pc ist langsam und kaspersky notfall cd findet trojan-fakeav.win32.tweaker.b

premmarga · 13.06.2015, 18:49

Hallo,
Der pc ist langsam und notfall cd von kaspersky hat trojan-fakeav.win32.tweaker.b gefunden. und gesagt dies soll neutralisiert werden.

Weiss jetzt nicht genau wie ich vorgehen soll.

Danke

cosinus · 13.06.2015, 19:15

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

premmarga · 13.06.2015, 21:04

[QUOTE=cosinus;1477805]Hallo und

Danke für die rasche antwort

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Nein, malwarebytes und avast hat nichts gefunden.

Soll ich trotzdem nach logs suchen?

die logs von farbar wie angesagt.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by Carmen (administrator) on LENOVONOTEBOOK on 13-06-2015 21:56:58
Running from C:\Users\Carmen\Downloads
Loaded Profiles: Carmen (Available Profiles: Carmen & carmen-lokal)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu8.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\InstallServices64.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu_Hook.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_160.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_160.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-27] (Avast Software s.r.o.)
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4630 series.lnk [2014-11-30]
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4630 series.lnk -> C:\Program Files\HP\HP Officejet 4630 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-27] (Avast Software s.r.o.)
CHR HKU\S-1-5-21-4062042949-3846255169-451896970-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4062042949-3846255169-451896970-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-17] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-01] (Google Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-12] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-17] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-01] (Google Inc.)
BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-04-01] (IObit)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-12] (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-01] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-01] (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\mwm5x373.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_160.dll [2015-06-12] ()
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-12] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-23]

Chrome: 
=======
CHR Profile: C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-23]
CHR Extension: (Google Drive) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2015-05-30]
CHR Extension: (YouTube) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-23]
CHR Extension: (Google Search) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-23]
CHR Extension: (Avast Online Security) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-11-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-07]
CHR Extension: (Google Wallet) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-05]
CHR Extension: (Gmail) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-23]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-27] (Avast Software s.r.o.)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2585376 2015-03-26] (IObit)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 StartMenuService; C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe [72512 2013-12-09] (IObit)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-27] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-27] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-27] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-27] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-27] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-27] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-01-13] (REALiX(tm))
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-13 21:56 - 2015-06-13 21:58 - 00012742 _____ C:\Users\Carmen\Downloads\FRST.txt
2015-06-13 21:56 - 2015-06-13 21:57 - 00000000 ____D C:\FRST
2015-06-13 21:55 - 2015-06-13 21:55 - 02109952 _____ (Farbar) C:\Users\Carmen\Downloads\FRST64.exe
2015-06-12 15:16 - 2015-06-12 15:16 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-12 15:15 - 2015-06-12 15:15 - 00001114 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-12 15:15 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-12 15:15 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-12 15:15 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-12 15:08 - 2015-06-12 15:09 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Carmen\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-12 14:53 - 2015-06-12 14:53 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-06-12 14:52 - 2015-06-12 14:52 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-12 14:42 - 2015-06-12 14:42 - 01124072 _____ (Adobe Systems Incorporated) C:\Users\Carmen\Downloads\readerdc_de_ha_install.exe
2015-06-12 14:38 - 2015-06-12 14:38 - 00562784 _____ (Oracle Corporation) C:\Users\Carmen\Downloads\jre-8u45-windows-i586-iftw.exe
2015-06-12 14:29 - 2015-06-13 19:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-12 14:29 - 2015-06-12 14:29 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-12 14:00 - 2015-06-12 14:00 - 00000000 ____D C:\Users\Carmen\AppData\Roaming\ProductData
2015-06-12 13:59 - 2015-06-12 13:59 - 00000000 ____D C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-06-09 21:04 - 2015-04-25 04:34 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-09 21:04 - 2015-04-25 04:33 - 00549888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-09 21:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 21:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-09 21:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-09 21:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-09 21:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-09 21:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-09 21:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-09 21:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-06-09 21:03 - 2015-05-23 04:43 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-06-09 21:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-09 21:03 - 2015-05-23 04:38 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-09 21:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-09 21:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-09 21:03 - 2015-05-23 04:28 - 01042944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-06-09 21:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-09 21:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-09 21:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 21:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 21:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 21:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 21:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-09 21:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 21:03 - 2015-05-22 20:23 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-06-09 21:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 21:03 - 2015-05-22 20:15 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-06-09 21:03 - 2015-05-22 20:09 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-06-09 21:03 - 2015-05-22 20:08 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-09 21:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 21:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 21:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 21:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 21:03 - 2015-05-22 19:49 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-06-09 21:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 21:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-09 21:03 - 2015-05-21 18:47 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-08 09:16 - 2015-06-08 15:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-06-08 09:08 - 2015-06-13 21:35 - 00001856 _____ C:\Windows\setupact.log
2015-06-08 09:08 - 2015-06-13 21:32 - 00057160 _____ C:\Windows\PFRO.log
2015-06-08 09:08 - 2015-06-08 09:08 - 00000000 _____ C:\Windows\setuperr.log
2015-06-07 21:46 - 2015-06-08 11:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 17:57 - 2015-06-02 17:57 - 00000000 ____D C:\Users\Carmen\AppData\Local\GWX
2015-05-30 15:46 - 2015-05-30 15:46 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-05-30 15:46 - 2015-05-30 15:46 - 01018880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-30 15:46 - 2015-05-30 15:46 - 00410336 _____ C:\Windows\system32\ApnDatabase.xml
2015-05-30 15:46 - 2015-05-30 15:46 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rgb9rast.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 02483712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authz.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 03633664 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00468480 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00325464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-30 15:44 - 2015-05-30 15:44 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 18823168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 15158784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 04837376 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 02485056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 01454080 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 01142272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 01084416 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00962216 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00952896 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00885760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 00801584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00786120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00733696 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00702464 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00657920 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00624640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00551232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00514048 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00473408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2015-05-30 15:43 - 2015-05-30 15:43 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00182784 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00169984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00155648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00136512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00128512 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\i8042prt.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\agilevpn.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\vsstrace.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00059712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdclass.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00058176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vsstrace.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00051008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouclass.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2015-05-30 15:43 - 2015-05-30 15:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00039744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2015-05-30 15:43 - 2015-05-30 15:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouhid.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sermouse.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\eventcls.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eventcls.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 00672984 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2015-05-30 15:39 - 2015-05-30 15:39 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 00273240 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-27 12:14 - 2015-05-27 12:14 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-05-27 12:14 - 2015-05-27 12:14 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-05-19 16:50 - 2015-05-19 16:40 - 00031478 _____ C:\Users\Carmen\Documents\Fobi%20Schmerz%2024.1.12.doc_0.odt
2015-05-16 21:55 - 2015-06-03 18:18 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-16 21:55 - 2015-06-03 18:18 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 21:28 - 2015-05-16 21:28 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-05-16 21:28 - 2015-05-16 21:28 - 00000000 ____D C:\Windows\system32\appraiser
2015-05-16 19:24 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 19:24 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 19:20 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-16 19:20 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-16 19:20 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-16 19:20 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-16 19:20 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-16 19:20 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-16 19:19 - 2015-03-13 06:03 - 00239424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-16 19:19 - 2015-03-13 06:03 - 00154432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-16 19:19 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-16 19:19 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-16 19:19 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-16 19:19 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-14 22:05 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-14 22:05 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-14 22:05 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 22:05 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 22:05 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-14 22:05 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-14 22:05 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-14 22:05 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-14 22:05 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-14 22:05 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-14 22:04 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-14 22:04 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 22:04 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-13 21:56 - 2013-11-23 22:56 - 01976579 _____ C:\Windows\WindowsUpdate.log
2015-06-13 21:49 - 2013-11-23 16:02 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4062042949-3846255169-451896970-1001
2015-06-13 21:44 - 2014-03-30 19:56 - 00165659 _____ C:\MyXML.xml
2015-06-13 21:44 - 2013-11-23 16:09 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-13 21:35 - 2013-11-27 16:40 - 00000000 ____D C:\ProgramData\Kodak
2015-06-13 21:35 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-13 20:09 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-06-13 20:02 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-06-13 19:30 - 2013-11-23 16:02 - 00003958 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{071E09A8-05A5-4E8C-9806-1724AC596E7B}
2015-06-13 19:23 - 2013-11-23 16:09 - 00001148 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-13 19:15 - 2013-11-23 16:12 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-06-12 15:56 - 2014-10-10 18:01 - 00000000 ____D C:\Users\carmen-lokal\AppData\Roaming\Systweak
2015-06-12 15:56 - 2014-07-11 16:46 - 00000000 ____D C:\ProgramData\Systweak
2015-06-12 15:56 - 2014-07-11 16:37 - 00000000 ____D C:\Users\Carmen\AppData\Roaming\Systweak
2015-06-12 15:56 - 2014-01-20 19:27 - 00000000 ____D C:\ProgramData\APN
2015-06-12 15:03 - 2013-11-23 17:49 - 00000000 ____D C:\ProgramData\ProductData
2015-06-12 14:59 - 2014-07-01 13:47 - 00000000 ____D C:\Users\Carmen\AppData\Local\Adobe
2015-06-12 14:54 - 2014-12-25 19:31 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-12 14:52 - 2013-11-23 17:42 - 00000000 ____D C:\ProgramData\Adobe
2015-06-12 14:44 - 2013-11-25 15:36 - 00000000 ____D C:\ProgramData\Oracle
2015-06-12 14:43 - 2014-11-06 16:51 - 00000000 ____D C:\Program Files (x86)\Java
2015-06-12 14:40 - 2014-11-06 16:52 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-06-12 14:36 - 2013-11-23 16:30 - 00000000 ____D C:\Windows\system32\MRT
2015-06-12 14:30 - 2013-11-23 16:30 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-12 14:00 - 2013-11-23 17:46 - 00000000 ____D C:\Program Files (x86)\IObit
2015-06-12 13:59 - 2013-11-23 17:49 - 00000000 ____D C:\Users\Carmen\AppData\Roaming\IObit
2015-06-12 13:59 - 2013-11-23 17:47 - 00000000 ____D C:\ProgramData\IObit
2015-06-12 13:55 - 2013-11-27 18:32 - 00000000 ____D C:\ProgramData\Ashampoo
2015-06-12 13:54 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-06-12 13:27 - 2015-01-13 10:08 - 00002856 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (Carmen)
2015-06-12 13:21 - 2013-08-22 16:44 - 00362760 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-12 13:18 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 11:14 - 2014-10-10 16:39 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4062042949-3846255169-451896970-1002
2015-06-09 19:51 - 2014-02-18 10:59 - 00000000 ____D C:\Users\Carmen\Documents\Silberstreif
2015-06-08 11:17 - 2013-11-25 15:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-07 21:01 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-05-30 15:50 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\setup
2015-05-30 15:50 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\setup
2015-05-30 15:49 - 2013-11-23 22:56 - 00000000 ____D C:\Users\Carmen
2015-05-30 15:39 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2015-05-30 15:31 - 2013-11-23 22:58 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-05-30 15:31 - 2013-08-23 01:24 - 00765582 _____ C:\Windows\system32\perfh007.dat
2015-05-30 15:31 - 2013-08-23 01:24 - 00159366 _____ C:\Windows\system32\perfc007.dat
2015-05-27 12:14 - 2014-05-15 22:04 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys
2015-05-27 12:14 - 2014-01-09 17:02 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-21 15:09 - 2015-04-04 21:34 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-21 15:09 - 2015-04-04 21:34 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-16 21:58 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppCompat
2015-05-16 21:28 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-16 19:11 - 2013-11-23 16:09 - 00004120 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 19:11 - 2013-11-23 16:09 - 00003884 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 19:05 - 2013-08-23 01:26 - 00000000 ____D C:\Program Files\Windows Journal

==================== Files in the root of some directories =======

2013-11-27 17:00 - 2013-11-27 17:00 - 0000236 _____ () C:\Users\Carmen\AppData\Local\LaunchHomeCenter.log
2014-11-30 21:13 - 2014-11-30 21:13 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-12 13:12

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Carmen at 2015-06-13 21:58:38
Running from C:\Users\Carmen\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4062042949-3846255169-451896970-500 - Administrator - Disabled)
Carmen (S-1-5-21-4062042949-3846255169-451896970-1001 - Administrator - Enabled) => C:\Users\Carmen
carmen-lokal (S-1-5-21-4062042949-3846255169-451896970-1002 - Limited - Enabled) => C:\Users\carmen-lokal
Gast (S-1-5-21-4062042949-3846255169-451896970-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.160 - Adobe Systems Incorporated)
aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 5.8.10.0 - Your Company Name) Hidden
aioscnnr (x32 Version: 7.6.13.10 - Your Company Name) Hidden
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden
center (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden
Dropbox (HKU\S-1-5-21-4062042949-3846255169-451896970-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
essentials (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.0 - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 4630 series - Grundlegende Software für das Gerät (HKLM\...\{3566FFED-696A-4260-8F12-073426CAC951}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet 4630 series Hilfe (HKLM-x32\...\{08B9332C-26DB-4EF3-85D6-6DC62B937681}) (Version: 31.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden
KODAK All-in-One Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden
PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)
Start Menu 8 (HKLM-x32\...\IObit_StartMenu8_is1) (Version: 1.4.0.0 - IObit)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.11.90 - Akademische Arbeitsgemeinschaft)
Studie zur Verbesserung von HP Officejet 4630 series (HKLM\...\{3917CF9F-DF46-406E-B524-CA0F150C70D7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

26-05-2015 16:08:32 Windows Update
30-05-2015 15:05:50 Windows Update
02-06-2015 18:18:48 Windows Update
07-06-2015 21:43:06 Windows Update
12-06-2015 13:13:05 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01071E8A-196C-4FC2-8D1F-02E29E5A95CC} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {1489B754-C157-4155-A312-ADA0409124CD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {22BCB510-A2B0-4564-954F-0738DBE289EF} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {494B521B-9EA1-47B3-BB06-B2B988CAE8CB} - System32\Tasks\Driver Booster SkipUAC (Carmen) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {4DE6CC7E-5A1C-427C-9EC2-70F1FF4DCBDD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {51408F7D-B57F-46EF-8F2F-575E0EF5F919} - System32\Tasks\StartMenuAutoupdate => C:\Program Files (x86)\IObit\Start Menu 8\AutoUpdate.exe [2013-12-09] (IObit)
Task: {6FCB4406-B284-4E22-95EA-86735ACAAD9A} - System32\Tasks\HP AR Program Upload - 71791f773cb74245877fb7872668eb0d5568422fbe56404392d5b8b564653d58 => C:\Program Files\HP\HP Officejet 4630 series\bin\HPRewards.exe [2014-07-21] (TODO: <Company name>)
Task: {727D079F-8555-46CF-B519-CFA574014280} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.)
Task: {78A3EFEC-E889-4129-A5B5-7827ECE93771} - System32\Tasks\HPCustParticipation HP Officejet 4630 series => C:\Program Files\HP\HP Officejet 4630 series\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {8CEA366F-800F-4C0C-8E02-699C2ACE194F} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {8DCC6ADF-CFCE-4C99-BC5F-B8AB29B43A31} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-27] (Avast Software s.r.o.)
Task: {9A7CA00A-4638-45C9-9A0A-CC6D666B2871} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {A2FB962E-6475-4112-9FB7-F527DE05941A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-06-12] (Microsoft Corporation)
Task: {C33BDAE4-C93B-4B23-B4CD-3757EDEF725F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.)
Task: {CE3907C9-0643-426C-88D8-EEF46C38C4DE} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {E52C6300-B098-4188-8DF1-34041570313A} - System32\Tasks\avastBCLRestartS-1-5-21-4062042949-3846255169-451896970-1001 => Firefox.exe 
Task: {F5D801C2-BF00-458C-8269-C8A0B6248911} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2013-10-04 00:42 - 2013-10-04 00:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-05-27 12:14 - 2015-05-27 12:14 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-27 12:14 - 2015-05-27 12:14 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-06-13 19:16 - 2015-06-13 19:16 - 02954752 _____ () C:\Program Files\AVAST Software\Avast\defs\15061300\algo.dll
2015-06-13 21:37 - 2015-06-13 21:37 - 02954752 _____ () C:\Program Files\AVAST Software\Avast\defs\15061301\algo.dll
2013-11-23 17:49 - 2014-10-16 10:26 - 00622880 _____ () C:\Program Files (x86)\IObit\LiveUpdate\ProductStatistics.dll
2013-11-23 17:46 - 2013-12-09 16:10 - 00348992 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madExcept_.bpl
2013-11-23 17:46 - 2013-12-09 16:10 - 00183616 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madBasic_.bpl
2013-11-23 17:46 - 2013-12-09 16:10 - 00051008 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madDisAsm_.bpl
2014-03-30 19:56 - 2013-12-09 16:10 - 00089920 _____ () C:\Program Files (x86)\IObit\Start Menu 8\NTFSScan.dll
2013-11-23 17:46 - 2013-12-09 16:10 - 00039744 _____ () C:\Program Files (x86)\IObit\Start Menu 8\pri.dll
2013-11-23 17:46 - 2013-12-09 16:11 - 00041280 _____ () C:\Program Files (x86)\IObit\Start Menu 8\winkey.dll
2015-03-16 11:49 - 2015-03-16 11:49 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4062042949-3846255169-451896970-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Carmen\Pictures\2013-12-24\IMG_0588.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{16F83C8C-E2B9-49C0-AF18-A43C156E521E}] => (Allow) LPort=5353
FirewallRules: [{5BDB590B-BE4B-4A94-8620-9DCCE661A7EB}] => (Allow) LPort=9322
FirewallRules: [{2DDBD328-3F1F-43BB-9D0D-B2D21857B5F6}] => (Allow) LPort=5353
FirewallRules: [TCP Query User{E85BBC39-3CFB-4E49-9E76-6C829CBFBD01}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{6801240D-2FDB-4387-958E-0E32BDD4F14D}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{6B2EFF5E-6163-4530-BE83-627BBC5D72BE}] => (Allow) LPort=9322
FirewallRules: [{EB7CB9E5-E045-4788-9149-A3388B1BE021}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
FirewallRules: [{364EB8DA-91AC-41FA-8A4D-BA8F12A61FD2}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
FirewallRules: [{40708F19-3A4B-40B0-ACF0-768E5B92BC1B}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe
FirewallRules: [{AA80B086-52C6-4B8A-9C00-7FCA87DEE5FD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe
FirewallRules: [{8E4C9FEE-D771-434E-A00A-F6DF3B61C516}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe
FirewallRules: [{EA2C697B-F9C2-4158-8235-6DF26E96B968}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe
FirewallRules: [{AA68AC6A-59FE-471F-9C20-A1C4044CC026}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe
FirewallRules: [{E098F6FF-8C74-463B-B0CF-EE1F08606F9E}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe
FirewallRules: [{0EA87165-32E7-482F-A5A2-9FEB7D341CA6}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe
FirewallRules: [{28E0E319-1EF0-4BF6-B355-CAB2C00494B6}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe
FirewallRules: [{6A6C69FB-AF82-423A-878A-2FA87FEB5170}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\FaxApplications.exe
FirewallRules: [{DC9A2DFA-8899-4C27-B575-448F5ECD26A0}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\DigitalWizards.exe
FirewallRules: [{45BE591D-9078-4636-BF10-8D02378F3824}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\SendAFax.exe
FirewallRules: [{6B75A329-1768-48DF-9E21-287582AFCE18}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\DeviceSetup.exe
FirewallRules: [{2F3CE577-B3D4-4C67-8FB6-AC0C9B041666}] => (Allow) LPort=5357
FirewallRules: [{2B294CE4-6C27-4D8F-99E0-E8F40DA3ECE6}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{E25A3B22-2185-4B69-8EBF-154E08F2ED4D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DAE3DD82-043B-4BED-B2E8-5B44944D3EF0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{074EBD5E-114E-4E26-B11E-D59097B397C2}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{2FB1C4AF-825C-4DFC-AFB1-9605360D521A}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{CFB1083D-8688-4696-81E4-0778543C8AF8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/13/2015 09:33:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0xd8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fb8

Startzeit: 01d0a512c3aa3d6b

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: b889e8f2-1106-11e5-84c7-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexSports

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7c8

Startzeit: 01d0a512c3aa3d6b

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: b88a1002-1106-11e5-84c7-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingNews_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexNews

Error: (06/08/2015 09:09:11 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" konnte im Namespace "//./ROOT/SecurityCenter" aufgrund des Fehlers "0x80041033" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (06/08/2015 09:09:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0x1d4
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1248

Startzeit: 01d0a15ef161b145

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: e4b0d680-0d52-11e5-84be-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 834

Startzeit: 01d0a15ef161b145

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: e46e13c3-0d52-11e5-84be-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingFinance_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexFinance

Error: (06/07/2015 09:10:01 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex (1424) WebCacheLocal: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Users\Carmen\AppData\Local\Microsoft\Windows\WebCache\V010000F.log.

Error: (06/02/2015 05:47:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0x164
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (05/30/2015 03:56:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: )
Description: Vom Kryptografiedienst konnte die Katalogdatenbank nicht initialisiert werden. "ESENT"-Fehler: -528.


System errors:
=============
Error: (06/13/2015 09:36:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Defender-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (06/13/2015 09:34:51 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 408) (User: NT-AUTORITÄT)
Description: Die Aufgabenplanungdienst konnte das Leerlaufstatuserkennungs-Modul nicht initialisieren. Leerlaufaufgaben können nicht wie erforderlich gestartet werden Zusätzliche Daten: Fehlerwert: 1747

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Designs" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Shellhardwareerkennung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Benachrichtigungsdienst für Systemereignisse" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Aufgabenplanung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Benutzerprofildienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Multimediaklassenplaner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Gruppenrichtlinienclient" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2015 09:34:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Server" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%109


Microsoft Office:
=========================
Error: (06/13/2015 09:33:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b2d801d0a60fbc2dfe0fC:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dll07efc3ba-1203-11e5-84cd-1c3e84e7b766

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384fb801d0a512c3aa3d6b4294967295C:\Windows\system32\backgroundTaskHost.exeb889e8f2-1106-11e5-84c7-1c3e84e7b766Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbweAppexSports

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.163847c801d0a512c3aa3d6b4294967295C:\Windows\system32\backgroundTaskHost.exeb88a1002-1106-11e5-84c7-1c3e84e7b766Microsoft.BingNews_3.0.1.174_x64__8wekyb3d8bbweAppexNews

Error: (06/08/2015 09:09:11 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./ROOT/SecurityCenterSELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'0x80041033

Error: (06/08/2015 09:09:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b21d401d0a1b9f5084d09C:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dll3dbbbc76-0dad-11e5-84bf-1c3e84e7b766

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384124801d0a15ef161b1454294967295C:\Windows\system32\backgroundTaskHost.exee4b0d680-0d52-11e5-84be-1c3e84e7b766Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbweApp

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.1638483401d0a15ef161b1454294967295C:\Windows\system32\backgroundTaskHost.exee46e13c3-0d52-11e5-84be-1c3e84e7b766Microsoft.BingFinance_3.0.1.174_x64__8wekyb3d8bbweAppexFinance

Error: (06/07/2015 09:10:01 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex1424WebCacheLocal: C:\Users\Carmen\AppData\Local\Microsoft\Windows\WebCache\V010000F.log-1811 (0xfffff8ed)

Error: (06/02/2015 05:47:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b216401d09d4b5c11873dC:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dlla5922704-093e-11e5-84bb-1c3e84e7b766

Error: (05/30/2015 03:56:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: )
Description: -528


CodeIntegrity Errors:
===================================
  Date: 2015-06-13 21:36:18.367
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 21:34:51.161
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 19:05:58.410
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 08:57:31.439
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 16:08:43.008
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 16:01:58.036
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 13:22:28.724
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 12:55:50.686
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-11 14:38:52.476
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-11 14:28:50.591
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU 2020M @ 2.40GHz
Percentage of memory in use: 67%
Total physical RAM: 1627.15 MB
Available physical RAM: 535.36 MB
Total Pagefile: 5979.15 MB
Available Pagefile: 1656.51 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.09 GB) (Free:249.92 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 00A9EB1E)
Partition 1: (Active) - (Size=1 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=297.1 GB) - (Type=07 NTFS)

==================== End of log ============================

--- --- ---

premmarga · 13.06.2015, 21:13

hier noch die logs von Malwarebytes und von avast, ich hatte schon einen startscan gemacht:

Code:

ATTFilter

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/06/12 15:17:21 +0200</date>
<logfile>mbam-log-2015-06-12 (15-17-18).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.01.6.1022</version>
<malware-database>v2015.06.12.03</malware-database>
<rootkit-database>v2015.06.02.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>Carmen</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>391828</objects>
<time>2210</time>
<processes>0</processes>
<modules>0</modules>
<keys>4</keys>
<values>0</values>
<datas>0</datas>
<folders>12</folders>
<files>164</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\Advanced System Protector</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>be159920513978beb1faef2338ccbd43</hash></key>
<key><path>HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\ssd</path><vendor>PUP.Optional.SystemSpeedup</vendor><action>success</action><hash>4c87ab0e7e0cf83e60b46eae7b89d52b</hash></key>
<key><path>HKU\S-1-5-18\SOFTWARE\AskPartnerNetwork</path><vendor>PUP.Optional.APNToolBar.Gen</vendor><action>success</action><hash>9f3400b9bdcdef47ae90905d0ef532ce</hash></key>
<key><path>HKU\S-1-5-21-4062042949-3846255169-451896970-1002\SOFTWARE\SYSTWEAK\Advanced System Protector</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>1fb4f3c61b6f9e982686ee24867ec43c</hash></key>
<folder><path>C:\Users\Carmen\AppData\Roaming\Systweak\ssd</path><vendor>PUP.Optional.SystemSpeedup</vendor><action>success</action><hash>05cedcddc7c30c2ab1d027a6fb08dc24</hash></folder>
<folder><path>C:\ProgramData\Systweak\Advanced System Protector</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></folder>
<folder><path>C:\ProgramData\Systweak\Advanced System Protector\2.1.1000.13665</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></folder>
<folder><path>C:\ProgramData\Systweak\Advanced System Protector\signatures</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></folder>
<folder><path>C:\ProgramData\Systweak\Advanced System Protector\updates</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></folder>
<folder><path>C:\Users\carmen-lokal\AppData\Roaming\Systweak\Advanced System Protector</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>b51e6f4a96f493a3583ee0f350b354ac</hash></folder>
<folder><path>C:\Users\carmen-lokal\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.12580</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>b51e6f4a96f493a3583ee0f350b354ac</hash></folder>
<folder><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></folder>
<folder><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.12580</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></folder>
<folder><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.13665</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></folder>
<folder><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></folder>
<folder><path>C:\ProgramData\APN\APN-Stub</path><vendor>PUP.Optional.APNToolBar.Gen</vendor><action>success</action><hash>2ca761589deddd594fd1925a7d86c33d</hash></folder>
<file><path>C:\Windows\System32\roboot64.exe</path><vendor>PUP.Optional.RegCleanPro.C</vendor><action>success</action><hash>d0031d9c1a7068ceb741730717efd030</hash></file>
<file><path>C:\Windows\System32\sasnative64.exe</path><vendor>PUP.Optional.AdvancedSystemProtector</vendor><action>success</action><hash>cd065069becce94dc1be904316eb19e7</hash></file>
<file><path>C:\Windows\System32\Tasks\Advanced System Protector_startup</path><vendor>PUP.Optional.AdvancedSystemProtector</vendor><action>success</action><hash>359e54650d7dab8bd491f12463a1837d</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\ssd\SSDPTstub.exe</path><vendor>PUP.Optional.SystemSpeedup</vendor><action>success</action><hash>05cedcddc7c30c2ab1d027a6fb08dc24</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\AddonSafelist</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\log.xslt</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\completedatabase.db</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\Cookies.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\DigSign.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\FilePaths.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\FileSignature.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\Folders.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\Md5.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\Registry.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\SetupSign.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\signatures\StrSetupSign.bin</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\100oupdate.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1835completedatabase.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1870mupdate.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1871update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1872update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1873update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1874update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1875update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1876update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1877update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1878update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1879update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1880update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1881update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1882update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1883update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1884update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1885update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1886update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1887update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1888update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1889update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1890update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1891update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1892update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1893update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1894update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1895update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1896update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1897update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1898update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1899update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1900update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1901update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1902update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1903update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1904update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1905update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1906update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1907update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1908update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1909update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1910update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1911update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1912update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1913update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1914update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1915update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1916update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1917update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1918update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1919update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1920update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1921update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1922update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1923update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1924update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1925update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1926update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1927update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1928update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1929update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1930update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1931update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1932update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1933update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1934update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1935update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1936update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1937update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1938update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1939update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1940update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1941update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1942update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1943update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1944update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1945update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1946update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1947update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1948update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1949update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1950update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1951update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1952update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1953update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1954update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1955update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1956update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1957update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1958update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1959update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1960update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1961update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1962update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1963update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1964update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1965update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1966update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1967update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1968update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1969update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1971completedatabase.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1972update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1973update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1974update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1975update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1976update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1977update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1978update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1979update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1980update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1981update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1982update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1983update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1984update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\ProgramData\Systweak\Advanced System Protector\updates\1985update.zip</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>8d46f8c1365470c6375f09caf80b3ec2</hash></file>
<file><path>C:\Users\carmen-lokal\AppData\Roaming\Systweak\Advanced System Protector\Settings.db</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>b51e6f4a96f493a3583ee0f350b354ac</hash></file>
<file><path>C:\Users\carmen-lokal\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.12580\ASPLog.txt</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>b51e6f4a96f493a3583ee0f350b354ac</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\ASPStartupManagerErrorLog.txt</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\QDetail.db</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Settings.db</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Update.ini</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.12580\ASPLog.txt</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.13665\ASPLog.txt</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_18-08-14_06-20-54.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_12-08-14_12-14-13.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_12-08-14_12-54-45.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_13-07-14_05-14-26.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_13-08-14_11-46-07.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_14-08-14_11-02-11.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_16-08-14_05-30-09.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_16-08-14_06-11-57.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_16-08-14_06-53-54.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_16-08-14_07-35-30.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_16-08-14_08-17-32.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_18-08-14_03-42-05.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_18-08-14_04-24-09.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_18-08-14_05-04-33.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_18-08-14_06-59-35.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_20-08-14_01-14-10.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_20-08-14_01-51-26.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_20-08-14_02-34-02.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_20-08-14_12-36-48.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\log_28-08-14_05-32-10.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Systweak\Advanced System Protector\Logs\SMLog.xml</path><vendor>PUP.Optional.AdvancedSystemProtector.A</vendor><action>success</action><hash>09cad9e08dfd94a21d79d00335ce0ff1</hash></file>
<file><path>C:\Users\carmen-lokal\AppData\Roaming\Mozilla\Firefox\Profiles\gwzwbqbj.default\prefs.js</path><vendor>PUP.Optional.ASK.A</vendor><action>replaced</action><baddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&amp;o=APN11464&amp;pf=V7&amp;trgb=FF&amp;p2=%5EBEA%5EOSJ000%5EYY%5EDE&amp;gct=hp&amp;apn_ptnrs=BEA&amp;apn_dtid=%5EOSJ000%5EYY%5EDE&amp;apn_dbr=ff_32.0.1.5367&amp;apn_uid=913C7D7A-B5BE-4BB1-A4DC-9E320A5C1A04&amp;itbv=12.15.5.31&amp;doi=2014-09-15&amp;psv=&amp;pt=tb&quot;);</baddata><gooddata></gooddata><hash>dff40dac4941ad89ab3c97e8a56145bb</hash></file>
<file><path>C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\mwm5x373.default\prefs.js</path><vendor>PUP.Optional.ASK.A</vendor><action>replaced</action><baddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;hxxp://www.search.ask.com/?tpid=ORJ-ST-SPE&amp;o=APN11464&amp;pf=V7&amp;trgb=FF&amp;p2=%5EBEA%5EOSJ000%5EYY%5EDE&amp;gct=hp&amp;apn_ptnrs=BEA&amp;apn_dtid=%5EOSJ000%5EYY%5EDE&amp;apn_dbr=ff_32.0.1.5367&amp;apn_uid=913C7D7A-B5BE-4BB1-A4DC-9E320A5C1A04&amp;itbv=12.15.5.31&amp;doi=2014-09-15&amp;psv=&amp;pt=tb&quot;);</baddata><gooddata></gooddata><hash>478c91286921ae88ad3a7d0224e28c74</hash></file>
</items>
</mbam-log>

Code:

ATTFilter

08.06.2015	09:08:49	RefreshStaticAccountData thr. 1332
08.06.2015	09:08:52	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
08.06.2015	09:08:52	[000004A8] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
08.06.2015	09:09:09	[000004A8] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
08.06.2015	09:09:53	RefreshStaticAccountData thr. 1444
08.06.2015	09:09:57	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
08.06.2015	09:09:57	[00000664] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
08.06.2015	09:10:19	[00000664] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
08.06.2015	09:10:21	[00000664] UpdateStatus AV OK status 0 sign 1
08.06.2015	09:10:21	[00000664] WaitForWscService( 837 ) -> true, SCM OK wsc OK err 0
08.06.2015	09:10:21	[00000664] UpdateStatus AS OK status 0 sign 1
08.06.2015	15:29:23	RefreshStaticAccountData thr. 1416
08.06.2015	15:29:43	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
08.06.2015	15:29:43	[00000408] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
08.06.2015	15:30:41	Browser Cleanup: Cannot load dynamic library bcuengine.dll 00000013
08.06.2015	15:31:34	RefreshStaticAccountData thr. 1440
08.06.2015	15:31:40	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
08.06.2015	15:31:40	[0000084C] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
08.06.2015	15:33:28	[0000084C] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
08.06.2015	15:33:53	[0000084C] UpdateStatus AV OK status 0 sign 1
08.06.2015	15:33:53	[0000084C] WaitForWscService( 794 ) -> true, SCM OK wsc OK err 0
08.06.2015	15:33:53	[0000084C] UpdateStatus AS OK status 0 sign 1
09.06.2015	19:24:05	RefreshStaticAccountData thr. 444
09.06.2015	19:24:35	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
09.06.2015	19:24:35	[00000CD8] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
09.06.2015	19:26:20	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
09.06.2015	19:26:20	[0000041C] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
09.06.2015	19:26:29	[00000CD8] WaitForWscService( 838 ) -> true, SCM OK wsc OK err 0
09.06.2015	19:26:42	[00000CD8] UpdateStatus AV OK status 0 sign 1
09.06.2015	19:26:42	[00000CD8] WaitForWscService( 820 ) -> true, SCM OK wsc OK err 0
09.06.2015	19:26:42	[00000CD8] UpdateStatus AS OK status 0 sign 1
09.06.2015	19:26:42	[0000041C] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
09.06.2015	19:26:42	[0000041C] UpdateStatus AV OK status 0 sign 1
09.06.2015	19:26:42	[0000041C] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
09.06.2015	19:26:42	[0000041C] UpdateStatus AS OK status 0 sign 1
11.06.2015	11:09:07	RefreshStaticAccountData thr. 2572
11.06.2015	11:21:09	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
11.06.2015	11:21:09	[00001644] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
11.06.2015	11:21:09	[00001644] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
11.06.2015	11:21:14	[00001644] UpdateStatus AV OK status 0 sign 1
11.06.2015	11:21:14	[00001644] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
11.06.2015	11:21:14	[00001644] UpdateStatus AS OK status 0 sign 1
11.06.2015	14:26:53	RefreshStaticAccountData thr. 1428
11.06.2015	14:26:58	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
11.06.2015	14:26:58	[000006E8] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
11.06.2015	14:28:56	[000006E8] WaitForWscService( 837 ) -> true, SCM OK wsc OK err 0
11.06.2015	14:29:09	[000006E8] UpdateStatus AV OK status 0 sign 1
11.06.2015	14:29:09	[000006E8] WaitForWscService( 818 ) -> true, SCM OK wsc OK err 0
11.06.2015	14:29:09	[000006E8] UpdateStatus AS OK status 0 sign 1
11.06.2015	14:36:49	RefreshStaticAccountData thr. 1424
11.06.2015	14:36:54	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
11.06.2015	14:36:54	[00000658] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
11.06.2015	14:38:57	[00000658] WaitForWscService( 838 ) -> true, SCM OK wsc OK err 0
11.06.2015	14:39:04	[00000658] UpdateStatus AV OK status 0 sign 1
11.06.2015	14:39:04	[00000658] WaitForWscService( 828 ) -> true, SCM OK wsc OK err 0
11.06.2015	14:39:04	[00000658] UpdateStatus AS OK status 0 sign 1
12.06.2015	12:54:11	RefreshStaticAccountData thr. 1392
12.06.2015	12:54:14	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
12.06.2015	12:54:14	[00000618] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
12.06.2015	12:55:56	[00000618] WaitForWscService( 838 ) -> true, SCM OK wsc OK err 0
12.06.2015	12:56:07	[00000618] UpdateStatus AV OK status 0 sign 1
12.06.2015	12:56:07	[00000618] WaitForWscService( 819 ) -> true, SCM OK wsc OK err 0
12.06.2015	12:56:07	[00000618] UpdateStatus AS OK status 0 sign 1
12.06.2015	12:57:08	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
12.06.2015	12:57:08	[00001224] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
12.06.2015	12:57:08	[00001224] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
12.06.2015	12:57:08	[00001224] UpdateStatus AV OK status 0 sign 1
12.06.2015	12:57:08	[00001224] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
12.06.2015	12:57:08	[00001224] UpdateStatus AS OK status 0 sign 1
12.06.2015	13:22:03	RefreshStaticAccountData thr. 1372
12.06.2015	13:22:37	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
12.06.2015	13:22:37	[00000A7C] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
12.06.2015	13:22:38	[00000A7C] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
12.06.2015	13:22:39	[00000A7C] UpdateStatus AV OK status 0 sign 1
12.06.2015	13:22:39	[00000A7C] WaitForWscService( 838 ) -> true, SCM OK wsc OK err 0
12.06.2015	13:22:39	[00000A7C] UpdateStatus AS OK status 0 sign 1
12.06.2015	15:58:37	RefreshStaticAccountData thr. 1352
12.06.2015	16:00:26	RefreshStaticAccountData thr. 1384
12.06.2015	16:02:11	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
12.06.2015	16:02:11	[00000B90] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
12.06.2015	16:02:12	[00000B90] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
12.06.2015	16:02:14	[00000B90] UpdateStatus AV OK status 0 sign 1
12.06.2015	16:02:14	[00000B90] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
12.06.2015	16:02:14	[00000B90] UpdateStatus AS OK status 0 sign 1
12.06.2015	16:07:47	RefreshStaticAccountData thr. 1352
13.06.2015	08:56:35	RefreshStaticAccountData thr. 1364
13.06.2015	19:04:58	RefreshStaticAccountData thr. 1368
13.06.2015	19:06:03	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
13.06.2015	19:06:03	[00000A80] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
13.06.2015	19:06:03	[00000A80] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
13.06.2015	19:06:06	[00000A80] UpdateStatus AV OK status 0 sign 1
13.06.2015	19:06:06	[00000A80] WaitForWscService( 837 ) -> true, SCM OK wsc OK err 0
13.06.2015	19:06:06	[00000A80] UpdateStatus AS OK status 0 sign 1
13.06.2015	19:17:15	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
13.06.2015	19:17:15	[00000D48] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
13.06.2015	19:17:15	[00000D48] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
13.06.2015	19:17:18	[00000D48] UpdateStatus AV OK status 0 sign 1
13.06.2015	19:17:18	[00000D48] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
13.06.2015	19:17:18	[00000D48] UpdateStatus AS OK status 0 sign 1
13.06.2015	21:33:02	RefreshStaticAccountData thr. 1336
13.06.2015	21:34:53	RefreshStaticAccountData thr. 1124
13.06.2015	21:34:53	RefreshStaticAccountData thr. 1928
13.06.2015	21:34:55	RefreshStaticAccountData thr. 1124
13.06.2015	21:34:55	RefreshStaticAccountData thr. 1124
13.06.2015	21:34:55	RefreshStaticAccountData thr. 1336
13.06.2015	21:34:55	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
13.06.2015	21:34:55	[000009F0] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
13.06.2015	21:34:56	RefreshStaticAccountData thr. 2480
13.06.2015	21:34:56	StartBrowserCleanup: BCU Component is not installed
13.06.2015	21:34:56	StartPatchManagement: ASU Component is not installed
13.06.2015	21:34:56	RefreshStaticAccountData thr. 1124
13.06.2015	21:35:33	RefreshStaticAccountData thr. 1380
13.06.2015	21:36:24	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
13.06.2015	21:36:24	[00000A28] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
13.06.2015	21:36:24	[00000A28] WaitForWscService( 839 ) -> true, SCM OK wsc OK err 0
13.06.2015	21:36:27	[00000A28] UpdateStatus AV OK status 0 sign 1
13.06.2015	21:36:27	[00000A28] WaitForWscService( 836 ) -> true, SCM OK wsc OK err 0
13.06.2015	21:36:27	[00000A28] UpdateStatus AS OK status 0 sign 1
13.06.2015	21:37:16	Maj 6 Min 2 GetVersionEx 6.2 Stored 6.2
13.06.2015	21:37:16	[00000948] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin81 ExpPrg 0 Fw 0 Fs 1
13.06.2015	21:37:16	[00000948] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
13.06.2015	21:37:16	[00000948] UpdateStatus AV OK status 0 sign 1
13.06.2015	21:37:16	[00000948] WaitForWscService( 840 ) -> true, SCM OK wsc OK err 0
13.06.2015	21:37:16	[00000948] UpdateStatus AS OK status 0 sign 1

cosinus · 14.06.2015, 13:32

Zitat:

Processor: Intel(R) Pentium(R) CPU 2020M @ 2.40GHz
Percentage of memory in use: 67%
Total physical RAM: 1627.15 MB

Bei fast 10 Jahre alter Hardware muss sich nun wirklich keiner wundern, dass aktuelle Windows-Versionen nicht wie ne Rakete auf dem Rechner laufen...

premmarga · 14.06.2015, 18:21

Also ich weiss das der pc nicht zu dick mit ram geschmückt ist. und der cpu nicht der neueste ist. Aber trotzdem ist der pc erst vor 2 Jahren neugekauft.

Aber mein anliegen ist ja eigentlich nciht die schnelligkeit, sondern die meldung von kaspersky.

Kannst du mir sagen ob der pc verseucht ist mit diesen trojaner. Oder fällt dir was anderes auf.

Das wäre hilfreich und nett..
Danke

cosinus · 14.06.2015, 18:49

edit: sry hab mich vertan, hab hier irgendwie was mit Pentium4 gelesen. Aber der RAM ist wirklich sehr wenig...

Zitat:

Kannst du mir sagen ob der pc verseucht ist mit diesen trojaner. Oder fällt dir was anderes auf.

Adware/Junkware/Toolbars entfernen

1. Schritt: Malwarebytes

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

2. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

3. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

4. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

premmarga · 14.06.2015, 20:20

Hier sind die log dateien, aber ich glaube die haben nichts gefunden.
ABer ich kann die ja auch nicht echt einschätzen.
Komisch das die kaspersky rescue disk 10 diesen trojaner gefunden hat.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 14.06.2015
Suchlauf-Zeit: 20:10:31
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.14.05
Rootkit Datenbank: v2015.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Carmen

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 392519
Verstrichene Zeit: 27 Min, 19 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Code:

ATTFilter

# AdwCleaner v4.206 - Bericht erstellt 14/06/2015 um 20:47:54
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-14.1 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Carmen - LENOVONOTEBOOK
# Gestarted von : C:\Users\Carmen\Desktop\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\Program Files (x86)\Advanced System Protector
Ordner Gelöscht : C:\Users\Carmen\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Carmen\AppData\Roaming\rightbackup
Ordner Gelöscht : C:\Users\Carmen\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\carmen-lokal\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd
Datei Gelöscht : C:\Users\carmen-lokal\AppData\Roaming\Mozilla\Firefox\Profiles\gwzwbqbj.default\searchplugins\ask-search.xml

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v38.0.5 (x86 de)


-\\ Google Chrome v43.0.2357.124


*************************

AdwCleaner[R0].txt - [2029 Bytes] - [14/06/2015 20:43:39]
AdwCleaner[S0].txt - [1949 Bytes] - [14/06/2015 20:47:54]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2008  Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.9.5 (06.14.2015:1)
OS: Windows 8.1 x64
Ran by Carmen on 14.06.2015 at 20:55:52,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\Driver Booster SkipUAC (Carmen)



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\Carmen\AppData\Roaming\productdata



~~~ FireFox




~~~ Chrome


[C:\Users\Carmen\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Carmen\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Carmen\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Carmen\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.06.2015 at 21:02:42,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by Carmen (administrator) on LENOVONOTEBOOK on 14-06-2015 21:06:12
Running from C:\Users\Carmen\Desktop
Loaded Profiles: Carmen (Available Profiles: Carmen & carmen-lokal)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\InstallServices64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-27] (Avast Software s.r.o.)
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)
Startup: C:\Users\Carmen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4630 series.lnk [2014-11-30]
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4630 series.lnk -> C:\Program Files\HP\HP Officejet 4630 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-27] (Avast Software s.r.o.)
CHR HKU\S-1-5-21-4062042949-3846255169-451896970-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4062042949-3846255169-451896970-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-17] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-01] (Google Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-12] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-17] (Avast Software s.r.o.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-01] (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-12] (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-01] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-01] (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\mwm5x373.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_160.dll [2015-06-12] ()
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-12] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-23]

Chrome: 
=======
CHR Profile: C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-23]
CHR Extension: (Google Drive) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-23]
CHR Extension: (YouTube) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-23]
CHR Extension: (Google Search) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-23]
CHR Extension: (Avast Online Security) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-11-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-07]
CHR Extension: (Google Wallet) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-05]
CHR Extension: (Gmail) - C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-23]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-27] (Avast Software s.r.o.)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2585376 2015-03-26] (IObit)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 StartMenuService; C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe [72512 2013-12-09] (IObit)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-27] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-27] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-27] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-27] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-27] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-27] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-27] ()
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-01-13] (REALiX(tm))
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-14 21:06 - 2015-06-14 21:06 - 00011414 _____ C:\Users\Carmen\Desktop\FRST.txt
2015-06-14 21:02 - 2015-06-14 21:02 - 00001300 _____ C:\Users\Carmen\Desktop\JRT.txt
2015-06-14 20:56 - 2015-06-14 20:56 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LENOVONOTEBOOK-Windows-8.1-(64-bit).dat
2015-06-14 20:56 - 2015-06-14 20:56 - 00000000 ____D C:\RegBackup
2015-06-14 20:54 - 2015-06-14 20:54 - 02944147 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2015-06-14 20:51 - 2015-06-14 20:51 - 00002088 _____ C:\Users\Carmen\Desktop\AdwCleaner[S0].txt
2015-06-14 20:43 - 2015-06-14 20:51 - 00000000 ____D C:\AdwCleaner
2015-06-14 20:40 - 2015-06-14 20:41 - 02231296 _____ C:\Users\Carmen\Desktop\AdwCleaner_4.206.exe
2015-06-14 20:39 - 2015-06-14 20:39 - 00001199 _____ C:\Users\Carmen\Desktop\mbam.txt
2015-06-13 21:56 - 2015-06-14 21:06 - 00000000 ____D C:\FRST
2015-06-13 21:55 - 2015-06-13 21:55 - 02109952 _____ (Farbar) C:\Users\Carmen\Desktop\FRST64.exe
2015-06-12 15:16 - 2015-06-14 20:10 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-12 15:15 - 2015-06-12 15:15 - 00001114 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-12 15:15 - 2015-06-12 15:15 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-12 15:15 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-12 15:15 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-12 15:15 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-12 15:08 - 2015-06-12 15:09 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Carmen\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-12 14:53 - 2015-06-12 14:53 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-06-12 14:52 - 2015-06-12 14:52 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-12 14:42 - 2015-06-12 14:42 - 01124072 _____ (Adobe Systems Incorporated) C:\Users\Carmen\Downloads\readerdc_de_ha_install.exe
2015-06-12 14:38 - 2015-06-12 14:38 - 00562784 _____ (Oracle Corporation) C:\Users\Carmen\Downloads\jre-8u45-windows-i586-iftw.exe
2015-06-12 14:29 - 2015-06-14 20:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-12 14:29 - 2015-06-12 14:29 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-12 13:59 - 2015-06-12 13:59 - 00000000 ____D C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-06-09 21:04 - 2015-04-25 04:34 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-09 21:04 - 2015-04-25 04:33 - 00549888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-09 21:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 21:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-09 21:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-09 21:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-09 21:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-09 21:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-09 21:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-09 21:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-09 21:03 - 2015-05-23 04:47 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-06-09 21:03 - 2015-05-23 04:43 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-06-09 21:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-09 21:03 - 2015-05-23 04:38 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-09 21:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-09 21:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-09 21:03 - 2015-05-23 04:28 - 01042944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2015-06-09 21:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-09 21:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-09 21:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 21:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 21:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 21:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 21:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 21:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-09 21:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 21:03 - 2015-05-22 20:23 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-06-09 21:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 21:03 - 2015-05-22 20:15 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-06-09 21:03 - 2015-05-22 20:09 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-06-09 21:03 - 2015-05-22 20:08 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-09 21:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 21:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 21:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 21:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 21:03 - 2015-05-22 19:49 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-06-09 21:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 21:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-09 21:03 - 2015-05-21 18:47 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-08 09:16 - 2015-06-08 15:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-06-08 09:08 - 2015-06-14 20:49 - 00002088 _____ C:\Windows\setupact.log
2015-06-08 09:08 - 2015-06-13 21:32 - 00057160 _____ C:\Windows\PFRO.log
2015-06-08 09:08 - 2015-06-08 09:08 - 00000000 _____ C:\Windows\setuperr.log
2015-06-07 21:46 - 2015-06-08 11:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 17:57 - 2015-06-02 17:57 - 00000000 ____D C:\Users\Carmen\AppData\Local\GWX
2015-05-30 15:46 - 2015-05-30 15:46 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2015-05-30 15:46 - 2015-05-30 15:46 - 01018880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2015-05-30 15:46 - 2015-05-30 15:46 - 00410336 _____ C:\Windows\system32\ApnDatabase.xml
2015-05-30 15:46 - 2015-05-30 15:46 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rgb9rast.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 02483712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\authz.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rastapi.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2015-05-30 15:45 - 2015-05-30 15:45 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authz.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 03633664 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00468480 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2015-05-30 15:44 - 2015-05-30 15:44 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00325464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2015-05-30 15:44 - 2015-05-30 15:44 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2015-05-30 15:44 - 2015-05-30 15:44 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 18823168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 15158784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 04837376 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 02485056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 01454080 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 01154048 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 01142272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 01084416 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 01027584 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00962216 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00952896 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00885760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 00801584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00786120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00733696 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00702464 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00657920 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00624640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00551232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00514048 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00473408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2015-05-30 15:43 - 2015-05-30 15:43 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00182784 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00169984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00155648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00136512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00128512 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2015-05-30 15:43 - 2015-05-30 15:43 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\i8042prt.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\agilevpn.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2015-05-30 15:43 - 2015-05-30 15:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\vsstrace.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00059712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdclass.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00058176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vsstrace.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00051008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouclass.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2015-05-30 15:43 - 2015-05-30 15:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00039744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2015-05-30 15:43 - 2015-05-30 15:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouhid.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sermouse.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2015-05-30 15:43 - 2015-05-30 15:43 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\eventcls.dll
2015-05-30 15:43 - 2015-05-30 15:43 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eventcls.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 00672984 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2015-05-30 15:39 - 2015-05-30 15:39 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.Handlers.dll
2015-05-30 15:39 - 2015-05-30 15:39 - 00273240 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2015-05-27 12:14 - 2015-05-27 12:14 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-05-27 12:14 - 2015-05-27 12:14 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-05-19 16:50 - 2015-05-19 16:40 - 00031478 _____ C:\Users\Carmen\Documents\Fobi%20Schmerz%2024.1.12.doc_0.odt
2015-05-16 21:55 - 2015-06-03 18:18 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-16 21:55 - 2015-06-03 18:18 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-16 21:28 - 2015-05-16 21:28 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-05-16 21:28 - 2015-05-16 21:28 - 00000000 ____D C:\Windows\system32\appraiser
2015-05-16 19:24 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 19:24 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 19:20 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-16 19:20 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-16 19:20 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-16 19:20 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-16 19:20 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-16 19:20 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-16 19:19 - 2015-03-13 06:03 - 00239424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-16 19:19 - 2015-03-13 06:03 - 00154432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-16 19:19 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-16 19:19 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-16 19:19 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-16 19:19 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-14 21:00 - 2013-11-23 22:56 - 01135735 _____ C:\Windows\WindowsUpdate.log
2015-06-14 21:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-06-14 20:54 - 2013-11-23 16:02 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4062042949-3846255169-451896970-1001
2015-06-14 20:50 - 2013-11-23 16:09 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-14 20:49 - 2014-03-30 19:56 - 00165659 _____ C:\MyXML.xml
2015-06-14 20:49 - 2013-11-27 16:40 - 00000000 ____D C:\ProgramData\Kodak
2015-06-14 20:49 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-14 20:48 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-06-14 20:46 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-06-14 20:16 - 2013-11-23 16:09 - 00001148 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-14 20:08 - 2013-11-23 16:02 - 00003958 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{071E09A8-05A5-4E8C-9806-1724AC596E7B}
2015-06-13 22:17 - 2013-11-23 22:57 - 00000000 ____D C:\Users\Carmen\AppData\Local\Packages
2015-06-13 22:17 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-06-13 19:15 - 2013-11-23 16:12 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-06-12 14:59 - 2014-07-01 13:47 - 00000000 ____D C:\Users\Carmen\AppData\Local\Adobe
2015-06-12 14:54 - 2014-12-25 19:31 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-12 14:52 - 2013-11-23 17:42 - 00000000 ____D C:\ProgramData\Adobe
2015-06-12 14:44 - 2013-11-25 15:36 - 00000000 ____D C:\ProgramData\Oracle
2015-06-12 14:43 - 2014-11-06 16:51 - 00000000 ____D C:\Program Files (x86)\Java
2015-06-12 14:40 - 2014-11-06 16:52 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-06-12 14:36 - 2013-11-23 16:30 - 00000000 ____D C:\Windows\system32\MRT
2015-06-12 14:30 - 2013-11-23 16:30 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-12 14:00 - 2013-11-23 17:46 - 00000000 ____D C:\Program Files (x86)\IObit
2015-06-12 13:59 - 2013-11-23 17:49 - 00000000 ____D C:\Users\Carmen\AppData\Roaming\IObit
2015-06-12 13:59 - 2013-11-23 17:47 - 00000000 ____D C:\ProgramData\IObit
2015-06-12 13:55 - 2013-11-27 18:32 - 00000000 ____D C:\ProgramData\Ashampoo
2015-06-12 13:54 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2015-06-12 13:21 - 2013-08-22 16:44 - 00362760 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-12 13:18 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 11:14 - 2014-10-10 16:39 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4062042949-3846255169-451896970-1002
2015-06-09 19:51 - 2014-02-18 10:59 - 00000000 ____D C:\Users\Carmen\Documents\Silberstreif
2015-06-08 11:17 - 2013-11-25 15:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-30 15:50 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\setup
2015-05-30 15:50 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\setup
2015-05-30 15:49 - 2013-11-23 22:56 - 00000000 ____D C:\Users\Carmen
2015-05-30 15:39 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2015-05-30 15:31 - 2013-11-23 22:58 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI
2015-05-30 15:31 - 2013-08-23 01:24 - 00765582 _____ C:\Windows\system32\perfh007.dat
2015-05-30 15:31 - 2013-08-23 01:24 - 00159366 _____ C:\Windows\system32\perfc007.dat
2015-05-27 12:14 - 2014-05-15 22:04 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys
2015-05-27 12:14 - 2014-01-09 17:02 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-27 12:14 - 2013-11-23 16:09 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-21 15:09 - 2015-04-04 21:34 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-21 15:09 - 2015-04-04 21:34 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-16 21:58 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppCompat
2015-05-16 21:28 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-16 19:11 - 2013-11-23 16:09 - 00004120 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 19:11 - 2013-11-23 16:09 - 00003884 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 19:05 - 2013-08-23 01:26 - 00000000 ____D C:\Program Files\Windows Journal

==================== Files in the root of some directories =======

2013-11-27 17:00 - 2013-11-27 17:00 - 0000236 _____ () C:\Users\Carmen\AppData\Local\LaunchHomeCenter.log
2014-11-30 21:13 - 2014-11-30 21:13 - 0000057 _____ () C:\ProgramData\Ament.ini

Some files in TEMP:
====================
C:\Users\Carmen\AppData\Local\Temp\Quarantine.exe
C:\Users\Carmen\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-12 13:12

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

ATTFilter

scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Carmen at 2015-06-14 21:07:52
Running from C:\Users\Carmen\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4062042949-3846255169-451896970-500 - Administrator - Disabled)
Carmen (S-1-5-21-4062042949-3846255169-451896970-1001 - Administrator - Enabled) => C:\Users\Carmen
carmen-lokal (S-1-5-21-4062042949-3846255169-451896970-1002 - Limited - Enabled) => C:\Users\carmen-lokal
Gast (S-1-5-21-4062042949-3846255169-451896970-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.160 - Adobe Systems Incorporated)
aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 5.8.10.0 - Your Company Name) Hidden
aioscnnr (x32 Version: 7.6.13.10 - Your Company Name) Hidden
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden
center (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden
Dropbox (HKU\S-1-5-21-4062042949-3846255169-451896970-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
essentials (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.0 - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 4630 series - Grundlegende Software für das Gerät (HKLM\...\{3566FFED-696A-4260-8F12-073426CAC951}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet 4630 series Hilfe (HKLM-x32\...\{08B9332C-26DB-4EF3-85D6-6DC62B937681}) (Version: 31.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden
KODAK All-in-One Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden
PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)
Start Menu 8 (HKLM-x32\...\IObit_StartMenu8_is1) (Version: 1.4.0.0 - IObit)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.11.90 - Akademische Arbeitsgemeinschaft)
Studie zur Verbesserung von HP Officejet 4630 series (HKLM\...\{3917CF9F-DF46-406E-B524-CA0F150C70D7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4062042949-3846255169-451896970-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Carmen\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

26-05-2015 16:08:32 Windows Update
30-05-2015 15:05:50 Windows Update
02-06-2015 18:18:48 Windows Update
07-06-2015 21:43:06 Windows Update
12-06-2015 13:13:05 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01071E8A-196C-4FC2-8D1F-02E29E5A95CC} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {494B521B-9EA1-47B3-BB06-B2B988CAE8CB} - \Driver Booster SkipUAC (Carmen) No Task File <==== ATTENTION
Task: {4DE6CC7E-5A1C-427C-9EC2-70F1FF4DCBDD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {51408F7D-B57F-46EF-8F2F-575E0EF5F919} - System32\Tasks\StartMenuAutoupdate => C:\Program Files (x86)\IObit\Start Menu 8\AutoUpdate.exe [2013-12-09] (IObit)
Task: {6B71E448-A040-4B58-81AE-4E01A0A8A07E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {6FCB4406-B284-4E22-95EA-86735ACAAD9A} - System32\Tasks\HP AR Program Upload - 71791f773cb74245877fb7872668eb0d5568422fbe56404392d5b8b564653d58 => C:\Program Files\HP\HP Officejet 4630 series\bin\HPRewards.exe [2014-07-21] (TODO: <Company name>)
Task: {727D079F-8555-46CF-B519-CFA574014280} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.)
Task: {78A3EFEC-E889-4129-A5B5-7827ECE93771} - System32\Tasks\HPCustParticipation HP Officejet 4630 series => C:\Program Files\HP\HP Officejet 4630 series\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {7BBE5662-36C3-4FC5-88EA-89D8D2215F4C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {8DCC6ADF-CFCE-4C99-BC5F-B8AB29B43A31} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-27] (Avast Software s.r.o.)
Task: {9A7CA00A-4638-45C9-9A0A-CC6D666B2871} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {A2FB962E-6475-4112-9FB7-F527DE05941A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-06-12] (Microsoft Corporation)
Task: {BB1A2575-C2D2-4744-AE3A-3CAE8E60BB41} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {C33BDAE4-C93B-4B23-B4CD-3757EDEF725F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.)
Task: {CE3907C9-0643-426C-88D8-EEF46C38C4DE} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {E52C6300-B098-4188-8DF1-34041570313A} - System32\Tasks\avastBCLRestartS-1-5-21-4062042949-3846255169-451896970-1001 => Firefox.exe 
Task: {F5D801C2-BF00-458C-8269-C8A0B6248911} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-05-27 12:14 - 2015-05-27 12:14 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-27 12:14 - 2015-05-27 12:14 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-06-14 20:07 - 2015-06-14 20:07 - 02954752 _____ () C:\Program Files\AVAST Software\Avast\defs\15061401\algo.dll
2013-11-23 17:46 - 2013-12-09 16:10 - 00348992 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madExcept_.bpl
2013-11-23 17:46 - 2013-12-09 16:10 - 00183616 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madBasic_.bpl
2013-11-23 17:46 - 2013-12-09 16:10 - 00051008 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madDisAsm_.bpl
2015-03-16 11:49 - 2015-03-16 11:49 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4062042949-3846255169-451896970-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Carmen\Pictures\2013-12-24\IMG_0588.JPG
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{16F83C8C-E2B9-49C0-AF18-A43C156E521E}] => (Allow) LPort=5353
FirewallRules: [{5BDB590B-BE4B-4A94-8620-9DCCE661A7EB}] => (Allow) LPort=9322
FirewallRules: [{2DDBD328-3F1F-43BB-9D0D-B2D21857B5F6}] => (Allow) LPort=5353
FirewallRules: [TCP Query User{E85BBC39-3CFB-4E49-9E76-6C829CBFBD01}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{6801240D-2FDB-4387-958E-0E32BDD4F14D}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{6B2EFF5E-6163-4530-BE83-627BBC5D72BE}] => (Allow) LPort=9322
FirewallRules: [{EB7CB9E5-E045-4788-9149-A3388B1BE021}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
FirewallRules: [{364EB8DA-91AC-41FA-8A4D-BA8F12A61FD2}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
FirewallRules: [{40708F19-3A4B-40B0-ACF0-768E5B92BC1B}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe
FirewallRules: [{AA80B086-52C6-4B8A-9C00-7FCA87DEE5FD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe
FirewallRules: [{8E4C9FEE-D771-434E-A00A-F6DF3B61C516}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe
FirewallRules: [{EA2C697B-F9C2-4158-8235-6DF26E96B968}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe
FirewallRules: [{AA68AC6A-59FE-471F-9C20-A1C4044CC026}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe
FirewallRules: [{E098F6FF-8C74-463B-B0CF-EE1F08606F9E}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe
FirewallRules: [{0EA87165-32E7-482F-A5A2-9FEB7D341CA6}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe
FirewallRules: [{28E0E319-1EF0-4BF6-B355-CAB2C00494B6}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe
FirewallRules: [{6A6C69FB-AF82-423A-878A-2FA87FEB5170}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\FaxApplications.exe
FirewallRules: [{DC9A2DFA-8899-4C27-B575-448F5ECD26A0}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\DigitalWizards.exe
FirewallRules: [{45BE591D-9078-4636-BF10-8D02378F3824}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\bin\SendAFax.exe
FirewallRules: [{6B75A329-1768-48DF-9E21-287582AFCE18}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\DeviceSetup.exe
FirewallRules: [{2F3CE577-B3D4-4C67-8FB6-AC0C9B041666}] => (Allow) LPort=5357
FirewallRules: [{2B294CE4-6C27-4D8F-99E0-E8F40DA3ECE6}] => (Allow) C:\Program Files\HP\HP Officejet 4630 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{E25A3B22-2185-4B69-8EBF-154E08F2ED4D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DAE3DD82-043B-4BED-B2E8-5B44944D3EF0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{074EBD5E-114E-4E26-B11E-D59097B397C2}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{2FB1C4AF-825C-4DFC-AFB1-9605360D521A}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{CFB1083D-8688-4696-81E4-0778543C8AF8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/13/2015 09:33:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0xd8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fb8

Startzeit: 01d0a512c3aa3d6b

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: b889e8f2-1106-11e5-84c7-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexSports

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7c8

Startzeit: 01d0a512c3aa3d6b

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: b88a1002-1106-11e5-84c7-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingNews_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexNews

Error: (06/08/2015 09:09:11 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" konnte im Namespace "//./ROOT/SecurityCenter" aufgrund des Fehlers "0x80041033" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.

Error: (06/08/2015 09:09:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0x1d4
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1248

Startzeit: 01d0a15ef161b145

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: e4b0d680-0d52-11e5-84be-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 834

Startzeit: 01d0a15ef161b145

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: e46e13c3-0d52-11e5-84be-1c3e84e7b766

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingFinance_3.0.1.174_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexFinance

Error: (06/07/2015 09:10:01 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex (1424) WebCacheLocal: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Users\Carmen\AppData\Local\Microsoft\Windows\WebCache\V010000F.log.

Error: (06/02/2015 05:47:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_gpsvc, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfe3
Name des fehlerhaften Moduls: gpsvc.dll, Version: 6.3.9600.17238, Zeitstempel: 0x53d0c970
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000326b2
ID des fehlerhaften Prozesses: 0x164
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_gpsvc0
Pfad der fehlerhaften Anwendung: svchost.exe_gpsvc1
Pfad des fehlerhaften Moduls: svchost.exe_gpsvc2
Berichtskennung: svchost.exe_gpsvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_gpsvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_gpsvc5

Error: (05/30/2015 03:56:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: )
Description: Vom Kryptografiedienst konnte die Katalogdatenbank nicht initialisiert werden. "ESENT"-Fehler: -528.


System errors:
=============
Error: (06/14/2015 08:59:33 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Modules Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (06/14/2015 08:57:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/14/2015 08:57:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Kodak AiO Network Discovery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/14/2015 08:57:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "LiveUpdate" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/14/2015 08:57:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Kodak AiO Status Monitor Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/14/2015 08:57:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/14/2015 08:57:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AAV UpdateService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/14/2015 08:57:30 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/14/2015 08:50:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Defender-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (06/14/2015 08:48:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069


Microsoft Office:
=========================
Error: (06/13/2015 09:33:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b2d801d0a60fbc2dfe0fC:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dll07efc3ba-1203-11e5-84cd-1c3e84e7b766

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384fb801d0a512c3aa3d6b4294967295C:\Windows\system32\backgroundTaskHost.exeb889e8f2-1106-11e5-84c7-1c3e84e7b766Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbweAppexSports

Error: (06/12/2015 03:27:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.163847c801d0a512c3aa3d6b4294967295C:\Windows\system32\backgroundTaskHost.exeb88a1002-1106-11e5-84c7-1c3e84e7b766Microsoft.BingNews_3.0.1.174_x64__8wekyb3d8bbweAppexNews

Error: (06/08/2015 09:09:11 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT)
Description: //./ROOT/SecurityCenterSELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'0x80041033

Error: (06/08/2015 09:09:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b21d401d0a1b9f5084d09C:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dll3dbbbc76-0dad-11e5-84bf-1c3e84e7b766

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384124801d0a15ef161b1454294967295C:\Windows\system32\backgroundTaskHost.exee4b0d680-0d52-11e5-84be-1c3e84e7b766Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbweApp

Error: (06/07/2015 10:22:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.1638483401d0a15ef161b1454294967295C:\Windows\system32\backgroundTaskHost.exee46e13c3-0d52-11e5-84be-1c3e84e7b766Microsoft.BingFinance_3.0.1.174_x64__8wekyb3d8bbweAppexFinance

Error: (06/07/2015 09:10:01 PM) (Source: ESENT) (EventID: 455) (User: )
Description: taskhostex1424WebCacheLocal: C:\Users\Carmen\AppData\Local\Microsoft\Windows\WebCache\V010000F.log-1811 (0xfffff8ed)

Error: (06/02/2015 05:47:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_gpsvc6.3.9600.163845215dfe3gpsvc.dll6.3.9600.1723853d0c970c000000500000000000326b216401d09d4b5c11873dC:\Windows\system32\svchost.exec:\windows\system32\gpsvc.dlla5922704-093e-11e5-84bb-1c3e84e7b766

Error: (05/30/2015 03:56:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 257) (User: )
Description: -528


CodeIntegrity Errors:
===================================
  Date: 2015-06-14 20:50:16.612
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-14 19:14:29.517
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 21:36:18.367
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 21:34:51.161
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 19:05:58.410
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-13 08:57:31.439
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 16:08:43.008
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 16:01:58.036
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 13:22:28.724
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-06-12 12:55:50.686
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU 2020M @ 2.40GHz
Percentage of memory in use: 54%
Total physical RAM: 1627.15 MB
Available physical RAM: 736.55 MB
Total Pagefile: 5979.15 MB
Available Pagefile: 5006.25 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.09 GB) (Free:249.97 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 00A9EB1E)
Partition 1: (Active) - (Size=1 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=297.1 GB) - (Type=07 NTFS)

==================== End of log ============================

--- --- ---

cosinus · 14.06.2015, 21:15

Zitat:

Komisch das die kaspersky rescue disk 10 diesen trojaner gefunden hat.

Was ist daran komisch?
JEDER Virenscanner arbeitet anders, hat seine anderen Einstellungen. Wenn jeder Virenscanner dasselbe Ergebnis liefert, gäbe es ja überhaupt keine Unterschiede bei den Virenscannern. Außerdem lässt sich garnix sagen was du mit diesem Fund gemacht hast, du hast nur den Namen des angeblichen Fundes gepostet. Aber nicht Fundort und auch nicht was Kaspersky dann gemacht hat.

Hast du das Log von Kaspersky noch?

premmarga · 15.06.2015, 07:44

Ich habe dann diesen scan abgebrochen, als ich gesehen habe das kaspersky mich aufforderte den trojaner zu neutralisieren.

Aber ich werde jetzt noch mals den ganzen scan mit kaspersky laufen lassen...
und das log hier reinstellen.

danke für deine antworten.

auch wieder was gelernt.

marga

cosinus · 15.06.2015, 09:01

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM-x32\...\Run: [] => [X]
CHR HKU\S-1-5-21-4062042949-3846255169-451896970-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
FF SearchEngineOrder.1: Ask Search
C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
Task: {01071E8A-196C-4FC2-8D1F-02E29E5A95CC} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {494B521B-9EA1-47B3-BB06-B2B988CAE8CB} - \Driver Booster SkipUAC (Carmen) No Task File <==== ATTENTION
EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

premmarga · 16.06.2015, 08:22

Also soll ich nicht den scan von kasperksy notfall disk nochmals laufen lassen?

hier das fixlog

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Carmen at 2015-06-15 10:35:25 Run:1
Running from C:\Users\Carmen\Desktop
Loaded Profiles: Carmen (Available Profiles: Carmen & carmen-lokal)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
CHR HKU\S-1-5-21-4062042949-3846255169-451896970-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
FF SearchEngineOrder.1: Ask Search
C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
Task: {01071E8A-196C-4FC2-8D1F-02E29E5A95CC} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {494B521B-9EA1-47B3-BB06-B2B988CAE8CB} - \Driver Booster SkipUAC (Carmen) No Task File <==== ATTENTION
EmptyTemp:
         
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKU\S-1-5-21-4062042949-3846255169-451896970-1001\SOFTWARE\Policies\Google" => key removed successfully
Firefox SearchEngineOrder.1 removed successfully
C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{01071E8A-196C-4FC2-8D1F-02E29E5A95CC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{01071E8A-196C-4FC2-8D1F-02E29E5A95CC}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System Protector_startup => key not found. 
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{494B521B-9EA1-47B3-BB06-B2B988CAE8CB}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{494B521B-9EA1-47B3-BB06-B2B988CAE8CB}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Driver Booster SkipUAC (Carmen)" => key removed successfully
EmptyTemp: => 2.4 GB temporary data Removed.


The system needed a reboot.. 

==== End of Fixlog 10:36:01 ====

Hat schon einiges gefunden.

Code:

ATTFilter

Untersuchung von Objekten: wurde beendet vor 2 Tagen  (Ereignis: 6, Objekte: 848418, Zeit: 00:37:12)	
13.06.15 09:37	Aufgabe wurde gestartet			
13.06.15 10:00	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
13.06.15 10:00	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
13.06.15 10:00	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
13.06.15 10:00	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
13.06.15 10:15	Aufgabe wurde beendet			
Untersuchung von Objekten: wurde abgeschlossen vor 1 Minute  (Ereignis: 18, Objekte: 2748256, Zeit: 03:56:35)	
15.06.15 13:11	Aufgabe wurde gestartet			
15.06.15 13:19	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 13:19	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 13:19	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 13:19	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 13:35	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 13:35	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 13:35	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 13:35	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 15:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 15:08	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 15:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 15:08	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 16:18	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 17:08	Gelöscht: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 17:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 17:08	Gelöscht: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 17:08	Aufgabe wurde abgeschlossen

hier nochmals das kaspersky log, ich weiss nicht ob es gerade an der richtige stelle gekommen ist

Code:

ATTFilter

Untersuchung von Objekten: wurde beendet vor 2 Tagen  (Ereignis: 6, Objekte: 848418, Zeit: 00:37:12)	
13.06.15 09:37	Aufgabe wurde gestartet			
13.06.15 10:00	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
13.06.15 10:00	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
13.06.15 10:00	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
13.06.15 10:00	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
13.06.15 10:15	Aufgabe wurde beendet			
Untersuchung von Objekten: wurde abgeschlossen vor 1 Minute  (Ereignis: 18, Objekte: 2748256, Zeit: 03:56:35)	
15.06.15 13:11	Aufgabe wurde gestartet			
15.06.15 13:19	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 13:19	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 13:19	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 13:19	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 13:35	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 13:35	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 13:35	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 13:35	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 15:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 15:08	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe	Zurückgestellt	
15.06.15 15:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 15:08	Nicht desinfizierte Objekte: Trojan-FakeAV.Win32.Tweaker.b	C:/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe	Zurückgestellt	
15.06.15 16:18	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 17:08	Gelöscht: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728(1).exe		
15.06.15 17:08	Gefunden: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 17:08	Gelöscht: Trojan-FakeAV.Win32.Tweaker.b	/mnt/MountedDevices/PD-00A9EB1E-0000000040100000/Users/Carmen/Downloads/rcp_dcomnew_util_728.exe		
15.06.15 17:08	Aufgabe wurde abgeschlossen

cosinus · 16.06.2015, 08:53

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

premmarga · 16.06.2015, 09:05

Hallo Cosinus,

ich habe doch schon Malwarebytes laufen lassen,,, soll dies noch mals geschehen???
m.

cosinus · 16.06.2015, 09:22

Beitrag lesen? Du sollst MBAM und ESET als Kontrollscan (nochmal) machen...

16.06.2015, 09:22	#15
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	pc ist langsam und kaspersky notfall cd findet trojan-fakeav.win32.tweaker.b Beitrag lesen? Du sollst MBAM und ESET als Kontrollscan (nochmal) machen... __________________ Logfiles bitte immer in CODE-Tags posten

pc ist langsam und kaspersky notfall cd findet trojan-fakeav.win32.tweaker.b

Plagegeister aller Art und deren Bekämpfung: pc ist langsam und kaspersky notfall cd findet trojan-fakeav.win32.tweaker.b