Diensts
Error: (04/24/2015 10:01:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Media Player-Netzwerkfreigabedienst1300001Neustart des Diensts
Error: (04/24/2015 10:01:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Search1300001Neustart des Diensts
Error: (04/24/2015 10:01:01 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Splashtop Connect IE Software Updater Service1
Microsoft Office Sessions:
=========================
Error: (04/24/2015 09:30:05 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING
Error: (04/24/2015 09:30:05 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING
Error: (04/24/2015 09:30:03 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\CHRISZ\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\241M5CXE.DEFAULT\SAFEBROWSING-TO_DELETE
Error: (04/24/2015 07:50:37 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll4
Error: (04/23/2015 04:21:29 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/23/2015 04:21:27 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: EmdCache4
Error: (04/22/2015 09:24:43 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll4
Error: (04/22/2015 09:34:48 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (04/22/2015 09:34:45 AM) (Source: Perflib) (EventID: 1023) (User: )
Description: EmdCache4
Error: (04/21/2015 04:34:32 PM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5,0xc0000000,0x00000003,...)0x80070005
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
CodeIntegrity Errors:
===================================
Date: 2013-11-21 03:02:33.970
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:33.803
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:33.634
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:33.481
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:10.660
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:10.502
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:10.347
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:10.099
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:09.862
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-21 03:02:09.696
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD FX(tm)-4100 Quad-Core Processor
Percentage of memory in use: 33%
Total physical RAM: 8188.32 MB
Available physical RAM: 5472.09 MB
Total Pagefile: 16429.61 MB
Available Pagefile: 13265.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:74.53 GB) (Free:15.69 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:149.05 GB) (Free:99.98 GB) NTFS
Drive f: () (Removable) (Total:3.8 GB) (Free:3.46 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 74.5 GB) (Disk ID: E455DA3E)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 149.1 GB) (Disk ID: 084C084B)
Partition 1: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 3.8 GB) (Disk ID: 2C6B7369)
No partition Table on disk 2.
==================== End Of Log ============================
|
|
24.04.2015, 15:48
| #4 |
| /// the machine /// TB-Ausbilder | Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.04.2015, 17:14
| #5 |
| | Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira sooo Code:
ATTFilter ComboFix 15-04-19.01 - Chrisz 24.04.2015 17:48:06.1.4 - x64
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.49.1031.18.8188.5833 [GMT 2:00]
ausgeführt von:: c:\users\Chrisz\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Chrisz\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Chrisz\AppData\Roaming\AcroIEHelpe.txt
c:\users\Chrisz\AppData\Roaming\srvblck2.tmp
c:\windows\wininit.ini
D:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-24 bis 2015-04-24 ))))))))))))))))))))))))))))))
.
.
2015-04-24 10:10 . 2015-04-24 10:12 -------- d-----w- C:\FRST
2015-04-24 09:14 . 2015-04-24 15:38 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2015-04-24 07:25 . 2015-04-24 08:01 -------- d-----w- C:\AdwCleaner
2015-04-24 05:38 . 2015-04-04 06:25 12032440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{730848F8-C682-4799-845E-99C40AB446C0}\mpengine.dll
2015-04-22 19:33 . 2015-04-04 06:25 12032440 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-04-22 17:52 . 2015-04-22 17:52 -------- d-----w- c:\users\Chrisz\AppData\Roaming\java
2015-04-22 17:52 . 2015-04-22 17:55 -------- d-----w- c:\users\Chrisz\AppData\Roaming\.minecraft
2015-04-22 08:49 . 2015-04-22 08:49 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-04-22 08:49 . 2015-04-22 08:48 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-04-22 08:48 . 2015-04-22 08:49 -------- d-----w- c:\programdata\Oracle
2015-04-22 08:48 . 2015-04-22 08:48 -------- d-----w- c:\program files (x86)\Java
2015-04-22 08:29 . 2015-04-23 14:11 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2015-04-22 07:31 . 2015-04-22 07:31 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Steganos Updates
2015-04-20 10:08 . 2015-04-24 05:44 -------- d-----w- c:\users\Chrisz\AppData\Local\Spotify
2015-04-20 10:07 . 2015-04-24 13:23 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Spotify
2015-04-15 10:46 . 2015-03-05 02:25 304128 ----a-w- c:\windows\SysWow64\gdi32.dll
2015-04-15 10:46 . 2015-03-05 01:58 390144 ----a-w- c:\windows\system32\gdi32.dll
2015-04-15 10:45 . 2015-03-13 01:44 4691384 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-04-15 10:45 . 2015-03-13 01:44 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2015-04-15 10:45 . 2015-03-13 01:30 301568 ----a-w- c:\windows\system32\wow64win.dll
2015-04-15 10:45 . 2015-03-13 01:30 234496 ----a-w- c:\windows\system32\wow64.dll
2015-04-15 10:45 . 2015-03-13 01:30 17408 ----a-w- c:\windows\system32\wow64cpu.dll
2015-04-15 10:45 . 2015-03-13 01:30 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2015-04-15 10:45 . 2015-03-13 00:08 26112 ----a-w- c:\windows\SysWow64\setup16.exe
2015-04-15 10:45 . 2015-03-13 00:08 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2015-04-15 10:45 . 2015-03-13 00:08 2560 ----a-w- c:\windows\SysWow64\user.exe
2015-04-15 10:45 . 2015-03-14 02:22 1585248 ----a-w- c:\windows\system32\ntdll.dll
2015-04-15 10:45 . 2015-03-14 02:22 1168080 ----a-w- c:\windows\SysWow64\ntdll.dll
2015-04-15 10:34 . 2015-03-05 02:23 57344 ----a-w- c:\windows\SysWow64\clfsw32.dll
2015-04-15 10:34 . 2015-03-05 02:14 360384 ----a-w- c:\windows\system32\clfs.sys
2015-04-15 10:34 . 2015-03-05 01:58 77824 ----a-w- c:\windows\system32\clfsw32.dll
2015-04-15 10:33 . 2015-03-09 00:40 1869824 ----a-w- c:\windows\system32\msxml3.dll
2015-04-15 10:33 . 2015-03-09 01:01 1249280 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-04-12 22:33 . 2015-02-20 02:03 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-04-12 22:33 . 2015-02-20 01:44 48128 ----a-w- c:\windows\system32\atmlib.dll
2015-04-12 22:33 . 2015-02-20 00:39 372224 ----a-w- c:\windows\system32\atmfd.dll
2015-04-12 22:33 . 2015-02-20 00:28 296960 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-04-12 22:32 . 2014-12-08 01:59 306176 ----a-w- c:\windows\SysWow64\scesrv.dll
2015-04-12 22:32 . 2014-12-08 01:37 399360 ----a-w- c:\windows\system32\scesrv.dll
2015-04-12 22:27 . 2015-01-29 01:35 975360 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-04-12 22:27 . 2015-01-29 01:33 1209856 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-04-12 22:26 . 2014-12-19 00:26 139776 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2015-04-12 22:26 . 2015-01-21 02:02 807936 ----a-w- c:\windows\SysWow64\msctf.dll
2015-04-12 22:26 . 2015-01-21 01:42 1040896 ----a-w- c:\windows\system32\msctf.dll
2015-04-12 22:21 . 2014-08-12 02:25 729600 ----a-w- c:\windows\SysWow64\IMJP10K.DLL
2015-04-12 22:21 . 2014-08-12 02:11 923136 ----a-w- c:\windows\system32\IMJP10K.DLL
2015-04-12 22:21 . 2015-02-26 00:31 2792960 ----a-w- c:\windows\system32\win32k.sys
2015-04-12 22:15 . 2014-06-15 22:18 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll
2015-04-12 22:15 . 2014-06-15 22:18 1943696 ----a-w- c:\windows\system32\dfshim.dll
2015-04-12 22:15 . 2014-06-13 18:22 81560 ----a-w- c:\windows\SysWow64\mscories.dll
2015-04-12 22:15 . 2014-06-13 18:22 156824 ----a-w- c:\windows\SysWow64\mscorier.dll
2015-04-12 22:15 . 2014-06-13 17:36 73880 ----a-w- c:\windows\system32\mscories.dll
2015-04-12 22:15 . 2014-06-13 17:36 156312 ----a-w- c:\windows\system32\mscorier.dll
2015-04-12 22:14 . 2014-10-24 01:03 499200 ----a-w- c:\windows\SysWow64\kerberos.dll
2015-04-12 22:14 . 2014-10-24 00:39 656384 ----a-w- c:\windows\system32\kerberos.dll
2015-04-12 22:13 . 2015-02-18 01:42 12899840 ----a-w- c:\windows\system32\shell32.dll
2015-04-12 22:02 . 2014-10-10 01:09 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-04-12 22:02 . 2014-10-10 01:00 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2015-04-12 22:02 . 2014-10-09 23:53 619520 ----a-w- c:\windows\system32\adtschema.dll
2015-04-12 22:02 . 2014-10-09 23:22 619520 ----a-w- c:\windows\SysWow64\adtschema.dll
2015-04-12 22:02 . 2014-10-10 01:10 548352 ----a-w- c:\windows\system32\termsrv.dll
2015-04-12 22:01 . 2014-10-18 00:46 847360 ----a-w- c:\windows\system32\oleaut32.dll
2015-04-12 22:01 . 2014-10-18 01:08 564224 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-04-12 22:00 . 2014-10-03 01:17 115712 ----a-w- c:\windows\SysWow64\AudioSes.dll
2015-04-12 22:00 . 2014-10-03 01:18 274432 ----a-w- c:\windows\SysWow64\AUDIOKSE.dll
2015-04-12 22:00 . 2014-10-03 01:17 396800 ----a-w- c:\windows\SysWow64\AudioEng.dll
2015-04-12 22:00 . 2014-10-03 01:03 313344 ----a-w- c:\windows\system32\AUDIOKSE.dll
2015-04-12 22:00 . 2014-10-03 01:02 201728 ----a-w- c:\windows\system32\EncDump.dll
2015-04-12 22:00 . 2014-10-03 01:01 474624 ----a-w- c:\windows\system32\AudioEng.dll
2015-04-12 22:00 . 2014-10-03 01:01 446976 ----a-w- c:\windows\system32\audiosrv.dll
2015-04-12 22:00 . 2014-10-02 23:49 88576 ----a-w- c:\windows\SysWow64\audiodg.exe
2015-04-12 21:52 . 2015-01-29 01:33 449024 ----a-w- c:\windows\system32\WMPhoto.dll
2015-04-12 21:52 . 2015-01-29 01:35 369664 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-04-12 21:51 . 2014-12-06 03:14 48640 ----a-w- c:\windows\SysWow64\nlaapi.dll
2015-04-12 21:51 . 2014-12-06 03:14 93184 ----a-w- c:\windows\SysWow64\ncsi.dll
2015-04-12 21:51 . 2014-12-06 02:54 61440 ----a-w- c:\windows\system32\nlaapi.dll
2015-04-12 21:51 . 2014-12-06 02:54 205824 ----a-w- c:\windows\system32\nlasvc.dll
2015-04-12 21:51 . 2014-12-06 02:54 178688 ----a-w- c:\windows\system32\profsvc.dll
2015-04-12 21:51 . 2014-10-24 01:04 67072 ----a-w- c:\windows\SysWow64\packager.dll
2015-04-12 21:51 . 2014-10-24 00:39 77312 ----a-w- c:\windows\system32\packager.dll
2015-04-12 21:51 . 2014-09-04 23:38 198656 ----a-w- c:\windows\system32\drivers\fastfat.sys
2015-04-12 21:51 . 2014-08-27 00:55 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-04-12 21:51 . 2014-08-27 00:41 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-04-12 21:50 . 2015-01-09 01:41 85504 ----a-w- c:\windows\system32\csrsrv.dll
2015-04-12 21:50 . 2015-01-09 00:29 75264 ----a-w- c:\windows\system32\smss.exe
2015-04-12 21:48 . 2015-01-15 06:53 77312 ----a-w- c:\windows\SysWow64\secur32.dll
2015-04-12 21:47 . 2015-03-06 04:01 279040 ----a-w- c:\windows\SysWow64\schannel.dll
2015-04-12 21:47 . 2015-03-06 03:35 347136 ----a-w- c:\windows\system32\schannel.dll
2015-04-12 21:47 . 2014-10-10 01:09 1689600 ----a-w- c:\windows\system32\lsasrv.dll
2015-04-12 21:47 . 2015-01-15 04:08 516536 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-04-10 16:24 . 2015-04-10 16:24 -------- d-----w- c:\users\Chrisz\AppData\Local\Apple Computer
2015-04-10 16:23 . 2015-04-12 21:32 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Apple Computer
2015-04-10 16:23 . 2015-04-10 16:23 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2015-04-10 16:23 . 2015-04-10 16:22 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2015-04-10 16:23 . 2015-04-10 16:22 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2015-04-10 16:23 . 2015-04-10 16:22 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2015-04-10 16:23 . 2015-04-10 16:22 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2015-04-10 16:22 . 2015-04-10 16:22 -------- d-----w- c:\program files (x86)\QuickTime
2015-04-10 16:22 . 2015-04-10 16:22 -------- d-----w- c:\programdata\Apple Computer
2015-04-10 16:20 . 2015-04-10 16:20 -------- d-----w- c:\users\Chrisz\AppData\Local\Apple
2015-04-10 16:17 . 2015-04-10 16:32 -------- d-----w- c:\users\Chrisz\AppData\Roaming\InfraRecorder
2015-04-10 16:15 . 2015-04-10 16:15 -------- d-----w- c:\program files\InfraRecorder
2015-04-10 13:37 . 2015-04-10 13:37 -------- d-----w- c:\program files (x86)\Free Codec Pack
2015-04-10 13:36 . 2015-04-24 15:59 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Steganos VPN
2015-04-10 13:36 . 2015-04-14 10:10 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Steganos
2015-04-10 13:36 . 2015-04-10 13:36 -------- d-----w- c:\program files (x86)\OkayFreedom
2015-04-10 13:36 . 2015-04-10 13:36 -------- d-----w- c:\program files (x86)\Common Files\Steganos
2015-04-10 13:35 . 2015-04-10 13:35 -------- d-----w- c:\users\Chrisz\AppData\Local\784ED66F_stp
2015-04-10 13:35 . 2015-04-10 13:36 -------- d-----w- c:\users\Chrisz\AppData\Local\5D515C96_stp
2015-04-10 12:19 . 2015-04-10 12:19 -------- d-----w- c:\users\Chrisz\AppData\Roaming\Avira
2015-04-10 12:13 . 2015-03-17 11:01 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-04-10 12:13 . 2015-03-17 11:01 132120 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-04-10 12:13 . 2015-03-17 11:01 128536 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-04-10 12:10 . 2015-04-10 12:13 -------- d-----w- c:\programdata\Avira
2015-04-10 12:10 . 2015-04-10 12:13 -------- d-----w- c:\program files (x86)\Avira
2015-04-10 12:10 . 2015-04-10 12:10 -------- d-----w- c:\programdata\Package Cache
2015-04-10 12:08 . 2015-04-10 12:08 -------- d-----w- c:\users\Chrisz\AppData\Roaming\dlg
2015-04-10 12:06 . 2015-04-10 12:06 -------- d-----w- c:\programdata\62d94c5d8454453aa99260d2139bc31b
2015-04-10 12:05 . 2015-04-10 15:09 -------- d-----w- c:\programdata\Packer9dc087ae-908f-4f18-9cdf-58cd3413437f
2015-04-10 12:05 . 2015-04-24 15:58 -------- d-----w- c:\users\Chrisz\AppData\Local\CopyEditor
2015-04-10 11:20 . 2015-04-10 11:19 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9B03838E-0E9D-4A8F-B98A-845CB6B9C42B}\gapaengine.dll
2015-04-10 10:55 . 2015-04-10 10:55 -------- d-----w- C:\OEMSettings
2015-04-10 10:54 . 2009-10-14 13:08 418816 ----a-w- c:\windows\system32\drivers\wg111v3.sys
2015-04-10 10:54 . 2015-04-10 10:54 -------- d-----w- c:\program files (x86)\NETGEAR
2015-04-10 10:51 . 2015-04-10 10:51 -------- d-----w- c:\windows\Downloaded Installations
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-22 08:34 . 2012-08-23 11:43 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-04-22 08:34 . 2011-10-24 07:52 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-04-15 10:34 . 2006-11-02 12:35 128913832 ----a-w- c:\windows\system32\mrt.exe
2015-03-13 01:44 . 2015-04-15 10:45 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2015-03-13 01:43 . 2015-04-15 10:45 43008 ----a-w- c:\windows\apppatch\acwow64.dll
2015-03-03 13:17 . 2011-10-23 20:38 295552 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Officejet 6600 (NET)"="c:\program files\HP\HP Officejet 6600\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"OKAYFREEDOM_Agent"="c:\program files (x86)\OkayFreedom\OkayFreedomClient.exe" [2015-02-18 6553000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"P17RunE"="P17RunE.dll" [2008-03-28 14848]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-04-10 726320]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-04-10 335232]
.
c:\users\Chrisz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Officejet 6600 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 6600\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN3867QGPP05RN;CONNECTION=NW;MONITOR=1; [2006-11-2 46592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111v3 Setup-Assistent.lnk - c:\program files (x86)\NETGEAR\WG111v3\WG111v3.exe [2009-11-6 2080768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\bknwccx.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro36CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-24 11780712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-01-30 1332296]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 182784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\users\Chrisz\AppData\Local\CopyEditor\vvmcoayx\yggqqgwb.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9gDzKu1CDExyiuzRdPug00ANy_bDqxoFixjWtuRhYGI0bvWcqU_j7FrAC3oia3CgGP6GPu4gNsRxg,,
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q={searchTerms}
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Chrisz\AppData\Roaming\Mozilla\Firefox\Profiles\241m5cxe.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9gDzKu1CDExyiuzRdPug00ANy_bDqxoFixjWtuRhYGI0bvWcqU_j7FrAC3oia3CgGP6GPu4gNsRxg,,
FF - prefs.js: keyword.URL - hxxp://feed.sonic-search.com/?p=mKO_AwFzXIpYRa4j3q-3hUPE9a9InJ9YovTwLIQAT9Pa3aeCIuPVkrKWUd3OzYyZUu6SF-P2Kj76wEwRag-wbqKMokW6XY2kr7h_PqLwfHKvSMBvr9RHzjJXSkC2raIDgynSQ1pJ9thffv7mpvI8BLrSdCvBEZp7MvjI_yNN1BAJYkexCUnE6XayQe68WA,,&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
WebBrowser-{91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - (no file)
HKLM-Run-smrt - c:\program files (x86)\ProductUI\Startup.exe
AddRemove-SecurityUtility Service - c:\programdata\SecurityUtility\SoftConfigTest.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2073220060-3931782743-526888967-1000\Software\SecuROM\License information*]
"datasecu"=hex:1a,c9,dc,f8,37,59,5a,3d,e7,f4,db,9a,04,98,c1,47,c7,35,18,bc,18,
c8,17,74,e6,4c,62,f9,aa,21,d3,9c,a4,7b,2c,3a,14,01,f5,86,5d,85,04,45,03,a2,\
"rkeysecu"=hex:95,21,68,80,5f,7d,60,b1,c5,a5,1f,10,0f,cd,d7,9b
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\sched.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\users\Chrisz\AppData\Local\CopyEditor\CopyEditor.exe
c:\programdata\EPSON\EPW!3 SSRP\E_S30RP1.EXE
c:\users\Chrisz\AppData\Local\CopyEditor\CopyEditor_run.exe
c:\program files (x86)\OkayFreedom\OkayFreedomService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Tor\tor.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Windows Media Player\wmplayer.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-24 18:05:48 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-24 16:05
.
Vor Suchlauf: 12 Verzeichnis(se), 16.906.924.032 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 16.954.363.904 Bytes frei
.
- - End Of File - - A0C1AD381A5B66C46F7594D518753D42
5C616939100B85E558DA92B899A0FC36
|
|
25.04.2015, 14:51
| #6 |
| /// the machine /// TB-Ausbilder | Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira |
|
| Themen zu Windows Vista - Virusfund in C:\Users\Chrisz\AppData\Local\CopyEditor mit Avira |
| avira, avira virusfund, chromium, virusfund, windows vista |
WARNUNG an die MITLESER: 
Linear-Darstellung
