| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.07.2015, 14:12
| #1 |
| |  Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Sehr geehrtes Trojaner-Board Team. Ich habe mir gestern über einen FreewarePlayer den Omnibox Browser Virus eingehandelt. Nach Entfernung des Programms (Deinstallation des Players über Systemsteuerung,Suchlauf und Löschung über ADWCleaner und Malwarebytes Anti-Malware, Zurücksetzen von IE 11) zunächst vermeintlicher Erfolg. Nach einer Browsersitzung aber nun immer wieder die Meldung im IE: Seite kann nicht angezeigt werden. Das gleiche bei Firefox. Internetverbindung besteht, Outlook und TeamViewer funktionieren. Als Logfiles habe ich angehängt: Defogger, FRST, Gmer und den Virenscan von GData (Installierter Virenscanner auf dem Rechner). Ich bedanke mich im voraus schon mal für die Bemühungen. Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:28 on 08/07/2015 (Lampe)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by Lampe at 2015-07-08 13:37:01
Running from C:\Users\Lampe\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1344064752-2903933196-2754972076-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-1344064752-2903933196-2754972076-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1344064752-2903933196-2754972076-1002 - Limited - Enabled)
Lampe (S-1-5-21-1344064752-2903933196-2754972076-1000 - Administrator - Enabled) => C:\Users\Lampe
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G DATA TOTAL PROTECTION (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Trend Micro Client/Server Security Agent (Disabled - Up to date) {7193B549-236F-55EE-9AEC-F65279E59A92}
AS: Trend Micro Client/Server Security Agent Anti-Spyware (Disabled - Up to date) {CAF254AD-0555-5A60-A05C-CD200262D02F}
AS: G DATA TOTAL PROTECTION (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G*DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
FW: Trend Micro Personal Firewall (Disabled) {50C2E989-60CF-0845-AFD3-290B7D301E79}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.172 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Agrilog (HKLM-x32\...\de.bertelsmann.agrilog.AgrilogPortal) (Version: 0.10.2 - UNKNOWN)
Agrilog (x32 Version: 0.10.2 - UNKNOWN) Hidden
AMD Catalyst Install Manager (HKLM\...\{0E262CBA-A8C6-3BE1-A812-D7490B4F2B09}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)
ANDI 2012 (HKLM-x32\...\{7598E3D8-48DE-4C7B-9E8E-945B6ADB071A}) (Version: 4.0.3 - LGLN Hannover)
ANDI 2013 (HKLM-x32\...\{21E3464C-EE59-4EA2-B3E1-4FCE000B8722}) (Version: 5.0.8 - LGLN Hannover)
ANDI 2015 (HKLM-x32\...\{D7A68E09-4DA6-4F3A-96A6-345E2A0BBA75}) (Version: 7.0.4 - LGLN Hannover)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.126 - Atheros)
AVM ISDN CAPI Port (HKLM-x32\...\AVM ISDN CAPI Port) (Version: - AVM Berlin)
AVM ISDN TAPI Services for CAPI (HKLM-x32\...\AVM ISDN TAPI Services) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Crystal Reports Basic Runtime for Visual Studio 2008 (HKLM-x32\...\{CE26F10F-C80F-4377-908B-1B7882AE2CE3}) (Version: 10.5.0.0 - Business Objects)
CyberLink PowerDVD 9.5 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.5.2.6102 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Data Vault (Version: 4.2.2.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.81 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.3.60494 - Dell)
Dell Update (HKLM-x32\...\{3FB000F3-7444-41C1-A0A6-53E8FD0B7D9C}) (Version: 1.6.1007.0 - Dell Inc.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
DGExpert (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\490eb16e43b10dda) (Version: 1.4.2.2 - Deutsche Gesellschaft für Ernährung e.V.)
Dropbox (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Dropbox) (Version: 3.6.7 - Dropbox, Inc.)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
FRITZ!Box USB-Fernanschluss (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\2db37667170956ee) (Version: 2.3.2.0 - AVM Berlin)
G DATA TOTAL PROTECTION (HKLM-x32\...\{2A1FF304-D778-49F1-B340-E4BF4CDA2EB0}) (Version: 25.1.0.5 - G DATA Software AG)
GIS-Tools (HKLM-x32\...\{807D5989-073F-4956-98E3-D7926DE76D49}) (Version: 1.0.0 - ASSW-Solutions)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HELM MultiPlant II (HKLM-x32\...\HELM MultiPlant II) (Version: 4.82 - HELM-Software Ladenburg)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
LiveUpdate 3.3 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.3.0.101 - Symantec Corporation)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MOBackup - Datensicherung für Outlook (Testversion) (HKLM-x32\...\MOBackup-DatensicherungfürOutlook) (Version: 7.95 - Heiko Schröder)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Myfarm24 WebSync (HKLM-x32\...\Myfarm24 myWebSync) (Version: - )
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge)
ProFlura2013 (HKLM-x32\...\{321FA8C1-AFDD-4E1F-AA61-DB4138B0622E}) (Version: 7.0 - ASSW GmbH & Co. KG)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6537 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
SAP Crystal Reports runtime engine for .NET Framework (32-bit) (HKLM-x32\...\{436F858F-DCEF-40E5-956D-B417D1EE5E45}) (Version: 13.0.8.1216 - SAP)
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.13.8.201307151333 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.259 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.259 - Sony)
Spotify (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Spotify) (Version: 1.0.8.59.gee82e7e6 - Spotify AB)
Symantec pcAnywhere (HKLM-x32\...\{8D94B4B5-A3E3-4BD5-851E-E14872BFC79B}) (Version: 12.5.5 - Symantec Corporation)
SYNCING.NET 5.0 (HKLM-x32\...\SYNCING.NET) (Version: 5.0 - ASBYTE)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.43879 - TeamViewer)
Trend Micro Client/Server Security Agent (HKLM-x32\...\{BED0B8A2-2986-49F8-90D6-FA008D37A3D2}) (Version: 3.5.1163 - Trend Micro)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
WinZip 17.5 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DA}) (Version: 17.5.10480 - WinZip Computing, S.L. )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{3560575F-7C2D-48AE-AB45-DAD430A95EBE}\InprocServer32 -> C:\Program Files (x86)\WinZip\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
==================== Restore Points =========================
30-06-2015 03:00:27 Windows Update
03-07-2015 08:43:09 Windows Update
07-07-2015 07:52:50 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {06B506CB-15F9-42F1-8F02-9E62DDC1E29B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)
Task: {2424D8DB-BCA8-446B-B72F-895E8765F93F} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-03-20] (PC-Doctor, Inc.)
Task: {2AE1E4F3-FE6B-42FE-8016-F06D563B7819} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-03-20] (PC-Doctor, Inc.)
Task: {41E07192-F756-4410-A88D-A21F3BE500EE} - System32\Tasks\Sichern Outlook => C:\Program Files (x86)\MOBackup\mobackup.exe [2014-02-20] (Heiko Schröder)
Task: {49AD9908-790A-4756-99AA-772A252D8280} - \WordShark Auto Updater 1.10.0.19 Core No Task File <==== ATTENTION
Task: {4D83D81C-3AE3-4557-BF2E-39A988C36C73} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28] (Dropbox, Inc.)
Task: {53807AA7-747A-425E-81E5-810331A396E1} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28] (Dropbox, Inc.)
Task: {6246F0EE-3BC6-41C8-A116-3CC8838EE6E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {6B10C8EB-2D1A-470A-83D3-A8EFFE1E216C} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {6D0561DD-88D6-4644-A0D8-5929ABD069F0} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-04-10] (Dell Inc.)
Task: {7D59C2F0-1C7D-42DE-8E54-FB60EF09348A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)
Task: {7E87F4C3-6FD0-4C77-BF43-9D2E5BEC04A4} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {860A403F-73E2-43D7-90DC-0FFF1B5CA1D6} - \WordShark Auto Updater 1.10.0.19 Pending Update No Task File <==== ATTENTION
Task: {A026F9D0-4710-43F4-9A12-434FC8949DA6} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Lampe-PC-Lampe Lampe-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-05-28] (Microsoft Corporation)
Task: {C632B317-990F-47FB-9CA3-5E0058845617} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {C9F1A864-77FF-43DE-A3E5-DABDF4F18B4E} - System32\Tasks\{3B8520A2-DB72-4DE1-88FC-A6D387E0EF14} => Firefox.exe
Task: {CFE9479D-BAD3-4B97-AFE1-41A0CB644782} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core.job => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA.job => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2013-08-09 17:59 - 2006-02-23 11:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2013-08-09 17:59 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2013-07-13 16:07 - 2014-06-23 09:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2011-10-25 21:29 - 2011-10-25 21:29 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-11-09 09:55 - 2011-11-09 09:55 - 00016384 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-06-10 21:05 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2009-03-26 22:36 - 2009-03-26 22:36 - 01489408 _____ () c:\Program Files (x86)\Trend Micro\Client Server Security Agent\LIBEAY32.dll
2009-03-26 22:37 - 2009-03-26 22:37 - 00318464 _____ () c:\Program Files (x86)\Trend Micro\Client Server Security Agent\SSLEAY32.dll
2013-07-05 22:00 - 2012-01-26 21:49 - 02751808 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2011-02-27 00:58 - 2011-02-27 00:58 - 00094736 _____ () c:\Program Files (x86)\Trend Micro\Client Server Security Agent\zlibwapi.dll
2015-06-16 11:17 - 2015-06-16 11:17 - 00382584 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-05-03 11:37 - 2013-05-03 11:37 - 00904704 _____ () C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\System.Data.SQLite.dll
2013-05-03 11:36 - 2013-05-03 11:36 - 00532480 _____ () C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\sqlite3.dll
2013-07-13 16:07 - 2012-04-30 11:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2013-07-13 16:07 - 2014-12-04 15:18 - 00241152 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 14:54 - 2011-07-07 14:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2013-07-13 16:07 - 2013-05-20 12:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2013-07-13 16:07 - 2010-01-11 16:44 - 00053248 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
2013-05-14 09:38 - 2013-05-14 09:38 - 00607744 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2013-01-08 17:03 - 2013-01-08 17:03 - 00086016 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\CalEngine.dll
2012-04-04 14:33 - 2012-04-04 14:33 - 00139776 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\CAgdLNotes.dll
2013-01-08 17:02 - 2013-01-08 17:02 - 00163840 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\CAgdOutlook.dll
2012-07-26 11:51 - 2012-07-26 11:51 - 00208896 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VistaCalendar.dll
2014-03-19 12:24 - 2014-07-11 08:19 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2013-09-13 03:30 - 2014-11-21 08:42 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll
2015-06-02 15:52 - 2015-07-07 18:46 - 41287224 _____ () C:\Users\Lampe\AppData\Roaming\Spotify\libcef.dll
2015-07-08 13:34 - 2015-07-08 13:34 - 00043008 _____ () c:\users\lampe\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwgxmov.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00750080 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00047616 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00865280 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00200704 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00726016 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-06-02 15:52 - 2015-07-07 18:46 - 01488440 _____ () C:\Users\Lampe\AppData\Roaming\Spotify\libglesv2.dll
2015-06-02 15:52 - 2015-07-07 18:46 - 00079928 _____ () C:\Users\Lampe\AppData\Roaming\Spotify\libegl.dll
2015-06-02 15:52 - 2015-06-02 15:52 - 09305656 _____ () C:\Users\Lampe\AppData\Roaming\Spotify\pdf.dll
2013-09-13 03:30 - 2014-11-21 08:42 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2014-10-16 03:35 - 2014-10-16 03:35 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2013-07-05 21:52 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-07-05 21:55 - 2012-01-21 13:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Lampe\Documents\Agravis Beleg.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Lampe\Documents\Agravis Beleg.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [{3497B23A-874F-4DCF-AF1E-D24C41FEC7B8}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{580A0143-3E1D-4621-A9F1-C18FE2F328A2}] => (Allow) LPort=2869
FirewallRules: [{521C28B1-DADB-44BB-A8B9-C459D60F1525}] => (Allow) LPort=1900
FirewallRules: [{377F44F4-7ADA-4E00-BE63-68ACAB268B54}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{4DA280A4-FCEC-440B-B295-D13A438E6928}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.EXE
FirewallRules: [{05F89325-DF6B-4ED0-9EE0-77F48349CD2D}] => (Allow) C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{0F75333A-E9C1-4810-85C8-3E7BC2EA37D9}] => (Allow) LPort=61116
FirewallRules: [{2749FEC9-A93C-4096-9135-F63E320E6144}] => (Allow) LPort=21112
FirewallRules: [{D0306993-98E2-4FE4-9BF6-CCC1B3ADBC5B}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe
FirewallRules: [{B828B916-3AE6-4456-A4E8-4E05FC5D395B}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe
FirewallRules: [{5239E099-CD08-4F73-A66B-4D1B4C76A6D7}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\NotificationService.exe
FirewallRules: [{0F8E0728-8275-43B5-BC1B-52508D894ADC}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\NotificationService.exe
FirewallRules: [{2163E2E4-762F-40AE-987E-1AB923A401C8}] => (Allow) LPort=61117
FirewallRules: [{8334CD4E-6776-46C0-A80F-EBED27A958A3}] => (Allow) C:\Program Files (x86)\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{C842D168-E1CD-4B48-9702-5C5FEC932987}] => (Allow) C:\Program Files (x86)\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{54EB344E-8570-4A53-BA8E-EC621BD0245D}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftC2D3.tmp\fsetup.exe
FirewallRules: [{45A16240-64D9-4E20-9888-3CF4A407F3CA}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftC2D3.tmp\fsetup.exe
FirewallRules: [{6C8B07AC-97C8-4072-9176-32BB0AFCF04F}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftA00.tmp\fsetup.exe
FirewallRules: [{77C02208-DF4A-4221-8F3D-5D2A08D8A627}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftA00.tmp\fsetup.exe
FirewallRules: [{05BF8AD6-D622-4980-B91B-CB27D643EE11}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7CE991A4-9C67-40AA-A3C4-50A103B8BBF7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D104ADEC-23B3-47FD-AABA-7169A86DBAA3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{19107462-03D8-4774-8E2E-8538A3B3A210}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{415F9AF7-22D0-4454-A2FE-B7A01E4CD850}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{EA33C50C-25A9-4B4A-B0F8-EC90B8B1C0F6}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{E1C94697-752D-4900-9472-1C22D731882E}] => (Allow) C:\Program Files (x86)\FRITZ!\fboxset.exe
FirewallRules: [{365C98A1-724A-4446-98EF-D21BC6AD7C13}] => (Allow) C:\Program Files (x86)\FRITZ!\fboxset.exe
FirewallRules: [{7DFE3C48-2E48-488E-BD56-1A7DE023972F}] => (Allow) C:\Program Files (x86)\FRITZ!\igd_finder.exe
FirewallRules: [{991C98F8-82E2-441F-BEC1-63638588F90F}] => (Allow) C:\Program Files (x86)\FRITZ!\igd_finder.exe
FirewallRules: [{9F7AFE22-950E-49D1-8159-6CB39F8308C1}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{DD37FF90-68B4-4741-B2E8-4DE30B2EF2E8}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{F5E94CDC-5608-406E-8A8D-28EB1CC9DFFF}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{B47C5661-627E-4396-AAA8-7EC26574FF48}] => (Allow) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{2F599987-A7AE-4C96-9399-1E5C40BBA885}] => (Allow) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{6BA101F0-C535-4EB2-AA11-21756E3FEAFA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{876DD064-E60F-4793-A05A-C0294BD6FAB5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{7F096D67-CCB2-4753-8FCD-B650655F8016}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{B8EB1790-F86A-4819-B56A-19C20CA5A99F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [{17F3CC06-D539-4707-8DC1-8643ABFDF55A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [{A4489A1F-0C3E-4F28-96FD-1039871EBFB1}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5DE722D1-6338-48E9-9160-692DF49F01BB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5AB65E56-42D4-48C4-AD91-5A18594F6EB8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D13A2DE3-B9D6-4D93-B1EE-A6961595802C}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{630BD710-033F-49FB-ACB3-18599DF856E0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A4A7A9E5-F356-4E13-9885-C666A1D9E964}] => (Allow) LPort=61117
FirewallRules: [{23A00B15-AC51-4860-AF8B-D5A58E27789C}] => (Allow) LPort=61116
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/08/2015 01:33:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 11:16:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 10:32:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:25:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000679c9
ID des fehlerhaften Prozesses: 0xd94
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (07/08/2015 08:25:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:18:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 07:29:49 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 07:07:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:54:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:51:22 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: TrustManager-Subsystem isn't available
System errors:
=============
Error: (07/08/2015 01:31:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AVMPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (07/08/2015 01:31:48 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (07/08/2015 11:31:00 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst WerSvc erreicht.
Error: (07/08/2015 11:15:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AVMPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (07/08/2015 11:15:42 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (07/08/2015 10:31:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AVMPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (07/08/2015 10:31:37 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (07/08/2015 08:26:54 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (07/08/2015 08:26:16 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (07/08/2015 08:24:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WS 1.10.0.19 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office:
=========================
Error: (07/08/2015 01:33:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 11:16:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 10:32:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:25:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4Explorer.EXE6.1.7601.175674d672ee4c000000500000000000679c9d9401d0b946acd9f775C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1046dd5d-253a-11e5-9d94-bc85567a9172
Error: (07/08/2015 08:25:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:18:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 07:29:49 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 07:07:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:54:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:51:22 PM) (Source: AVKWCtl) (EventID: 0) (User: )
Description: Der Filter Treiber konnte aus dem folgenden Grund nicht gestartet werden: TrustManager-Subsystem isn't available
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 54%
Total physical RAM: 8152.95 MB
Available physical RAM: 3732.64 MB
Total Virtual: 16304.1 MB
Available Virtual: 11386.36 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:1847.83 GB) (Free:1741.72 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1863 GB) (Disk ID: 163C4746)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=15.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1847.8 GB) - (Type=07 NTFS)
==================== End of log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by Lampe (administrator) on LAMPE-PC on 08-07-2015 13:35:42
Running from C:\Users\Lampe\Desktop
Loaded Profiles: Lampe (Available Profiles: Lampe & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(ASBYTE) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Spotify Ltd) C:\Users\Lampe\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Lampe\AppData\Roaming\Spotify\Spotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Dropbox, Inc.) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\PccNtMon.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVM Berlin) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
(Spotify Ltd) C:\Users\Lampe\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(ASBYTE) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncingOLWatchService.exe
(Spotify Ltd) C:\Users\Lampe\AppData\Roaming\Spotify\Spotify.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Spotify Ltd) C:\Users\Lampe\AppData\Roaming\Spotify\Spotify.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(G DATA Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\Ntrtscan.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(ASBYTE) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SN_Service.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmListen.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\HostedAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmPfw.exe
(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\Client Server Security Agent\CNTAoSMgr.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6457960 2011-12-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-16] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => c:\Program Files (x86)\Trend Micro\Client Server Security Agent\pccntmon.exe [1708048 2011-02-27] (Trend Micro Inc.)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1864312 2015-06-16] (G DATA Software AG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [SyncService] => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe [1730144 2013-07-31] (ASBYTE)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [455392 2015-04-10] (Sony)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Spotify Web Helper] => C:\Users\Lampe\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030648 2015-07-07] (Spotify Ltd)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [AVMUSBFernanschluss] => C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe [139264 2014-01-04] (AVM Berlin)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Spotify] => C:\Users\Lampe\AppData\Roaming\Spotify\Spotify.exe [7504952 2015-07-07] (Spotify Ltd)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Dropbox Update] => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-28] (Dropbox, Inc.)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Run: [SyncService] => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe [1730144 2013-07-31] (ASBYTE)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-04-08]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [!1SYNCING.NET Unread] -> {5C9D3C37-2C95-4b5b-9EF0-4E0AFCA5E78A} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!2SYNCING.NET Shared Folder] -> {FB8CDFB0-B508-4F12-A91E-26E68ABB4DAE} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!3SYNCING.NET CheckedOutByTeammate] -> {5CBF1ABD-2D6A-4570-9A4F-A47798BBFC08} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!4SYNCING.NET CheckedOutByMe] -> {B133F3E9-124C-4669-BFFF-1B74508B5A84} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!5SYNCING.NET DownArrow] -> {0B914147-F836-4cfa-893A-ECE90B815982} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000 -> {FEDF0020-63D5-4405-B17C-0D73462DF842} URL =
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll [2010-07-21] (Trend Micro Inc.)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll [2010-07-21] (Trend Micro Inc.)
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll [2012-03-08] (Atheros Commnucations)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Users\Lampe\AppData\Local\Programs\ANDI 2013\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-12-21] (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll [2010-07-21] (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll [2010-07-21] (Trend Micro Inc.)
ShellExecuteHooks: CExecuteHook Object - {7B0E5486-E11D-437f-AC8B-7901C7D3FCCB} - C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [1893984 2013-07-31] (ASBYTE)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{1B0624B1-6D37-470C-93F6-EF7E5628FF23}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{32E84A78-030F-46C0-A781-33E929293F85}: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Lampe\AppData\Roaming\Mozilla\Firefox\Profiles\0fdypcb4.default
FF Homepage: hxxp://www.spiegel.de/
FF NetworkProxy: "type", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension [2013-07-05]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-07-10]
Chrome:
=======
CHR Profile: C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-23]
CHR Extension: (Google Drive) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-23]
CHR Extension: (YouTube) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-23]
CHR Extension: (Google Search) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-07]
CHR Extension: (Google Wallet) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-18]
CHR Extension: (Gmail) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [107648 2012-03-08] (Atheros Commnucations) [File not signed]
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2558072 2015-06-19] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [966776 2015-06-16] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [3711712 2015-06-16] (G Data Software AG)
S3 awhost32; C:\Program Files (x86)\Symantec\pcAnywhere\awhost32.exe [793480 2012-04-02] (Symantec Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2557136 2015-02-26] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201936 2015-02-26] (Dell Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [232152 2015-05-20] (Dell Inc.)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3202368 2015-06-19] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [789624 2015-06-16] (G Data Software AG)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-01-19] (Symantec Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 ntrtscan; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe [1836616 2011-02-18] (Trend Micro Inc.)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 SN_Service; C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SN_Service.exe [32768 2013-05-03] (ASBYTE) [File not signed]
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-04-10] (Dell Inc.)
R2 svcGenericHost; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe [50704 2011-04-07] (Trend Micro Inc.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
R2 tmlisten; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe [2060896 2011-02-18] (Trend Micro Inc.)
R3 TmPfw; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe [596032 2010-07-21] (Trend Micro Inc.)
R3 TmProxy; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe [917840 2010-07-21] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [159360 2012-03-08] (Atheros) [File not signed]
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-03-28] (Atheros) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2014-01-04] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2014-01-04] (AVM Berlin)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S2 AVMPORT; C:\Windows\SysWOW64\drivers\avmport.sys [66472 2009-10-02] (AVM Berlin)
R1 awecho; C:\Windows\SysWow64\drivers\awechomd.sys [16696 2012-04-01] (Symantec Corporation)
R1 AW_HOST; C:\Windows\SysWow64\drivers\aw_host5.sys [23864 2012-04-01] (Symantec Corporation)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-31] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-31] (Dell Computer Corporation)
S3 FUS2BASE; C:\Windows\System32\DRIVERS\fus2base.sys [696832 2009-06-10] (AVM Berlin)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [158720 2015-07-07] (G Data Software AG)
R3 GDKBB; C:\Windows\system32\drivers\GDKBB64.sys [27648 2015-07-07] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2015-07-07] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [230912 2015-07-07] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [76288 2015-07-07] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [65024 2015-07-07] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2015-07-08] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [125952 2015-07-07] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R2 TmFilter; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys [310032 2011-03-24] (Trend Micro Inc.)
R1 tmlwf; C:\Windows\System32\DRIVERS\tmlwf.sys [196688 2010-11-08] (Trend Micro Inc.)
R2 TmPreFilter; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys [42768 2011-03-24] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2010-11-08] (Trend Micro Inc.)
R2 tmwfp; C:\Windows\System32\DRIVERS\tmwfp.sys [338000 2010-11-08] (Trend Micro Inc.)
R2 VSApiNt; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\VSApiNt.sys [1988368 2011-03-24] (Trend Micro Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-08 13:35 - 2015-07-08 13:36 - 00028801 _____ C:\Users\Lampe\Desktop\FRST.txt
2015-07-08 13:32 - 2015-07-08 13:32 - 00000000 ___RD C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-07-08 13:30 - 2015-07-08 13:35 - 00000000 ____D C:\FRST
2015-07-08 13:28 - 2015-07-08 13:28 - 00000472 _____ C:\Users\Lampe\Desktop\defogger_disable.log
2015-07-08 13:28 - 2015-07-08 13:28 - 00000000 _____ C:\Users\Lampe\defogger_reenable
2015-07-08 13:28 - 2015-07-08 13:06 - 02112512 ____N (Farbar) C:\Users\Lampe\Desktop\FRST64.exe
2015-07-08 13:27 - 2015-07-08 13:07 - 00380416 ____N C:\Users\Lampe\Desktop\Gmer-19357.exe
2015-07-08 13:27 - 2015-07-08 13:05 - 00050477 ____N C:\Users\Lampe\Desktop\Defogger.exe
2015-07-08 12:46 - 2015-07-08 12:46 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-08 12:46 - 2015-07-08 12:46 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-08 12:46 - 2015-07-08 12:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-08 11:53 - 2015-07-08 11:53 - 00002966 _____ C:\Windows\System32\Tasks\{3B8520A2-DB72-4DE1-88FC-A6D387E0EF14}
2015-07-08 11:10 - 2015-07-08 11:36 - 00000000 ____D C:\Users\Lampe\AppData\Local\Mozilla
2015-07-08 11:10 - 2015-07-08 11:11 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Mozilla
2015-07-08 11:10 - 2015-07-08 11:10 - 00000000 ____D C:\ProgramData\Mozilla
2015-07-08 11:10 - 2015-07-08 11:09 - 40945288 ____N C:\Users\Lampe\Downloads\Firefox_Setup_39.0de.exe
2015-07-08 11:00 - 2015-07-08 10:57 - 63320784 ____N (Microsoft Corporation) C:\Users\Lampe\Downloads\IE11_w7_Windows6.1-x64-de-de.exe
2015-07-08 07:39 - 2015-07-08 12:48 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-08 07:39 - 2015-07-08 07:39 - 00001108 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-08 07:39 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-08 07:39 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-08 07:39 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-08 07:35 - 2015-07-08 07:29 - 24345872 ____N (Malwarebytes Corporation ) C:\Users\Lampe\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-08 07:23 - 2015-07-08 10:09 - 00000000 ____D C:\AdwCleaner
2015-07-08 07:23 - 2015-07-08 07:21 - 02244096 ____N C:\Users\Lampe\Downloads\adwcleaner_4.207.exe
2015-07-07 19:51 - 2015-07-07 19:51 - 00027648 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB64.sys
2015-07-07 19:51 - 2015-07-07 19:51 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB64_01007.Wdf
2015-07-07 19:51 - 2015-07-07 19:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA TOTAL PROTECTION
2015-07-07 18:05 - 2015-07-07 18:05 - 00000000 _____ C:\Windows\prleth.sys
2015-07-07 18:05 - 2015-07-07 18:05 - 00000000 _____ C:\Windows\hgfs.sys
2015-07-02 09:35 - 2015-07-02 09:35 - 01453016 _____ C:\Windows\Minidump\070215-39608-01.dmp
2015-07-01 13:54 - 2015-07-08 13:36 - 00005136 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Lampe-PC-Lampe Lampe-PC
2015-06-28 08:46 - 2015-06-28 08:46 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-28 08:45 - 2015-07-08 12:51 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA.job
2015-06-28 08:45 - 2015-07-08 08:50 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core.job
2015-06-28 08:45 - 2015-06-28 08:45 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA
2015-06-28 08:45 - 2015-06-28 08:45 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core
2015-06-28 08:45 - 2015-06-28 08:45 - 00000000 ____D C:\Users\Lampe\AppData\Local\Dropbox
2015-06-28 08:45 - 2015-06-28 08:45 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-28 08:40 - 2015-06-28 08:40 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 13:10 - 2015-06-24 13:10 - 00009336 ____N (G*DATA Software AG) C:\Windows\SysWOW64\GDScrSv.de.dll
2015-06-24 12:06 - 2015-06-24 12:06 - 02230392 ____N (G Data Software AG) C:\Windows\SysWOW64\GdScrSv.scr
2015-06-15 08:37 - 2015-06-15 08:37 - 00000360 _____ C:\Users\Lampe\Downloads\Urlaub (1)
2015-06-13 14:49 - 2015-06-13 14:49 - 00011967 _____ C:\Users\Lampe\Documents\Strategien Gülle 2015.xlsx
2015-06-12 15:16 - 2015-06-12 15:16 - 00000000 ____D C:\Program Files (x86)\Dell Update
2015-06-12 13:45 - 2015-06-12 13:45 - 00002158 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-06-10 08:52 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 08:52 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 08:52 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 08:52 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 08:52 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 08:52 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 08:52 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 08:52 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 08:52 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 08:52 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 08:52 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 08:52 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 08:52 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 08:52 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 08:52 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 08:52 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 08:52 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 08:52 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 08:52 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 08:52 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 08:52 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 08:52 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 08:52 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 08:52 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 08:52 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 08:52 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 08:52 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 08:52 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 08:52 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 08:52 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 08:52 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 08:52 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 08:52 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 08:52 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 08:52 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 08:52 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 08:52 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 08:52 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 08:52 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 08:52 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 08:52 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 08:52 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 08:52 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 08:52 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 08:52 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 08:52 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 08:52 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 08:52 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 08:52 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 08:52 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 08:52 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 08:52 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 08:52 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 08:52 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 08:52 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 08:52 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 08:52 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 08:52 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 08:52 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 08:52 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 08:52 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 08:52 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 08:52 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 08:52 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 08:52 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 08:52 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 08:52 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 08:52 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 08:52 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 08:52 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 08:52 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 08:52 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 08:52 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 08:52 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 08:52 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 08:52 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 08:52 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 08:52 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 08:52 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 08:51 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 08:51 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 08:51 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 08:51 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-09 17:30 - 2015-07-07 19:50 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\vlc
2015-06-09 17:30 - 2015-06-09 17:30 - 00000873 _____ C:\Users\Public\Desktop\VLC media player.lnk
2015-06-09 17:30 - 2015-06-09 17:30 - 00000000 ____D C:\Program Files\VideoLAN
2015-06-08 08:14 - 2015-06-08 08:16 - 00000000 ____D C:\Users\Lampe\Desktop\fotos Aumühle
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-08 13:34 - 2013-08-29 11:27 - 00000000 ___RD C:\Users\Lampe\Dropbox
2015-07-08 13:34 - 2013-08-29 11:26 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Dropbox
2015-07-08 13:34 - 2013-07-05 22:07 - 00000031 _____ C:\tmuninst.ini
2015-07-08 13:33 - 2013-07-05 22:11 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2015-07-08 13:33 - 2013-07-05 22:11 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2015-07-08 13:33 - 2013-07-05 21:59 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2015-07-08 13:32 - 2013-07-23 08:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-08 13:32 - 2013-07-15 20:08 - 00000000 ____D C:\Users\Lampe\AppData\Local\Spotify
2015-07-08 13:31 - 2010-11-21 05:47 - 00290844 _____ C:\Windows\PFRO.log
2015-07-08 13:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-08 13:31 - 2009-07-14 06:51 - 00388281 _____ C:\Windows\setupact.log
2015-07-08 13:30 - 2013-07-13 12:26 - 00000000 ____D C:\Users\Lampe\Documents\Outlook-Dateien
2015-07-08 13:30 - 2013-07-05 21:39 - 01182707 _____ C:\Windows\WindowsUpdate.log
2015-07-08 13:28 - 2013-07-09 14:07 - 00000000 ____D C:\Users\Lampe
2015-07-08 13:12 - 2013-07-23 08:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-08 12:46 - 2013-07-10 20:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-08 11:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-08 11:25 - 2009-07-14 06:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-08 11:25 - 2009-07-14 06:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-08 11:23 - 2013-07-15 20:07 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Spotify
2015-07-08 11:23 - 2013-07-10 08:40 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2015-07-08 11:23 - 2013-07-10 08:40 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2015-07-08 11:00 - 2013-11-27 04:00 - 00011271 _____ C:\Windows\IE11_main.log
2015-07-08 10:30 - 2013-07-05 22:05 - 00000000 ____D C:\Windows\PCHEALTH
2015-07-08 10:22 - 2013-07-23 08:59 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-08 08:16 - 2009-07-14 07:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-07-08 07:26 - 2013-07-10 13:59 - 00005330 _____ C:\Windows\TMFilter.log
2015-07-08 07:26 - 2013-07-09 14:09 - 00000997 _____ C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-07 19:54 - 2013-07-09 16:31 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-07-07 19:53 - 2013-07-09 16:46 - 00076288 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2015-07-07 19:51 - 2014-11-18 09:56 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2015-07-07 19:51 - 2014-11-18 09:56 - 00001980 _____ C:\Users\Public\Desktop\G DATA TOTAL PROTECTION.lnk
2015-07-07 19:51 - 2013-07-09 16:45 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2015-07-07 19:50 - 2013-07-13 16:07 - 00388310 _____ C:\Windows\DPINST.LOG
2015-07-07 19:50 - 2013-07-09 16:45 - 00230912 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2015-07-07 19:50 - 2013-07-09 16:45 - 00158720 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2015-07-07 19:50 - 2013-07-09 16:45 - 00125952 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2015-07-07 18:38 - 2013-07-15 18:26 - 00000000 ____D C:\Users\Lampe\Documents\Zugänge
2015-07-07 18:38 - 2013-07-10 08:45 - 00000000 ____D C:\Users\Lampe\Documents\Betrieb
2015-07-07 14:55 - 2015-04-07 09:41 - 00003484 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-07-06 10:12 - 2013-07-14 13:46 - 00000000 ____D C:\Users\Lampe\Documents\Privat
2015-07-03 18:50 - 2010-11-21 08:50 - 00712406 _____ C:\Windows\system32\perfh007.dat
2015-07-03 18:50 - 2010-11-21 08:50 - 00153794 _____ C:\Windows\system32\perfc007.dat
2015-07-03 18:50 - 2009-07-14 07:13 - 01650592 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-02 11:18 - 2014-01-14 20:06 - 00017408 ___SH C:\Users\Lampe\Documents\Thumbs.db
2015-07-02 09:38 - 2013-07-09 14:11 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-02 09:35 - 2013-07-09 15:23 - 773942232 _____ C:\Windows\MEMORY.DMP
2015-07-02 09:35 - 2013-07-09 15:23 - 00000000 ____D C:\Windows\Minidump
2015-06-30 10:02 - 2014-12-16 15:40 - 00000973 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-06-30 10:02 - 2014-12-16 15:40 - 00000961 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-06-23 13:30 - 2010-11-21 05:27 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-13 14:56 - 2014-01-04 13:40 - 00000000 ____D C:\Users\Lampe\AppData\Local\Deployment
2015-06-12 15:16 - 2013-07-05 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-06-12 15:14 - 2013-07-05 21:56 - 00000000 ____D C:\ProgramData\Dell
2015-06-12 13:51 - 2015-02-12 10:46 - 00000000 ____D C:\ProgramData\SupportAssistAgent
2015-06-11 07:54 - 2014-11-13 15:27 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieBrowserModeList
2015-06-11 07:54 - 2014-04-10 10:39 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieUserList
2015-06-11 07:54 - 2014-04-10 10:39 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieSiteList
2015-06-11 07:54 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 04:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 03:25 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-11 03:25 - 2009-07-14 06:45 - 00327872 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 03:06 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 03:02 - 2013-07-15 13:20 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 22:38 - 2015-06-02 11:27 - 00000000 ____D C:\Users\Lampe\Desktop\bilder taufe inges geb
2015-06-10 22:37 - 2014-02-05 13:21 - 00849920 ___SH C:\Users\Lampe\Desktop\Thumbs.db
2015-06-09 13:35 - 2013-08-10 13:20 - 00019194 _____ C:\Windows\avmacc.log
==================== Files in the root of some directories =======
2015-01-22 09:30 - 2015-01-22 09:30 - 0000174 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
Some files in TEMP:
====================
C:\Users\Lampe\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwgxmov.dll
C:\Users\Lampe\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Lampe\AppData\Local\Temp\SetupHomeBusinessRetail.x86.de-DE_HomeBusinessRetail_WPMXP-NTVR7-V6BF2-YG6H8-MR96P_act_1_.exe
C:\Users\Lampe\AppData\Local\Temp\SyncingSetup.exe
C:\Users\Lampe\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-03 01:45
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-08 14:02:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST2000DM rev.CC27 1863,02GB
Running: Gmer-19357.exe; Driver: C:\Users\Lampe\AppData\Local\Temp\ugloapoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076c81401 2 bytes JMP 76ceb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076c81419 2 bytes JMP 76ceb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076c81431 2 bytes JMP 76d68f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076c8144a 2 bytes CALL 76cc489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076c814dd 2 bytes JMP 76d68822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076c814f5 2 bytes JMP 76d689f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076c8150d 2 bytes JMP 76d68718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076c81525 2 bytes JMP 76d68ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076c8153d 2 bytes JMP 76cdfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076c81555 2 bytes JMP 76ce68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076c8156d 2 bytes JMP 76d68fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076c81585 2 bytes JMP 76d68b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076c8159d 2 bytes JMP 76d686dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076c815b5 2 bytes JMP 76cdfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076c815cd 2 bytes JMP 76ceb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076c816b2 2 bytes JMP 76d68ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076c816bd 2 bytes JMP 76d68671 C:\Windows\syswow64\kernel32.dll
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc85567a9172
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc85567a9172 (not active ControlSet)
---- EOF - GMER 2.1 ----
|
|
08.07.2015, 14:17
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Hi
__________________die anderen Logs von MBAM, adwcleaner etc. bitte auch posten.
__________________ |
|
08.07.2015, 14:26
| #3 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrCode:
ATTFilter Virenprüfung mit G DATA TOTAL PROTECTION
Version 25.1.0.5
Virensignaturen vom 07.07.2015
Startzeit: 08.07.2015 11:23:03
Engine(s): Engine A (AVA 25.2410), Engine B (GD 25.5336)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein
Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 08.07.2015 12:35:48
228290 Dateien überprüft
5 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
Archiv: backup.pst
Pfad: C:\Users\Lampe\Documents\Outlook-Dateien
Status: Virus gefunden
Virus: W97M.Downloader.P (Engine A)
Objekt: [Time: 2014/07/22 05:51:10][Subject: Kunden Nr. 246049][From: Natie Chandter]=>Zahlung-9389.doc
In Archiv: C:\Users\Lampe\Documents\Outlook-Dateien\backup.pst
Status: Virus gefunden
Virus: W97M.Downloader.P
Objekt: ProtectWindowsManager.exe.vir
Pfad: C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect
Status: Datei in Quarantäne verschoben
Virus: Win32.Adware.Graftor.B (Engine B)
Objekt: BabMaint.exe
Pfad: C:\Users\Lampe\AppData\Local\Temp\39144F70-BAB0-7891-B2DA-C538CCE702E4\Latest
Status: Datei in Quarantäne verschoben
Virus: Win32.Application.Agent.GSTHUO (Engine B)
Archiv: gerritlampe@gmx.de(2).ost
Pfad: C:\Users\Lampe\AppData\Local\Microsoft\Outlook
Status: Datei in Quarantäne verschoben
Virus: W97M.Downloader.AG, Gen:Variant.Symmi.47295, W97M.Downloader.AP, Trojan.Zmutzy.36 (2x), Zum.Zmutz.1 (2x), Trojan.Downloader.JRYD (Engine A)
Objekt: [Time: 2014/09/03 20:59:34][Subject: ELSTER Finanzamt 2014. Identn93875299][From: Adriana]=>Steuerbericht09201416.doc
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: W97M.Downloader.AG
Objekt: [Time: 2014/09/22 17:21:47][Subject: invoice][From: Jeany]=>information.zip=>important_information_read_and_reply_777666123_627632244445600675377132816386968821932286570592735800858581352368108289421534679036480025826406966295471315303858489483.scr
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Gen:Variant.Symmi.47295
Objekt: [Time: 2014/09/23 00:43:23][Subject: ELSTER Finanzamt 2014. Ident 705467.][From: Nicci]=>order_85.zip=>order_85.doc
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: W97M.Downloader.AP
Objekt: [Time: 2014/09/24 18:06:50][Subject: Konto-Lastschrift konnte nicht durchgeführt werden 24.09.2014][From: Abrechnung]=>Stornierten Lastschrift Ihrer Bestellung Facebook vom 24.09.2014.zip=>Ausgleich nicht gedeckten Buchung Ihrer Bestellung Facebook vom 24.09.2014.zip=>Ausgleich 24.09.2014 - Abrechnung Facebook GmbH.com
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Trojan.Zmutzy.36
Objekt: [Time: 2014/09/24 18:06:50][Subject: Konto-Lastschrift konnte nicht durchgeführt werden 24.09.2014][From: Abrechnung]=>Stornierten Lastschrift Ihrer Bestellung Facebook vom 24.09.2014.zip=>Ausgleich nicht gedeckten Buchung Ihrer Bestellung Facebook vom 24.09.2014.zip=>(heurC)
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Zum.Zmutz.1
Objekt: [Time: 2014/10/11 17:42:21][Subject: Automatische Lastschrift konnte nicht vorgenommen werden 10.10.2014 Gerrit Lampe][From: Sachbearbeiter]=>Stornierten Zahlung Ihrer Bestellung Amazon vom 11.10.2014.zip=>Forderung stornierten Zahlung Ihrer Bestellung Amazon vom 11.10.2014.zip=>Ausgleich 11.10.2014 - Sachbearbeiter Amazon AG.com
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Trojan.Zmutzy.36
Objekt: [Time: 2014/10/11 17:42:21][Subject: Automatische Lastschrift konnte nicht vorgenommen werden 10.10.2014 Gerrit Lampe][From: Sachbearbeiter]=>Stornierten Zahlung Ihrer Bestellung Amazon vom 11.10.2014.zip=>Forderung stornierten Zahlung Ihrer Bestellung Amazon vom 11.10.2014.zip=>(heurC)
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Zum.Zmutz.1
Objekt: [Time: 2015/06/29 11:05:29][Subject: Requisites change][From: Lennart Michaelsen]=>Account.zip=>Account_info_25054.exe
In Archiv: C:\Users\Lampe\AppData\Local\Microsoft\Outlook\gerritlampe@gmx.de(2).ost
Status: Virus gefunden
Virus: Trojan.Downloader.JRYD
Archiv: PDFCreator-1_7_0_setup.exe
Pfad: C:\Users\Lampe\Downloads
Status: Datei in Quarantäne verschoben
Virus: Win32.Adware.OpenCandy.C (Engine B)
Objekt: {tmp}\OCSetupHlp.dll
In Archiv: C:\Users\Lampe\Downloads\PDFCreator-1_7_0_setup.exe
Status: Junkware (PUP) gefunden
Virus: Win32.Adware.OpenCandy.C
Der Zugriff auf die folgenden Dateien wurde verweigert:
C:\Windows\CSC\v2.0.6\pq
C:\Windows\CSC\v2.0.6\temp\ea-{d4b14055-e5a9-11e2-b8d4-c24dd2264b48}
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagtrack-Listener.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession7.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\00a1cdc6f8da87660dce5b7fd4c17c0b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\011c194f17d2c7b3c189c536d73a9fe8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\023201751e220b62288b8631f1c389b9_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\02bbb1fa1139c7e69e2eaff34b0af462_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\00f691cde1c86124325c442ea937f587_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\02dc2e7a27c80d70f54d1ed5414eb243_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0d61a6c2e5d61024ec891b263520488f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0d18287544fe3047a364e8e887e1cce3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0777f30172293f38c42c780b7ece0858_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0d878ca18950201d4253b6e0c2ebda9d_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\03a0d5cc18944f142a9eff55bbf94dc6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\055f3fb14959ac20f68bd3ce38c4c0c3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\178cc8ebc3476d889922ad0a048eabfc_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\159bfdb29a7787c7990fe1cdd42be45b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0f4a67656aeaf3a54fbc94d4f090c7c3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1c5e0e6122904734041646b66aa35df1_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1a63b249a07ba62f4fedb8056ddb9346_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1db65b2847ca088020700ed0185545df_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\17bd55e29faf3706665e74ab17d62165_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1d9e35ca813481fd2ab3b499db314d32_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1e3558dd6abdc89021ed0d5912b65ef8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\20b6e3fdd871d4a68b79d1218b6cab11_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2649bd0194665ee5e40bde40d77ad5fe_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\22fb0f3ada74ae0e5e7ac74c906508c8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\213b41b507a3db4b88245483b2220de8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2e43cd33cee65861712823f4418ed398_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2d1c5f9acee209b1d42f8168284cbe32_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\233495c6156896df369a3edcc8973a54_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3124fa59b064b7e75485df460babb913_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\34ec218720a50fa2c2077a72ceed7654_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\364c8d9ebac1895133f2325881f86a9a_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3a4eae227f029c6f5e07b3e1ef337afa_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\29fdc9f78f5630e66c1c02fc85541881_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3bfe62336a80abbab48f3b09e51213c7_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3a7cde7448d1adbc8394e5b0e962536e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\366f4c5c1be1c402e2a751597cbb52bd_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\41335a47e8250f82d7db0ff20b09ef39_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\33a2ee8ecdf7248e520b345223fc86c6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3d07b73a5c050e8b0aa749d868f03dc9_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\427b894744ab3413eb6a7bdc9a6e720e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4243abdb70475fc796e189448bf0a1a2_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\43f49d0e4f4d6c77710ec33ab1f5209b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\444228f9fd3423e791f27d769e770a38_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3c0c081c92f916c6902b3c2ac4819f17_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0a1feed3270c1ba7325fdea8d25cf559_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\57a63385b1785026c4e38b9a41f9a735_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\55eba0d9eae74b9adc1d10d9dbd79e61_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5059f60efa059c46ddef1148ed347ba3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\53e61a10d42d1aab9030d81e43e4bccf_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\59610ba6ecf39fda9e4f3d9d908bc9af_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\59643043be2e46a391e05430720fa713_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5acd401533bc1ffa83bb8709e690337b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4ed7ddf7ac008c4287b55bf286f1f31b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5bf4249d8da1c324022cf007bfb37464_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6327019b9143986aaff12236f795603e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\67ad211cfdee784aec243aa48addcbeb_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\67b0add1802d472dd50fde1ae92535bd_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5a3a5cc509b9899319fffefc793bc4d6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\467173fec7ce74b875452b35b3704f91_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6f7b37a3c8592422312757f1fdd61898_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6e74ff7d1a57d76024e35881230b97a7_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\58fcd2035e13512b5d0991d42808bc25_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5e2562732b49f302fb034da555f3e3ad_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\782f3e0bd53e69eb7841e9c6aa4c3cc5_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\785e4b2e742a5eca6280c3927d89a6f1_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\78cdd3808893edeecea8847ee6461042_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7b53c77a32f8cf6c29d17bbed7477b7e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7b5a5add172b1e2ffe462d661f1f70e6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\75961b20949b544e9a0052aa68021c75_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7c6fbbbf4e0834746ec7fd0109f1cf9f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\73f1a754b57f6522ed77e7b7c83f609b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7f81dbd807e323df668e8c6ef823aa56_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8074a7f4042e90d0bcc01352b95563cc_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8a24ad4f51564937f7943483364a68c3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\79f96c13d1e2f9ab3e916110b3362995_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\812d7ca98fd28e23db5d564d5dd650e0_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8d90f57d2e44f23442fb7ab00add0cbc_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8906d2bb36d0bf0301144040d4af6fe6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\85af7556240973e13b2326b31eaa3475_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8eb82f5a3e5052dc90e34c55ba8b515c_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\98f455e4c1fa6e40d926161013c9beb3_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\91062bd58f5bd066460ce11e60e090b4_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9996c1c78f6e9ace784035c63fcbcc00_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\96bd6496ce7f118a7c0a06d145684edb_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9b77b375ab07f135a203c66c559315a8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\90d2df569251e0547e79309f6d3272e4_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9b6d6704c5421bb15dc9f9dd2ede071a_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a344b9df4b735d6779f3f6ccc931d524_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9945833e3df250537fcc57257bf5b9ca_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9e939303d8766181c33a0ef07aa911c9_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a4594bd026fbf124c9ffc2c2603bc726_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a606a4d9934ad4c9c51d43a68324dd8a_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a7251d977c31defc7508f1a3e3ac0564_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9d15a88cb49a818f2be834a2c4302844_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ad59a015199a8ea2a17b8e08f0052a52_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a5bb21fda027444ababd8aeede70cf6f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a656f42a0c2b934b4f58dde5b0797b13_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ad74b01d0778b27f875414ed9379a9bd_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b1262ecc0110434a4427a9f9ddcf5008_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\af3d7aeadaec66debcc2b628216b4516_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\adf8cb412e9fdf3644b590021883fc6d_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b0202edef52eb07da51153480ff2c1c6_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b34e621f87e03642f0a025966be6944c_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\bb37b09a7536e31e60026b8dbdfb4f4e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ba1b11095004eae8a2baff39826e7c97_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c22b80da8a43f5ef37208104561066a1_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c5aa4d01a123bd9f1227f6384321339a_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\bec9a9ffef6df12e9151ca1cf90e9d10_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\bcdb86c17ef1af8156293f32c445363f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\cca26a8fa472b418f90ebc708c9e2b0f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\cfe6a8d464404415b2197f8b3dd30685_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c8081f79694ae72dff1367ba52b2b1b2_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d5a59db864c9a8eeedc19efcb2de31ef_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ac2dcb22bb59808e1869f9ef2c0c6e7c_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\da53fe48eac25bf56a184e1e63a1fc8e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\cf328944aa6f92a6bbfa75fee05ce199_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dbfbbec60d2f9a61783e7c009b83814e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\aa360ed6122c9fa680ecbb60adb5883c_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dd9795e5c98b8490dfe80c605c10239b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e30533e121ed2b879f02bb7e58d718d8_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ea1c796f0718a3975179cc5fb1f43f0b_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e565f5edc5b293408c42897e702b324f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ed54c8e9e97fecf7087b1bb15d85707c_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e17b5dac4dfd2d9f7c579c841fde5570_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ddb8e7561aa5961f0abd05661fd25d81_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f087f6ad968967607516736dbfabc63f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dcecd361aade854cd103c0bb478a6d71_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f690df21d49d60064910eaf455af0d48_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fbdb3b6ebc3fb9623a726106795ba90f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e9daf96e60c7683d526f52bcdf9df18d_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc31bd23d240c5558bb4aadff978e97f_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1039333e511ed11c6a1c71f80b7f3e_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f1a9ce9068d655110911fc1c57cb0885_6d91a9d2-a3c5-4ecc-90ec-e0cc8d34faf9
C:\ProgramData\Microsoft\Diagnosis\users.dat
C:\ProgramData\Microsoft\Diagnosis\events10.rbs
C:\ProgramData\Microsoft\Diagnosis\events11.rbs
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\cfc.flights.json
C:\ProgramData\Microsoft\Diagnosis\events01.rbs
C:\System Volume Information\MountPointManagerRemoteDatabase
C:\System Volume Information\Syscache.hve
C:\System Volume Information\Syscache.hve.LOG1
C:\System Volume Information\Syscache.hve.LOG2
Die folgenden Dateien sind Passwortgeschützt:
C:\Users\Lampe\Documents\Betrieb\ASA\EVB_CC4S6FY_V087270060901206304134.pdf
C:\Users\Lampe\Documents\Betrieb\ASA\EVB_CCLW8QK_V087270060901206316174.pdf
C:\Users\Lampe\Documents\Betrieb\ASA\VB_V087270060907064212069_CCTK70C.pdf
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.dat
C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\dgex...exe_7c52366dae340a59_0001.0004_none_bbd7a5b5e2a023aa\Daten\Rezepte\GV01_Rezepte.NWBBACKUP
C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\dgex...exe_7c52366dae340a59_0001.0004_none_bbd7a5b5e2a023aa\Daten\Grundtabellen\BLS_3.01.zip
C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\dgex..tion_7c52366dae340a59_0001.0004_6d2c950e6a2dc120\Daten\Grundtabellen\BLS_3.01.zip
C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\dgex..tion_7c52366dae340a59_0001.0004_6d2c950e6a2dc120\Daten\Rezepte\GV01_Rezepte.NWBBACKUP
C:\Users\Lampe\Music\iTunes\iTunes Media\Mobile Applications\Sokoban 1.1.2.ipa
Code:
ATTFilter # AdwCleaner v4.207 - Bericht erstellt 08/07/2015 um 07:24:22
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-07-05.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Lampe - LAMPE-PC
# Gestarted von : C:\Users\Lampe\Downloads\adwcleaner_4.207.exe
# Option : Suchlauf
***** [ Dienste ] *****
Dienst Gefunden : WindowsMangerProtect
***** [ Dateien / Ordner ] *****
Ordner Gefunden : C:\Program Files (x86)\Search Extensions
Ordner Gefunden : C:\Program Files (x86)\WordShark_1.10.0.19
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\BrowserDefender
Ordner Gefunden : C:\ProgramData\WindowsMangerProtect
Ordner Gefunden : C:\Users\Lampe\AppData\Local\Temp\mt_ffx
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\omniboxes
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\pdfforge
***** [ Geplante Tasks ] *****
Task Gefunden : Final Media Player Update Checker
Task Gefunden : RocketTab
Task Gefunden : RocketTab Update Task
***** [ Verknüpfungen ] *****
Verknüpfung Infiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Infiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.omniboxes.com/?type=sc&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Schlüssel Gefunden : HKCU\Software\APN PIP
Schlüssel Gefunden : HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : HKCU\Software\BABSOLUTION
Schlüssel Gefunden : HKCU\Software\Bitberry
Schlüssel Gefunden : HKCU\Software\e53de8db56fe947
Schlüssel Gefunden : HKCU\Software\HomeTab
Schlüssel Gefunden : HKCU\Software\Kromtech
Schlüssel Gefunden : HKCU\Software\Linkey
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\RocketTabInstalled
Schlüssel Gefunden : HKCU\Software\rttasks
Schlüssel Gefunden : HKCU\Software\Search Extensions
Schlüssel Gefunden : HKCU\Software\SearchProtectWS
Schlüssel Gefunden : HKCU\Software\simplytech
Schlüssel Gefunden : HKCU\Software\Simplytech\HomeTab
Schlüssel Gefunden : HKCU\Software\TNT2
Schlüssel Gefunden : HKCU\Software\WajIEnhance
Schlüssel Gefunden : HKCU\Software\WajIntEnhance
Schlüssel Gefunden : [x64] HKCU\Software\APN PIP
Schlüssel Gefunden : [x64] HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : [x64] HKCU\Software\BABSOLUTION
Schlüssel Gefunden : [x64] HKCU\Software\Bitberry
Schlüssel Gefunden : [x64] HKCU\Software\HomeTab
Schlüssel Gefunden : [x64] HKCU\Software\Kromtech
Schlüssel Gefunden : [x64] HKCU\Software\Linkey
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\RocketTabInstalled
Schlüssel Gefunden : [x64] HKCU\Software\rttasks
Schlüssel Gefunden : [x64] HKCU\Software\Search Extensions
Schlüssel Gefunden : [x64] HKCU\Software\SearchProtectWS
Schlüssel Gefunden : [x64] HKCU\Software\simplytech
Schlüssel Gefunden : [x64] HKCU\Software\Simplytech\HomeTab
Schlüssel Gefunden : [x64] HKCU\Software\TNT2
Schlüssel Gefunden : [x64] HKCU\Software\WajIEnhance
Schlüssel Gefunden : [x64] HKCU\Software\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\AIM Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Features\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\SOFTWARE\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\e53de8db56fe947
Schlüssel Gefunden : HKLM\SOFTWARE\Iminent
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\omniboxes uninstall
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.19
Schlüssel Gefunden : HKLM\SOFTWARE\omniboxesSoftware
Schlüssel Gefunden : HKLM\SOFTWARE\RocketTab
Schlüssel Gefunden : HKLM\SOFTWARE\SearchProtect
Schlüssel Gefunden : HKLM\SOFTWARE\searchult
Schlüssel Gefunden : HKLM\SOFTWARE\SpeedBit
Schlüssel Gefunden : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gefunden : HKLM\SOFTWARE\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\WordShark_1.10.0.19
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93BAD29AC2E44034A96BCB446EB8552E
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.omniboxes.com/web/?type=ds&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.omniboxes.com/?type=hp&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.omniboxes.com/?type=hp&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.omniboxes.com/web/?type=ds&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X&q={searchTerms}
-\\ Google Chrome v43.0.2357.132
*************************
AdwCleaner[R0].txt - [10352 Bytes] - [08/07/2015 07:24:22]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [10412 Bytes] ##########
Code:
ATTFilter # AdwCleaner v4.207 - Bericht erstellt 08/07/2015 um 07:26:04
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-07-05.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Lampe - LAMPE-PC
# Gestarted von : C:\Users\Lampe\Downloads\adwcleaner_4.207.exe
# Option : Suchlauf
***** [ Dienste ] *****
Dienst Gefunden : WindowsMangerProtect
***** [ Dateien / Ordner ] *****
Ordner Gefunden : C:\Program Files (x86)\Search Extensions
Ordner Gefunden : C:\Program Files (x86)\WordShark_1.10.0.19
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\BrowserDefender
Ordner Gefunden : C:\ProgramData\WindowsMangerProtect
Ordner Gefunden : C:\Users\Lampe\AppData\Local\Temp\mt_ffx
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\omniboxes
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Users\Lampe\AppData\Roaming\pdfforge
***** [ Geplante Tasks ] *****
Task Gefunden : Final Media Player Update Checker
Task Gefunden : RocketTab
Task Gefunden : RocketTab Update Task
***** [ Verknüpfungen ] *****
Verknüpfung Infiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Infiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Infiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.omniboxes.com/?type=sc&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Schlüssel Gefunden : HKCU\Software\APN PIP
Schlüssel Gefunden : HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : HKCU\Software\BABSOLUTION
Schlüssel Gefunden : HKCU\Software\Bitberry
Schlüssel Gefunden : HKCU\Software\e53de8db56fe947
Schlüssel Gefunden : HKCU\Software\HomeTab
Schlüssel Gefunden : HKCU\Software\Kromtech
Schlüssel Gefunden : HKCU\Software\Linkey
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\RocketTabInstalled
Schlüssel Gefunden : HKCU\Software\rttasks
Schlüssel Gefunden : HKCU\Software\Search Extensions
Schlüssel Gefunden : HKCU\Software\SearchProtectWS
Schlüssel Gefunden : HKCU\Software\simplytech
Schlüssel Gefunden : HKCU\Software\Simplytech\HomeTab
Schlüssel Gefunden : HKCU\Software\TNT2
Schlüssel Gefunden : HKCU\Software\WajIEnhance
Schlüssel Gefunden : HKCU\Software\WajIntEnhance
Schlüssel Gefunden : [x64] HKCU\Software\APN PIP
Schlüssel Gefunden : [x64] HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : [x64] HKCU\Software\BABSOLUTION
Schlüssel Gefunden : [x64] HKCU\Software\Bitberry
Schlüssel Gefunden : [x64] HKCU\Software\HomeTab
Schlüssel Gefunden : [x64] HKCU\Software\Kromtech
Schlüssel Gefunden : [x64] HKCU\Software\Linkey
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\RocketTabInstalled
Schlüssel Gefunden : [x64] HKCU\Software\rttasks
Schlüssel Gefunden : [x64] HKCU\Software\Search Extensions
Schlüssel Gefunden : [x64] HKCU\Software\SearchProtectWS
Schlüssel Gefunden : [x64] HKCU\Software\simplytech
Schlüssel Gefunden : [x64] HKCU\Software\Simplytech\HomeTab
Schlüssel Gefunden : [x64] HKCU\Software\TNT2
Schlüssel Gefunden : [x64] HKCU\Software\WajIEnhance
Schlüssel Gefunden : [x64] HKCU\Software\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\AIM Toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Features\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\SOFTWARE\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\e53de8db56fe947
Schlüssel Gefunden : HKLM\SOFTWARE\Iminent
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\omniboxes uninstall
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.19
Schlüssel Gefunden : HKLM\SOFTWARE\omniboxesSoftware
Schlüssel Gefunden : HKLM\SOFTWARE\RocketTab
Schlüssel Gefunden : HKLM\SOFTWARE\SearchProtect
Schlüssel Gefunden : HKLM\SOFTWARE\searchult
Schlüssel Gefunden : HKLM\SOFTWARE\SpeedBit
Schlüssel Gefunden : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gefunden : HKLM\SOFTWARE\WajIntEnhance
Schlüssel Gefunden : HKLM\SOFTWARE\WordShark_1.10.0.19
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93BAD29AC2E44034A96BCB446EB8552E
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.omniboxes.com/web/?type=ds&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.omniboxes.com/?type=hp&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.omniboxes.com/?type=hp&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.omniboxes.com/web/?type=ds&ts=1436285106&z=0ce58093cabd604975ad346gdzfc6q9o5bewaeatft&from=tti&uid=ST2000DM001-1CH164_S1E22H7XXXXXS1E22H7X&q={searchTerms}
-\\ Google Chrome v43.0.2357.132
*************************
AdwCleaner[R0].txt - [10604 Bytes] - [08/07/2015 07:24:22]
AdwCleaner[R1].txt - [10412 Bytes] - [08/07/2015 07:26:04]
########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [10472 Bytes] ##########
Code:
ATTFilter # AdwCleaner v4.207 - Bericht erstellt 08/07/2015 um 07:26:44
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-07-05.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Lampe - LAMPE-PC
# Gestarted von : C:\Users\Lampe\Downloads\adwcleaner_4.207.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : WindowsMangerProtect
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files (x86)\Search Extensions
Ordner Gelöscht : C:\Program Files (x86)\WordShark_1.10.0.19
Ordner Gelöscht : C:\Users\Lampe\AppData\Local\Temp\mt_ffx
Ordner Gelöscht : C:\Users\Lampe\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Lampe\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Lampe\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Lampe\AppData\Roaming\omniboxes
***** [ Geplante Tasks ] *****
Task Gelöscht : Final Media Player Update Checker
Task Gelöscht : RocketTab
Task Gelöscht : RocketTab Update Task
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Lampe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\e53de8db56fe947
Schlüssel Gelöscht : HKLM\SOFTWARE\e53de8db56fe947
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKCU\Software\BABSOLUTION
Schlüssel Gelöscht : HKCU\Software\Bitberry
Schlüssel Gelöscht : HKCU\Software\HomeTab
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RocketTabInstalled
Schlüssel Gelöscht : HKCU\Software\Search Extensions
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\WajIEnhance
Schlüssel Gelöscht : HKCU\Software\TNT2
Schlüssel Gelöscht : HKCU\Software\WajIntEnhance
Schlüssel Gelöscht : HKCU\Software\rttasks
Schlüssel Gelöscht : HKCU\Software\SearchProtectWS
Schlüssel Gelöscht : HKCU\Software\Linkey
Schlüssel Gelöscht : HKCU\Software\Kromtech
Schlüssel Gelöscht : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\RocketTab
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\WajIntEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\omniboxesSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\SpeedBit
Schlüssel Gelöscht : HKLM\SOFTWARE\AIM Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\searchult
Schlüssel Gelöscht : HKLM\SOFTWARE\WordShark_1.10.0.19
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\omniboxes uninstall
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WordShark_1.10.0.19
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\93BAD29AC2E44034A96BCB446EB8552E
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Google Chrome v43.0.2357.132
*************************
AdwCleaner[R0].txt - [10604 Bytes] - [08/07/2015 07:24:22]
AdwCleaner[R1].txt - [10664 Bytes] - [08/07/2015 07:26:04]
AdwCleaner[S0].txt - [8362 Bytes] - [08/07/2015 07:26:44]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8421 Bytes] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 08.07.2015 Suchlaufzeit: 07:41 Protokolldatei: Malwarebytes1.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.08.01 Rootkit-Datenbank: v2015.07.07.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Lampe Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgebrochen Durchsuchte Objekte: 99169 Abgelaufene Zeit: 33 Min., 22 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 1 PUP.Optional.WordShark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wsfd_1_10_0_19, In Quarantäne, [c58c904f078326106c3ce78814ee01ff], Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 5 PUP.Optional.WordShark.A, C:\Windows\System32\drivers\wsfd_1_10_0_19.sys, In Quarantäne, [c58c904f078326106c3ce78814ee01ff], PUP.Optional.Babylon.A, C:\Users\Lampe\AppData\Local\Temp\39144F70-BAB0-7891-B2DA-C538CCE702E4\Latest\BExternal.dll, In Quarantäne, [53fef3ec5733fb3b4dd3ed38a759f40c], Trojan.RotBrowse, C:\Users\Lampe\AppData\Local\Temp\39144F70-BAB0-7891-B2DA-C538CCE702E4\Latest\ccp.exe, In Quarantäne, [65ec637c23676ccab24adf31a660c040], PUP.Optional.Babylon.A, C:\Users\Lampe\AppData\Local\Temp\39144F70-BAB0-7891-B2DA-C538CCE702E4\Latest\CrxInstaller.dll, In Quarantäne, [98b98c5326642b0b3638480ba75acf31], PUP.Optional.Delta, C:\Users\Lampe\AppData\Local\Temp\39144F70-BAB0-7891-B2DA-C538CCE702E4\Latest\MyDeltaTB.exe, In Quarantäne, [312089561c6ec274421f2221c0410ef2], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Error, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Update, Bad md5 or size: akadomains, 11, Error, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Update, Bad md5 or size: akaips, 11, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, Remediation Database, 2015.5.13.1, 2015.7.1.2, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, Domain Database, 0.0.0.0, 2015.6.12.1, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, IP Database, 0.0.0.0, 2015.6.12.1, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, Rootkit Database, 2015.6.2.1, 2015.7.7.1, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, AKA IP Database, 0.0.0.0, 2015.6.12.1, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, AKA Domain Database, 0.0.0.0, 2015.6.12.1, Update, 08.07.2015 07:41, SYSTEM, LAMPE-PC, Manual, Malware Database, 2015.6.3.3, 2015.7.8.1, Scan, 08.07.2015 08:15, SYSTEM, LAMPE-PC, Manual, Start: 08.07.2015 07:41, Dauer: 33 Min. 22 Sek., Bedrohungssuchlauf, Abgebrochen, 1 Malware-Erkennung, 5 Nicht-Malware-Erkennungen, Error, 08.07.2015 08:17, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 08:17, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 08:17, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 08:23, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 08:23, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 08:23, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Update, 08.07.2015 10:10, SYSTEM, LAMPE-PC, Manual, Malware Database, 2015.7.8.1, 2015.7.8.2, Scan, 08.07.2015 10:29, SYSTEM, LAMPE-PC, Manual, Start: 08.07.2015 10:10, Dauer: 18 Min. 49 Sek., Bedrohungssuchlauf, Abgeschlossen, 0 Malware-Erkennung, 10 Nicht-Malware-Erkennungen, Error, 08.07.2015 10:31, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 10:31, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 10:31, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 11:15, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 11:15, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 11:15, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 13:32, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 13:32, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 13:32, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 13:46, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 13:46, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 13:46, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 13:48, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 13:48, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 13:48, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 13:52, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 13:52, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 13:52, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, Error, 08.07.2015 14:04, SYSTEM, LAMPE-PC, Protection, IsLicensed, 13, Protection, 08.07.2015 14:04, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopping, Protection, 08.07.2015 14:04, SYSTEM, LAMPE-PC, Protection, Malware Protection, Stopped, (end) |
|
08.07.2015, 14:48
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Junkware Removal Tool (JRT) Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.07.2015, 14:58
| #5 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrCode:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.3.7 (07.08.2015:2)
OS: Windows 7 Professional x64
Ran by Lampe on 08.07.2015 at 15:55:09,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\ProgramData\Google
Successfully deleted: [Folder] C:\Users\Lampe\documents\add-in express
~~~ Chrome
[C:\Users\Lampe\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\Lampe\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\Lampe\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\Lampe\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.07.2015 at 15:57:25,78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
08.07.2015, 15:05
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken 
__________________ --> Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr |
|
08.07.2015, 15:12
| #7 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by Lampe (administrator) on LAMPE-PC on 08-07-2015 16:09:07
Running from C:\Users\Lampe\Desktop
Loaded Profiles: Lampe (Available Profiles: Lampe & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(G DATA Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Dropbox, Inc.) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
(G DATA Software AG) C:\Program Files (x86)\G Data\InternetSecurity\GUI\GDSC.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(ASBYTE) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncingOLWatchService.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6457960 2011-12-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-16] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [OfficeScanNT Monitor] => c:\Program Files (x86)\Trend Micro\Client Server Security Agent\pccntmon.exe [1708048 2011-02-27] (Trend Micro Inc.)
HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1864312 2015-06-16] (G DATA Software AG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM\...\RunOnce: [PC-Doctor for Windows REBOOT] => [X]
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [SyncService] => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe [1730144 2013-07-31] (ASBYTE)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [455392 2015-04-10] (Sony)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Spotify Web Helper] => C:\Users\Lampe\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030648 2015-07-07] (Spotify Ltd)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [AVMUSBFernanschluss] => C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe [139264 2014-01-04] (AVM Berlin)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Spotify] => C:\Users\Lampe\AppData\Roaming\Spotify\Spotify.exe [7504952 2015-07-07] (Spotify Ltd)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Run: [Dropbox Update] => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-28] (Dropbox, Inc.)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Run: [SyncService] => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe [1730144 2013-07-31] (ASBYTE)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-04-08]
ShortcutTarget: Dropbox.lnk -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [!1SYNCING.NET Unread] -> {5C9D3C37-2C95-4b5b-9EF0-4E0AFCA5E78A} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!2SYNCING.NET Shared Folder] -> {FB8CDFB0-B508-4F12-A91E-26E68ABB4DAE} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!3SYNCING.NET CheckedOutByTeammate] -> {5CBF1ABD-2D6A-4570-9A4F-A47798BBFC08} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!4SYNCING.NET CheckedOutByMe] -> {B133F3E9-124C-4669-BFFF-1B74508B5A84} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [!5SYNCING.NET DownArrow] -> {0B914147-F836-4cfa-893A-ECE90B815982} => C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [2013-07-31] (ASBYTE)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll [2015-06-10] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000 -> {FEDF0020-63D5-4405-B17C-0D73462DF842} URL =
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll [2010-07-21] (Trend Micro Inc.)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll [2010-07-21] (Trend Micro Inc.)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll [2012-03-08] (Atheros Commnucations)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Users\Lampe\AppData\Local\Programs\ANDI 2013\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-12-21] (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-04] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-04] (Google Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg.dll [2010-07-21] (Trend Micro Inc.)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\TmIEPlg32.dll [2010-07-21] (Trend Micro Inc.)
ShellExecuteHooks: CExecuteHook Object - {7B0E5486-E11D-437f-AC8B-7901C7D3FCCB} - C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\ShellUI_1.dll [1893984 2013-07-31] (ASBYTE)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{1B0624B1-6D37-470C-93F6-EF7E5628FF23}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{32E84A78-030F-46C0-A781-33E929293F85}: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Lampe\AppData\Roaming\Mozilla\Firefox\Profiles\0fdypcb4.default
FF Homepage: hxxp://www.spiegel.de/
FF NetworkProxy: "type", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-20] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension
FF Extension: Trend Micro NSC Firefox Extension - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\bho\1009\FirefoxExtension [2013-07-05]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-07-10]
Chrome:
=======
CHR Profile: C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-23]
CHR Extension: (Google Drive) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-23]
CHR Extension: (YouTube) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-23]
CHR Extension: (Google Search) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-07]
CHR Extension: (Google Wallet) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-18]
CHR Extension: (Gmail) - C:\Users\Lampe\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [107648 2012-03-08] (Atheros Commnucations) [File not signed]
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2558072 2015-06-19] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [966776 2015-06-16] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [3711712 2015-06-16] (G Data Software AG)
S3 awhost32; C:\Program Files (x86)\Symantec\pcAnywhere\awhost32.exe [793480 2012-04-02] (Symantec Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2557136 2015-02-26] (Dell Inc.)
S2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201936 2015-02-26] (Dell Inc.)
S2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [232152 2015-05-20] (Dell Inc.)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3202368 2015-06-19] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [789624 2015-06-16] (G Data Software AG)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093944 2011-01-19] (Symantec Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 ntrtscan; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe [1836616 2011-02-18] (Trend Micro Inc.)
S2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
S2 SN_Service; C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SN_Service.exe [32768 2013-05-03] (ASBYTE) [File not signed]
S2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-04-10] (Dell Inc.)
S2 svcGenericHost; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe [50704 2011-04-07] (Trend Micro Inc.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
S2 tmlisten; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe [2060896 2011-02-18] (Trend Micro Inc.)
S3 TmPfw; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe [596032 2010-07-21] (Trend Micro Inc.)
S3 TmProxy; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe [917840 2010-07-21] (Trend Micro Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [159360 2012-03-08] (Atheros) [File not signed]
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-03-28] (Atheros) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2014-01-04] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2014-01-04] (AVM Berlin)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S2 AVMPORT; C:\Windows\SysWOW64\drivers\avmport.sys [66472 2009-10-02] (AVM Berlin)
R1 awecho; C:\Windows\SysWow64\drivers\awechomd.sys [16696 2012-04-01] (Symantec Corporation)
R1 AW_HOST; C:\Windows\SysWow64\drivers\aw_host5.sys [23864 2012-04-01] (Symantec Corporation)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-31] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-31] (Dell Computer Corporation)
S3 FUS2BASE; C:\Windows\System32\DRIVERS\fus2base.sys [696832 2009-06-10] (AVM Berlin)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [158720 2015-07-07] (G Data Software AG)
R3 GDKBB; C:\Windows\system32\drivers\GDKBB64.sys [27648 2015-07-07] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2015-07-07] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [230912 2015-07-07] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [76288 2015-07-07] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [65024 2015-07-07] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2015-07-08] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [125952 2015-07-07] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R2 TmFilter; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmXPFlt.sys [310032 2011-03-24] (Trend Micro Inc.)
R1 tmlwf; C:\Windows\System32\DRIVERS\tmlwf.sys [196688 2010-11-08] (Trend Micro Inc.)
R2 TmPreFilter; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPreFlt.sys [42768 2011-03-24] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [108624 2010-11-08] (Trend Micro Inc.)
R2 tmwfp; C:\Windows\System32\DRIVERS\tmwfp.sys [338000 2010-11-08] (Trend Micro Inc.)
R2 VSApiNt; c:\Program Files (x86)\Trend Micro\Client Server Security Agent\VSApiNt.sys [1988368 2011-03-24] (Trend Micro Inc.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-08 15:57 - 2015-07-08 15:57 - 00001646 _____ C:\Users\Lampe\Desktop\JRT.txt
2015-07-08 15:51 - 2015-07-08 15:51 - 00000207 _____ C:\Windows\tweaking.com-regbackup-lampe-pc-windows-7-professional-(64-bit).dat
2015-07-08 15:51 - 2015-07-08 15:51 - 00000000 ____D C:\RegBackup
2015-07-08 15:50 - 2015-07-08 15:50 - 02953707 ____N (Malwarebytes Corporation) C:\Users\Lampe\Desktop\JRT.exe
2015-07-08 14:53 - 2015-07-08 14:53 - 00003218 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-07-08 14:53 - 2015-07-08 14:53 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2015-07-08 14:53 - 2015-07-08 14:53 - 00000000 ____D C:\Program Files\Dell Support Center
2015-07-08 14:26 - 2015-07-08 14:26 - 00022914 _____ C:\Users\Lampe\Desktop\G*DATA Protokoll ID 5863.txt
2015-07-08 14:22 - 2015-07-08 14:22 - 00000000 ___RD C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-07-08 14:21 - 2015-07-08 14:21 - 00003664 _____ C:\Users\Lampe\Desktop\Malwarebytes2.txt
2015-07-08 14:20 - 2015-07-08 14:20 - 00002070 _____ C:\Users\Lampe\Desktop\Malwarebytes1.txt
2015-07-08 14:18 - 2015-07-08 07:26 - 00010664 _____ C:\Users\Lampe\Desktop\AdwCleaner[R1].txt
2015-07-08 14:18 - 2015-07-08 07:26 - 00008537 _____ C:\Users\Lampe\Desktop\AdwCleaner[S0].txt
2015-07-08 14:18 - 2015-07-08 07:25 - 00010604 _____ C:\Users\Lampe\Desktop\AdwCleaner[R0].txt
2015-07-08 14:12 - 2015-07-08 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-08 14:02 - 2015-07-08 14:02 - 00004438 _____ C:\Users\Lampe\Desktop\Gmer.txt
2015-07-08 13:37 - 2015-07-08 13:37 - 00043549 _____ C:\Users\Lampe\Desktop\Addition.txt
2015-07-08 13:35 - 2015-07-08 16:09 - 00024768 _____ C:\Users\Lampe\Desktop\FRST.txt
2015-07-08 13:30 - 2015-07-08 16:09 - 00000000 ____D C:\FRST
2015-07-08 13:28 - 2015-07-08 13:28 - 00000472 _____ C:\Users\Lampe\Desktop\defogger_disable.log
2015-07-08 13:28 - 2015-07-08 13:28 - 00000000 _____ C:\Users\Lampe\defogger_reenable
2015-07-08 13:28 - 2015-07-08 13:06 - 02112512 ____N (Farbar) C:\Users\Lampe\Desktop\FRST64.exe
2015-07-08 13:27 - 2015-07-08 13:07 - 00380416 ____N C:\Users\Lampe\Desktop\Gmer-19357.exe
2015-07-08 13:27 - 2015-07-08 13:05 - 00050477 ____N C:\Users\Lampe\Desktop\Defogger.exe
2015-07-08 12:46 - 2015-07-08 12:46 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-08 12:46 - 2015-07-08 12:46 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-08 12:46 - 2015-07-08 12:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-08 11:53 - 2015-07-08 11:53 - 00002966 _____ C:\Windows\System32\Tasks\{3B8520A2-DB72-4DE1-88FC-A6D387E0EF14}
2015-07-08 11:10 - 2015-07-08 11:36 - 00000000 ____D C:\Users\Lampe\AppData\Local\Mozilla
2015-07-08 11:10 - 2015-07-08 11:11 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Mozilla
2015-07-08 11:10 - 2015-07-08 11:10 - 00000000 ____D C:\ProgramData\Mozilla
2015-07-08 11:10 - 2015-07-08 11:09 - 40945288 ____N C:\Users\Lampe\Downloads\Firefox_Setup_39.0de.exe
2015-07-08 11:00 - 2015-07-08 10:57 - 63320784 ____N (Microsoft Corporation) C:\Users\Lampe\Downloads\IE11_w7_Windows6.1-x64-de-de.exe
2015-07-08 07:39 - 2015-07-08 14:19 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-08 07:39 - 2015-07-08 07:39 - 00001108 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-08 07:39 - 2015-07-08 07:39 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-08 07:39 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-08 07:39 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-08 07:39 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-08 07:35 - 2015-07-08 07:29 - 24345872 ____N (Malwarebytes Corporation ) C:\Users\Lampe\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-08 07:23 - 2015-07-08 14:21 - 00000000 ____D C:\AdwCleaner
2015-07-08 07:23 - 2015-07-08 07:21 - 02244096 ____N C:\Users\Lampe\Downloads\adwcleaner_4.207.exe
2015-07-07 19:51 - 2015-07-07 19:51 - 00027648 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBB64.sys
2015-07-07 19:51 - 2015-07-07 19:51 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_GDKBB64_01007.Wdf
2015-07-07 19:51 - 2015-07-07 19:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA TOTAL PROTECTION
2015-07-07 18:05 - 2015-07-07 18:05 - 00000000 _____ C:\Windows\prleth.sys
2015-07-07 18:05 - 2015-07-07 18:05 - 00000000 _____ C:\Windows\hgfs.sys
2015-07-02 09:35 - 2015-07-02 09:35 - 01453016 _____ C:\Windows\Minidump\070215-39608-01.dmp
2015-07-01 13:54 - 2015-07-08 14:36 - 00005136 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Lampe-PC-Lampe Lampe-PC
2015-06-28 08:46 - 2015-06-28 08:46 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-28 08:45 - 2015-07-08 15:50 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA.job
2015-06-28 08:45 - 2015-07-08 08:50 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core.job
2015-06-28 08:45 - 2015-06-28 08:45 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA
2015-06-28 08:45 - 2015-06-28 08:45 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core
2015-06-28 08:45 - 2015-06-28 08:45 - 00000000 ____D C:\Users\Lampe\AppData\Local\Dropbox
2015-06-28 08:45 - 2015-06-28 08:45 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-28 08:40 - 2015-06-28 08:40 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 13:10 - 2015-06-24 13:10 - 00009336 ____N (G*DATA Software AG) C:\Windows\SysWOW64\GDScrSv.de.dll
2015-06-24 12:06 - 2015-06-24 12:06 - 02230392 ____N (G Data Software AG) C:\Windows\SysWOW64\GdScrSv.scr
2015-06-15 08:37 - 2015-06-15 08:37 - 00000360 _____ C:\Users\Lampe\Downloads\Urlaub (1)
2015-06-13 14:49 - 2015-06-13 14:49 - 00011967 _____ C:\Users\Lampe\Documents\Strategien Gülle 2015.xlsx
2015-06-12 15:16 - 2015-06-12 15:16 - 00000000 ____D C:\Program Files (x86)\Dell Update
2015-06-12 13:45 - 2015-06-12 13:45 - 00002158 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-06-10 08:52 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 08:52 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 08:52 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 08:52 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 08:52 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 08:52 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 08:52 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 08:52 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 08:52 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 08:52 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 08:52 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 08:52 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 08:52 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 08:52 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 08:52 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 08:52 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 08:52 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 08:52 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 08:52 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 08:52 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 08:52 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 08:52 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 08:52 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 08:52 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 08:52 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 08:52 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 08:52 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 08:52 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 08:52 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 08:52 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 08:52 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 08:52 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 08:52 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 08:52 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 08:52 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 08:52 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 08:52 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 08:52 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 08:52 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 08:52 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 08:52 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 08:52 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 08:52 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 08:52 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 08:52 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 08:52 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 08:52 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 08:52 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 08:52 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 08:52 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 08:52 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 08:52 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 08:52 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 08:52 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 08:52 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 08:52 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 08:52 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 08:52 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 08:52 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 08:52 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 08:52 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 08:52 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 08:52 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 08:52 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 08:52 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 08:52 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 08:52 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 08:52 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 08:52 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 08:52 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 08:52 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 08:52 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 08:52 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 08:52 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 08:52 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 08:52 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 08:52 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 08:52 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 08:52 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 08:52 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 08:52 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 08:52 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 08:52 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 08:52 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 08:52 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 08:52 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 08:52 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 08:52 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 08:51 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 08:51 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 08:51 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 08:51 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-09 17:30 - 2015-07-07 19:50 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\vlc
2015-06-09 17:30 - 2015-06-09 17:30 - 00000873 _____ C:\Users\Public\Desktop\VLC media player.lnk
2015-06-09 17:30 - 2015-06-09 17:30 - 00000000 ____D C:\Program Files\VideoLAN
2015-06-08 08:14 - 2015-06-08 08:16 - 00000000 ____D C:\Users\Lampe\Desktop\fotos Aumühle
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-08 16:07 - 2013-07-13 12:26 - 00000000 ____D C:\Users\Lampe\Documents\Outlook-Dateien
2015-07-08 15:58 - 2010-11-21 08:50 - 00712406 _____ C:\Windows\system32\perfh007.dat
2015-07-08 15:58 - 2010-11-21 08:50 - 00153794 _____ C:\Windows\system32\perfc007.dat
2015-07-08 15:58 - 2009-07-14 07:13 - 01650592 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-08 15:57 - 2013-08-29 11:27 - 00000000 ___RD C:\Users\Lampe\Dropbox
2015-07-08 15:57 - 2013-08-29 11:26 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Dropbox
2015-07-08 15:55 - 2013-07-10 13:59 - 00005767 _____ C:\Windows\TMFilter.log
2015-07-08 15:49 - 2013-07-05 21:39 - 01208220 _____ C:\Windows\WindowsUpdate.log
2015-07-08 15:12 - 2013-07-23 08:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-08 14:53 - 2013-07-05 22:02 - 00000000 ____D C:\ProgramData\PCDr
2015-07-08 14:53 - 2013-07-05 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-07-08 14:48 - 2013-07-15 20:07 - 00000000 ____D C:\Users\Lampe\AppData\Roaming\Spotify
2015-07-08 14:32 - 2009-07-14 06:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-08 14:32 - 2009-07-14 06:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-08 14:25 - 2013-07-05 22:07 - 00000031 _____ C:\tmuninst.ini
2015-07-08 14:24 - 2013-07-05 22:11 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2015-07-08 14:24 - 2013-07-05 22:11 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2015-07-08 14:24 - 2013-07-05 21:59 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2015-07-08 14:23 - 2013-07-23 08:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-08 14:23 - 2013-07-15 20:08 - 00000000 ____D C:\Users\Lampe\AppData\Local\Spotify
2015-07-08 14:22 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-08 14:22 - 2009-07-14 06:51 - 00388561 _____ C:\Windows\setupact.log
2015-07-08 14:21 - 2013-07-23 09:00 - 00001052 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-08 14:21 - 2013-07-09 14:09 - 00000997 _____ C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-08 14:18 - 2013-07-09 16:31 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-07-08 13:42 - 2013-07-09 16:26 - 00000000 ____D C:\Users\Lampe\AppData\Local\CrashDumps
2015-07-08 13:31 - 2010-11-21 05:47 - 00290844 _____ C:\Windows\PFRO.log
2015-07-08 13:28 - 2013-07-09 14:07 - 00000000 ____D C:\Users\Lampe
2015-07-08 12:46 - 2013-07-10 20:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-08 11:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-08 11:23 - 2013-07-10 08:40 - 00106272 _____ (G Data Software) C:\Windows\system32\Drivers\GRD.sys
2015-07-08 11:23 - 2013-07-10 08:40 - 00018160 _____ (G Data Software) C:\Windows\system32\Drivers\GdPhyMem.sys
2015-07-08 11:00 - 2013-11-27 04:00 - 00011271 _____ C:\Windows\IE11_main.log
2015-07-08 10:30 - 2013-07-05 22:05 - 00000000 ____D C:\Windows\PCHEALTH
2015-07-08 10:22 - 2013-07-23 08:59 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-08 08:16 - 2009-07-14 07:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-07-07 19:53 - 2013-07-09 16:46 - 00076288 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2015-07-07 19:51 - 2014-11-18 09:56 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2015-07-07 19:51 - 2014-11-18 09:56 - 00001980 _____ C:\Users\Public\Desktop\G DATA TOTAL PROTECTION.lnk
2015-07-07 19:51 - 2013-07-09 16:45 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2015-07-07 19:50 - 2013-07-13 16:07 - 00388310 _____ C:\Windows\DPINST.LOG
2015-07-07 19:50 - 2013-07-09 16:45 - 00230912 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2015-07-07 19:50 - 2013-07-09 16:45 - 00158720 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2015-07-07 19:50 - 2013-07-09 16:45 - 00125952 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2015-07-07 18:38 - 2013-07-15 18:26 - 00000000 ____D C:\Users\Lampe\Documents\Zugänge
2015-07-07 18:38 - 2013-07-10 08:45 - 00000000 ____D C:\Users\Lampe\Documents\Betrieb
2015-07-06 10:12 - 2013-07-14 13:46 - 00000000 ____D C:\Users\Lampe\Documents\Privat
2015-07-02 11:18 - 2014-01-14 20:06 - 00017408 ___SH C:\Users\Lampe\Documents\Thumbs.db
2015-07-02 09:38 - 2013-07-09 14:11 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-02 09:35 - 2013-07-09 15:23 - 773942232 _____ C:\Windows\MEMORY.DMP
2015-07-02 09:35 - 2013-07-09 15:23 - 00000000 ____D C:\Windows\Minidump
2015-06-30 10:02 - 2014-12-16 15:40 - 00000973 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-06-30 10:02 - 2014-12-16 15:40 - 00000961 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-06-23 13:30 - 2010-11-21 05:27 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-06-13 14:56 - 2014-01-04 13:40 - 00000000 ____D C:\Users\Lampe\AppData\Local\Deployment
2015-06-12 15:14 - 2013-07-05 21:56 - 00000000 ____D C:\ProgramData\Dell
2015-06-12 13:51 - 2015-02-12 10:46 - 00000000 ____D C:\ProgramData\SupportAssistAgent
2015-06-11 07:54 - 2014-11-13 15:27 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieBrowserModeList
2015-06-11 07:54 - 2014-04-10 10:39 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieUserList
2015-06-11 07:54 - 2014-04-10 10:39 - 00000000 __SHD C:\Users\Lampe\AppData\Local\EmieSiteList
2015-06-11 07:54 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 04:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 03:25 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-11 03:25 - 2009-07-14 06:45 - 00327872 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 03:06 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 03:02 - 2013-07-15 13:20 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 22:38 - 2015-06-02 11:27 - 00000000 ____D C:\Users\Lampe\Desktop\bilder taufe inges geb
2015-06-10 22:37 - 2014-02-05 13:21 - 00849920 ___SH C:\Users\Lampe\Desktop\Thumbs.db
2015-06-09 13:35 - 2013-08-10 13:20 - 00019194 _____ C:\Windows\avmacc.log
==================== Files in the root of some directories =======
2015-01-22 09:30 - 2015-01-22 09:30 - 0000174 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
Some files in TEMP:
====================
C:\Users\Lampe\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7c5mkq.dll
C:\Users\Lampe\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Lampe\AppData\Local\Temp\Quarantine.exe
C:\Users\Lampe\AppData\Local\Temp\SetupHomeBusinessRetail.x86.de-DE_HomeBusinessRetail_WPMXP-NTVR7-V6BF2-YG6H8-MR96P_act_1_.exe
C:\Users\Lampe\AppData\Local\Temp\sqlite3.dll
C:\Users\Lampe\AppData\Local\Temp\SyncingSetup.exe
C:\Users\Lampe\AppData\Local\Temp\uninst1.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-03 01:45
==================== End of log ============================
[CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by Lampe at 2015-07-08 16:09:40
Running from C:\Users\Lampe\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1344064752-2903933196-2754972076-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-1344064752-2903933196-2754972076-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1344064752-2903933196-2754972076-1002 - Limited - Enabled)
Lampe (S-1-5-21-1344064752-2903933196-2754972076-1000 - Administrator - Enabled) => C:\Users\Lampe
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G DATA TOTAL PROTECTION (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Trend Micro Client/Server Security Agent (Disabled - Up to date) {7193B549-236F-55EE-9AEC-F65279E59A92}
AS: Trend Micro Client/Server Security Agent Anti-Spyware (Disabled - Up to date) {CAF254AD-0555-5A60-A05C-CD200262D02F}
AS: G DATA TOTAL PROTECTION (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G*DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
FW: Trend Micro Personal Firewall (Disabled) {50C2E989-60CF-0845-AFD3-290B7D301E79}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.172 - Adobe Systems Incorporated)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0.3 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Agrilog (HKLM-x32\...\de.bertelsmann.agrilog.AgrilogPortal) (Version: 0.10.2 - UNKNOWN)
Agrilog (x32 Version: 0.10.2 - UNKNOWN) Hidden
AMD Catalyst Install Manager (HKLM\...\{0E262CBA-A8C6-3BE1-A812-D7490B4F2B09}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)
ANDI 2012 (HKLM-x32\...\{7598E3D8-48DE-4C7B-9E8E-945B6ADB071A}) (Version: 4.0.3 - LGLN Hannover)
ANDI 2013 (HKLM-x32\...\{21E3464C-EE59-4EA2-B3E1-4FCE000B8722}) (Version: 5.0.8 - LGLN Hannover)
ANDI 2015 (HKLM-x32\...\{D7A68E09-4DA6-4F3A-96A6-345E2A0BBA75}) (Version: 7.0.4 - LGLN Hannover)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.126 - Atheros)
AVM ISDN CAPI Port (HKLM-x32\...\AVM ISDN CAPI Port) (Version: - AVM Berlin)
AVM ISDN TAPI Services for CAPI (HKLM-x32\...\AVM ISDN TAPI Services) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Crystal Reports Basic Runtime for Visual Studio 2008 (HKLM-x32\...\{CE26F10F-C80F-4377-908B-1B7882AE2CE3}) (Version: 10.5.0.0 - Business Objects)
CyberLink PowerDVD 9.5 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.5.2.6102 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Data Vault (Version: 4.2.2.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.1.6664.10 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.3.60494 - Dell)
Dell Update (HKLM-x32\...\{3FB000F3-7444-41C1-A0A6-53E8FD0B7D9C}) (Version: 1.6.1007.0 - Dell Inc.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
DGExpert (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\490eb16e43b10dda) (Version: 1.4.2.2 - Deutsche Gesellschaft für Ernährung e.V.)
Dropbox (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Dropbox) (Version: 3.6.7 - Dropbox, Inc.)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
FRITZ!Box USB-Fernanschluss (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\2db37667170956ee) (Version: 2.3.2.0 - AVM Berlin)
G DATA TOTAL PROTECTION (HKLM-x32\...\{2A1FF304-D778-49F1-B340-E4BF4CDA2EB0}) (Version: 25.1.0.5 - G DATA Software AG)
GIS-Tools (HKLM-x32\...\{807D5989-073F-4956-98E3-D7926DE76D49}) (Version: 1.0.0 - ASSW-Solutions)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HELM MultiPlant II (HKLM-x32\...\HELM MultiPlant II) (Version: 4.82 - HELM-Software Ladenburg)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
LiveUpdate 3.3 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.3.0.101 - Symantec Corporation)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MOBackup - Datensicherung für Outlook (Testversion) (HKLM-x32\...\MOBackup-DatensicherungfürOutlook) (Version: 7.95 - Heiko Schröder)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Myfarm24 WebSync (HKLM-x32\...\Myfarm24 myWebSync) (Version: - )
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge)
ProFlura2013 (HKLM-x32\...\{321FA8C1-AFDD-4E1F-AA61-DB4138B0622E}) (Version: 7.0 - ASSW GmbH & Co. KG)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6537 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
SAP Crystal Reports runtime engine for .NET Framework (32-bit) (HKLM-x32\...\{436F858F-DCEF-40E5-956D-B417D1EE5E45}) (Version: 13.0.8.1216 - SAP)
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.13.8.201307151333 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.259 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.259 - Sony)
Spotify (HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Spotify) (Version: 1.0.8.59.gee82e7e6 - Spotify AB)
Symantec pcAnywhere (HKLM-x32\...\{8D94B4B5-A3E3-4BD5-851E-E14872BFC79B}) (Version: 12.5.5 - Symantec Corporation)
SYNCING.NET 5.0 (HKLM-x32\...\SYNCING.NET) (Version: 5.0 - ASBYTE)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.43879 - TeamViewer)
Trend Micro Client/Server Security Agent (HKLM-x32\...\{BED0B8A2-2986-49F8-90D6-FA008D37A3D2}) (Version: 3.5.1163 - Trend Micro)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
WinZip 17.5 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DA}) (Version: 17.5.10480 - WinZip Computing, S.L. )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{3560575F-7C2D-48AE-AB45-DAD430A95EBE}\InprocServer32 -> C:\Program Files (x86)\WinZip\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1344064752-2903933196-2754972076-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Lampe\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
==================== Restore Points =========================
30-06-2015 03:00:27 Windows Update
03-07-2015 08:43:09 Windows Update
07-07-2015 07:52:50 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {06B506CB-15F9-42F1-8F02-9E62DDC1E29B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)
Task: {41E07192-F756-4410-A88D-A21F3BE500EE} - System32\Tasks\Sichern Outlook => C:\Program Files (x86)\MOBackup\mobackup.exe [2014-02-20] (Heiko Schröder)
Task: {49AD9908-790A-4756-99AA-772A252D8280} - \WordShark Auto Updater 1.10.0.19 Core No Task File <==== ATTENTION
Task: {4D83D81C-3AE3-4557-BF2E-39A988C36C73} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28] (Dropbox, Inc.)
Task: {53807AA7-747A-425E-81E5-810331A396E1} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-28] (Dropbox, Inc.)
Task: {6246F0EE-3BC6-41C8-A116-3CC8838EE6E6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {6D0561DD-88D6-4644-A0D8-5929ABD069F0} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-04-10] (Dell Inc.)
Task: {7D59C2F0-1C7D-42DE-8E54-FB60EF09348A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-23] (Google Inc.)
Task: {7E87F4C3-6FD0-4C77-BF43-9D2E5BEC04A4} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {860A403F-73E2-43D7-90DC-0FFF1B5CA1D6} - \WordShark Auto Updater 1.10.0.19 Pending Update No Task File <==== ATTENTION
Task: {A026F9D0-4710-43F4-9A12-434FC8949DA6} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Lampe-PC-Lampe Lampe-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-05-28] (Microsoft Corporation)
Task: {B2E4A01B-612F-455F-B8B5-CC0C2D22F021} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {C632B317-990F-47FB-9CA3-5E0058845617} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {C9F1A864-77FF-43DE-A3E5-DABDF4F18B4E} - System32\Tasks\{3B8520A2-DB72-4DE1-88FC-A6D387E0EF14} => Firefox.exe
Task: {CFE9479D-BAD3-4B97-AFE1-41A0CB644782} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000Core.job => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1344064752-2903933196-2754972076-1000UA.job => C:\Users\Lampe\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2013-08-09 17:59 - 2006-02-23 11:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2013-08-09 17:59 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2015-06-16 11:17 - 2015-06-16 11:17 - 00382584 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-06-10 21:05 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-09-13 03:30 - 2014-11-21 08:42 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-07-08 15:57 - 2015-07-08 15:57 - 00043008 _____ () c:\users\lampe\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7c5mkq.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00750080 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00047616 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00865280 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00200704 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00726016 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-28 08:46 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Lampe\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2013-09-13 03:30 - 2014-11-21 08:42 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-08-29 09:35 - 2015-05-12 19:27 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2014-03-19 12:24 - 2014-07-11 08:19 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2013-09-13 03:30 - 2014-11-21 08:42 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Lampe\Documents\Agravis Beleg.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Lampe\Documents\Agravis Beleg.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Lampe\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [{3497B23A-874F-4DCF-AF1E-D24C41FEC7B8}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{580A0143-3E1D-4621-A9F1-C18FE2F328A2}] => (Allow) LPort=2869
FirewallRules: [{521C28B1-DADB-44BB-A8B9-C459D60F1525}] => (Allow) LPort=1900
FirewallRules: [{377F44F4-7ADA-4E00-BE63-68ACAB268B54}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{4DA280A4-FCEC-440B-B295-D13A438E6928}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.EXE
FirewallRules: [{05F89325-DF6B-4ED0-9EE0-77F48349CD2D}] => (Allow) C:\Users\Lampe\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{0F75333A-E9C1-4810-85C8-3E7BC2EA37D9}] => (Allow) LPort=61116
FirewallRules: [{2749FEC9-A93C-4096-9135-F63E320E6144}] => (Allow) LPort=21112
FirewallRules: [{D0306993-98E2-4FE4-9BF6-CCC1B3ADBC5B}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe
FirewallRules: [{B828B916-3AE6-4456-A4E8-4E05FC5D395B}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\SyncService.exe
FirewallRules: [{5239E099-CD08-4F73-A66B-4D1B4C76A6D7}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\NotificationService.exe
FirewallRules: [{0F8E0728-8275-43B5-BC1B-52508D894ADC}] => (Allow) C:\Program Files (x86)\ASBYTE\SYNCING.NET\bin\NotificationService.exe
FirewallRules: [{2163E2E4-762F-40AE-987E-1AB923A401C8}] => (Allow) LPort=61117
FirewallRules: [{8334CD4E-6776-46C0-A80F-EBED27A958A3}] => (Allow) C:\Program Files (x86)\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{C842D168-E1CD-4B48-9702-5C5FEC932987}] => (Allow) C:\Program Files (x86)\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe
FirewallRules: [{54EB344E-8570-4A53-BA8E-EC621BD0245D}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftC2D3.tmp\fsetup.exe
FirewallRules: [{45A16240-64D9-4E20-9888-3CF4A407F3CA}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftC2D3.tmp\fsetup.exe
FirewallRules: [{6C8B07AC-97C8-4072-9176-32BB0AFCF04F}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftA00.tmp\fsetup.exe
FirewallRules: [{77C02208-DF4A-4221-8F3D-5D2A08D8A627}] => (Allow) C:\Users\Lampe\AppData\Local\Temp\pftA00.tmp\fsetup.exe
FirewallRules: [{05BF8AD6-D622-4980-B91B-CB27D643EE11}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7CE991A4-9C67-40AA-A3C4-50A103B8BBF7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D104ADEC-23B3-47FD-AABA-7169A86DBAA3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{19107462-03D8-4774-8E2E-8538A3B3A210}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{415F9AF7-22D0-4454-A2FE-B7A01E4CD850}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{EA33C50C-25A9-4B4A-B0F8-EC90B8B1C0F6}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{E1C94697-752D-4900-9472-1C22D731882E}] => (Allow) C:\Program Files (x86)\FRITZ!\fboxset.exe
FirewallRules: [{365C98A1-724A-4446-98EF-D21BC6AD7C13}] => (Allow) C:\Program Files (x86)\FRITZ!\fboxset.exe
FirewallRules: [{7DFE3C48-2E48-488E-BD56-1A7DE023972F}] => (Allow) C:\Program Files (x86)\FRITZ!\igd_finder.exe
FirewallRules: [{991C98F8-82E2-441F-BEC1-63638588F90F}] => (Allow) C:\Program Files (x86)\FRITZ!\igd_finder.exe
FirewallRules: [{9F7AFE22-950E-49D1-8159-6CB39F8308C1}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{DD37FF90-68B4-4741-B2E8-4DE30B2EF2E8}] => (Allow) C:\Users\Lampe\AppData\Local\Apps\2.0\3Q3A559W.K1Y\PZX1Z8JL.KO4\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\fritzbox-usb-fernanschluss.exe
FirewallRules: [{F5E94CDC-5608-406E-8A8D-28EB1CC9DFFF}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{B47C5661-627E-4396-AAA8-7EC26574FF48}] => (Allow) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{2F599987-A7AE-4C96-9399-1E5C40BBA885}] => (Allow) C:\Users\Lampe\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{6BA101F0-C535-4EB2-AA11-21756E3FEAFA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{876DD064-E60F-4793-A05A-C0294BD6FAB5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{7F096D67-CCB2-4753-8FCD-B650655F8016}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
FirewallRules: [{B8EB1790-F86A-4819-B56A-19C20CA5A99F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [{17F3CC06-D539-4707-8DC1-8643ABFDF55A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
FirewallRules: [{A4489A1F-0C3E-4F28-96FD-1039871EBFB1}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5DE722D1-6338-48E9-9160-692DF49F01BB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5AB65E56-42D4-48C4-AD91-5A18594F6EB8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D13A2DE3-B9D6-4D93-B1EE-A6961595802C}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{630BD710-033F-49FB-ACB3-18599DF856E0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{86492122-B9A7-4135-B408-9E19E4941576}] => (Allow) LPort=61117
FirewallRules: [{0FC62560-001A-40E3-80CE-D268725A2CDE}] => (Allow) LPort=61116
FirewallRules: [{2745FDF0-DEB7-457C-AF14-6A9BFA48368E}] => (Allow) LPort=21112
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/08/2015 02:24:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 02:05:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:56:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:52:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:42:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x1988
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (07/08/2015 01:33:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 11:16:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 10:32:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:25:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000679c9
ID des fehlerhaften Prozesses: 0xd94
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (07/08/2015 08:25:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/08/2015 04:09:21 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR7 gefunden.
Error: (07/08/2015 04:09:20 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR7 gefunden.
Error: (07/08/2015 04:09:20 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR7 gefunden.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dell Data Vault" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dell Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dell Data Vault Wizard" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/08/2015 03:55:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office:
=========================
Error: (07/08/2015 02:24:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 02:05:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:56:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:52:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 01:42:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa198801d0b9732249cb6dC:\Users\Lampe\Desktop\Gmer-19357.exeC:\Users\Lampe\Desktop\Gmer-19357.exe660194bf-2566-11e5-8bc2-bc85567a9172
Error: (07/08/2015 01:33:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 11:16:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 10:32:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/08/2015 08:25:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4Explorer.EXE6.1.7601.175674d672ee4c000000500000000000679c9d9401d0b946acd9f775C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1046dd5d-253a-11e5-9d94-bc85567a9172
Error: (07/08/2015 08:25:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 30%
Total physical RAM: 8152.95 MB
Available physical RAM: 5667.31 MB
Total Virtual: 16304.1 MB
Available Virtual: 13040.58 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:1847.83 GB) (Free:1740.7 GB) NTFS
Drive i: (USB DISK) (Removable) (Total:7.46 GB) (Free:6.01 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1863 GB) (Disk ID: 163C4746)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=15.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1847.8 GB) - (Type=07 NTFS)
========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 7.5 GB) (Disk ID: 5CB38824)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0C)
==================== End of log ============================
|
|
08.07.2015, 15:32
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
Task: {49AD9908-790A-4756-99AA-772A252D8280} - \WordShark Auto Updater 1.10.0.19 Core No Task File <==== ATTENTION
Task: {860A403F-73E2-43D7-90DC-0FFF1B5CA1D6} - \WordShark Auto Updater 1.10.0.19 Pending Update No Task File <==== ATTENTION
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2015, 15:45
| #9 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by Lampe at 2015-07-08 16:39:34 Run:1
Running from C:\Users\Lampe\Desktop
Loaded Profiles: Lampe (Available Profiles: Lampe & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2013-07-06] (Microsoft Corporation) <==== ATTENTION
Task: {49AD9908-790A-4756-99AA-772A252D8280} - \WordShark Auto Updater 1.10.0.19 Core No Task File <==== ATTENTION
Task: {860A403F-73E2-43D7-90DC-0FFF1B5CA1D6} - \WordShark Auto Updater 1.10.0.19 Pending Update No Task File <==== ATTENTION
EmptyTemp:
*****************
HKU\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
HKU\S-1-5-21-1344064752-2903933196-2754972076-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
HKU\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{49AD9908-790A-4756-99AA-772A252D8280}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{49AD9908-790A-4756-99AA-772A252D8280}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WordShark Auto Updater 1.10.0.19 Core" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{860A403F-73E2-43D7-90DC-0FFF1B5CA1D6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{860A403F-73E2-43D7-90DC-0FFF1B5CA1D6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WordShark Auto Updater 1.10.0.19 Pending Update" => key removed successfully
EmptyTemp: => 5.6 GB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 16:40:18 ====
|
|
08.07.2015, 15:46
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2015, 17:20
| #11 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehrCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 08.07.2015 Suchlaufzeit: 17:00 Protokolldatei: mbam2.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.08.04 Rootkit-Datenbank: v2015.07.07.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Lampe Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 449887 Abgelaufene Zeit: 11 Min., 22 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b7ec999d42ad2c49a39429d924b1767b
# end=init
# utc_time=2015-07-08 03:14:19
# local_time=2015-07-08 05:14:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24704
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b7ec999d42ad2c49a39429d924b1767b
# end=updated
# utc_time=2015-07-08 03:18:35
# local_time=2015-07-08 05:18:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=b7ec999d42ad2c49a39429d924b1767b
# engine=24704
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-08 04:12:09
# local_time=2015-07-08 06:12:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='G DATA TOTAL PROTECTION'
# compatibility_mode=4111 16777213 100 100 5395 11971933 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 10756 188001779 0 0
# scanned=214225
# found=5
# cleaned=0
# scan_time=3214
sh=F63CFF71F0586E4016BEA3B9055F79DDEF89EA84 ft=1 fh=7f27fbc395c41cc7 vn="Variante von Win32/Adware.Vitruvian.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WordShark_1.10.0.19\Service\wssvc.exe.vir"
sh=E7534E5E675967DB90A15434220D29EBAF08032D ft=1 fh=c71c001129cc2af8 vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Lampe\AppData\Roaming\omniboxes\UninstallManager.exe.vir"
sh=CC41CADBBD6BA6ED0BFDD17798B4C9F94D7955E0 ft=1 fh=e26a6656a404b558 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Lampe\AppData\Roaming\OpenCandy\649E12E7AD0D424B881E60AE941B6638\DeltaTB.exe.vir"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Lampe\Downloads\wz175-32gev.msi"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\3b9e9b8.msi"
|
|
08.07.2015, 17:40
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Lampe\Downloads\wz175-32gev.msi
C:\Windows\Installer\3b9e9b8.msi
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2015, 17:50
| #13 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Hallo Cosinus, ich habe leider jetzt einen Termin, den ich nicht verschieben kann. Alles Weitere Morgen? Ich schaue nachher nochmal rein, wenn es neue Aufgaben gibt... Vielen Dank für deine Mühe bis hierher! Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by Lampe at 2015-07-08 18:43:30 Run:2
Running from C:\Users\Lampe\Desktop
Loaded Profiles: Lampe (Available Profiles: Lampe & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\Lampe\Downloads\wz175-32gev.msi
C:\Windows\Installer\3b9e9b8.msi
EmptyTemp:
*****************
C:\Users\Lampe\Downloads\wz175-32gev.msi => moved successfully.
C:\Windows\Installer\3b9e9b8.msi => moved successfully.
EmptyTemp: => 3.5 MB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 18:43:35 ====
|
|
08.07.2015, 18:35
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
08.07.2015, 21:54
| #15 |
| | Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr Danke für die prompte Hilfe. Ich musste noch einige Einstellungen beim GData (Firewall)verändern, jetzt läuft es wieder. Aber anscheinend war eine solche Aktion auch mal nötig, um den ganzen restlichen Kram zu eliminieren. Nochmals danke für die Mühe!!!  |
|
| Themen zu Windows 7 Professional 64 bit: Browser funktionieren seit Entfernung Omnibox mit Malwarebytes nicht mehr |
| adware, branding, browser, computer, converter, cpu, defender, failed, firefox 39.0, flash player, gdata, helper, homepage, ie 11, internet browser, internet explorer, lightning, omnibox, onedrive, popup, rundll, scan, security, services.exe, software, svchost.exe, symantec, temp, teredo, updates, virus, windows, windows 7 64 bit professional, wlan |
Linear-Darstellung
