| |
| |||||||
Log-Analyse und Auswertung: Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.07.2015, 20:37
| #1 |
 |  Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist. Hallo, mein PC friert ab und zu ein. Manchmal nach 1-2 Minuten nach dem Start und manchmal erst nach 10 Minuten. Es kann dann noch kurz die Maus bewegt werden aber dann ist schluss. Nach ca. 1 Minute läuft der PC wieder als ob nichts gewesen wäre. Dabei fällt auf das manche Seiten dann sehr lange brauchen bis sie aufbauen. Das einfrieren geschieht auch wenn nur Outlook offen ist. Habe Malwarebytes Anti-Malware und Trend Micro Secuity am laufen. Aber bisher keine Funde oder Auffälligkeiten. Bis vor einigen Wochen war auffällig dass das TM-Antivirenprogramm warum auch immer, ab und zu scheinbar von selbst, deaktiviert war. Nach dem dritten mal wurde es neu installiert, seitdem scheinbar ok. Des weiteren hatten wir vor einger Zeit auf einer Ü18-Seite  einmal eine verdächtige Seite (Bundestroyaner? oder so ähnlich). Hatten sofort den Ausschalter gedrückt und nach wiedereinschalten war sichtlich alles ok!?Wäre super wenn Ihr helfen könntet. Hab mir sicher was eingefangen  Hänge FRST, Additon und GMER als txt an. defogger hab ich nur als _disable.log bekommen und angehängt. Hoffe das passt so Gruß Basti vom Hermann-PC Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:11 on 14/07/2015 (Hermann)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by Hermann (administrator) on HERMANN-HP on 14-07-2015 20:21:18
Running from C:\Users\Hermann\Desktop
Loaded Profiles: Hermann (Available Profiles: Hermann)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSessionAgent.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtWatchDog.exe
(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\REALTEK Bluetooth\AvrcpService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Realtek\REALTEK Bluetooth\BTDevMgr.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Development Company) C:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\REALTEK Bluetooth\RtkBleServ.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\REALTEK Bluetooth\BTServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Platinum] => C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSessionAgent.exe [1266688 2015-05-04] (Trend Micro Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320360 2014-06-25] (Intel Corporation)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [246304 2014-07-20] (Trend Micro Inc.)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [185144 2014-04-10] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [YouCam Tray] => c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [167488 2013-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-08-07] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-04-10] (Advanced Micro Devices, Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-04-11]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
BHO: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO: Trend Micro IE Protection -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe64.dll [2015-05-21] (Trend Micro Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: HP File Sanitizer -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2014-02-05] (Hewlett-Packard)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-05-12] (Microsoft Corporation)
BHO-x32: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
BHO-x32: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Trend Micro IE Protection -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe32.dll [2015-05-21] (Trend Micro Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Toolbar: HKLM-x32 - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-05-23] (Microsoft Corporation)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe64.dll [2015-05-21] (Trend Micro Inc.)
Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe32.dll [2015-05-21] (Trend Micro Inc.)
Handler: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)
Handler-x32: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B579DD91-C67A-42F5-84D5-B932A845AEB6}: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Hermann\AppData\Roaming\Mozilla\Firefox\Profiles\nrpn4htb.default-1426757629194
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-12-18] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-12-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-05-23] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-05-23] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\components\npChromeDPAgent.dll [2014-06-26] (DigitalPersona, Inc.)
FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension [2015-06-15]
FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension
FF HKLM-x32\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-11-14]
FF HKLM-x32\...\Firefox\Extensions: [{BBB77B49-9FF4-4d5c-8FE2-92B1D6CD696C}] - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension
FF Extension: Trend Micro Osprey Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension [2015-06-03]
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome
FF Extension: HP Client Security Manager - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome [2015-01-16]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome.crx [2014-06-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [43224 2014-07-03] (Realtek Semiconductor Corporation)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [98816 2014-10-11] () [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2014-03-31] () [File not signed]
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2014-07-28] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [567608 2013-11-20] (Hewlett-Packard Company)
R2 HpDamServiceHost; c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe [18232 2013-11-15] (Hewlett-Packard Development Company)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-06-25] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344976 2015-05-22] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 ISCTAgent; c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [198120 2013-09-07] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Platinum Host Service; C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe [1187328 2015-05-04] (Trend Micro Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2015-03-04] (Realtek Semiconductor)
R2 RtkBleServ; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [50392 2014-07-03] (Realtek Semiconductor Corporation)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-12-04] (Microsoft Corporation)
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-14] (Advanced Micro Devices, Inc.)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [90608 2011-12-27] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-10-07] (Hewlett-Packard Company)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-06-25] (Intel Corporation)
R3 INETMON; C:\windows\System32\Drivers\INETMON.sys [29088 2013-08-08] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-08-08] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2014-12-05] (WinMagic Inc.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RtkA2dp; C:\Windows\System32\drivers\RtkA2dp.sys [179416 2014-05-09] (Realtek Semiconductor Corporation)
S3 RtkAvrcp; C:\Windows\system32\drivers\RtkAvrcp.sys [61152 2012-12-28] (Realtek Semiconductor Corporation)
R3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [585944 2015-01-20] (Realtek Semiconductor Corporation)
S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [476888 2015-03-05] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [9127128 2014-12-26] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3802328 2015-04-21] (Realtek Semiconductor Corporation )
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2014-12-05] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2014-12-05] (WinMagic Inc.)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [30448 2014-04-08] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [31472 2014-04-08] (Synaptics Incorporated)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [122432 2015-04-24] (Trend Micro Inc.)
R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [307344 2015-04-24] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2014-07-09] (Trend Micro Inc.)
R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [106296 2014-07-09] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [93616 2015-04-24] (Trend Micro Inc.)
R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [407864 2014-07-09] (Trend Micro Inc.)
R2 tmusa; C:\Windows\System32\DRIVERS\tmusa.sys [106296 2014-06-30] (Trend Micro Inc.)
S3 pmem; \??\C:\Users\Hermann\AppData\Local\Temp\_MEI56762\drivers\winpmem64.sys [X]
U2 TMAgent; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 20:21 - 2015-07-14 20:21 - 00023401 _____ C:\Users\Hermann\Desktop\FRST.txt
2015-07-14 20:21 - 2015-07-14 20:21 - 00000000 ____D C:\FRST
2015-07-14 20:12 - 2015-07-14 20:13 - 02133504 _____ (Farbar) C:\Users\Hermann\Desktop\FRST64.exe
2015-07-14 20:11 - 2015-07-14 20:11 - 00000476 _____ C:\Users\Hermann\Desktop\defogger_disable.log
2015-07-14 20:10 - 2015-07-14 20:10 - 00050477 _____ C:\Users\Hermann\Downloads\Defogger.exe
2015-07-14 19:50 - 2015-07-14 19:50 - 00000000 _____ C:\Users\Hermann\defogger_reenable
2015-07-14 15:21 - 2015-07-14 15:22 - 00001078 _____ C:\windows\system32dbgraw.bmp
2015-07-13 23:11 - 2015-07-14 15:26 - 00003198 _____ C:\windows\System32\Tasks\HPCeeScheduleForHermann
2015-07-13 23:11 - 2015-07-14 15:26 - 00000340 _____ C:\windows\Tasks\HPCeeScheduleForHermann.job
2015-07-13 21:41 - 2015-07-13 21:41 - 00001156 _____ C:\Users\Public\Desktop\Rosetta Stone.lnk
2015-07-13 21:31 - 2015-07-13 21:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rosetta Stone
2015-07-13 21:31 - 2015-07-13 21:41 - 00000000 ____D C:\Program Files (x86)\Rosetta Stone
2015-07-13 21:29 - 2015-07-13 21:29 - 00000000 ____D C:\ProgramData\RosettaStoneLtdServices
2015-07-13 21:29 - 2015-07-13 21:29 - 00000000 ____D C:\Program Files (x86)\RosettaStoneLtdServices
2015-07-08 16:59 - 2015-06-29 20:01 - 00017856 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2015-07-08 16:59 - 2015-06-29 19:59 - 01085440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00765440 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00433664 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-07-08 16:59 - 2015-06-29 19:50 - 01145856 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 02603008 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-07-08 16:59 - 2015-06-27 00:06 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-07-08 16:59 - 2015-06-27 00:06 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-07-08 16:59 - 2015-06-27 00:06 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-07-08 16:59 - 2015-06-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-07-08 16:30 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_43.dll
2015-07-08 16:30 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2015-07-08 16:30 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_42.dll
2015-07-08 16:30 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_42.dll
2015-07-08 16:30 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\windows\SysWOW64\xinput1_3.dll
2015-07-06 17:22 - 2015-07-06 17:22 - 00000126 _____ C:\Users\Hermann\Desktop\Bayern 3 Radio, br 3 - das Bayern 3 Webradio Radio Stream kostenlos online hören radio.de.URL
2015-07-06 09:57 - 2015-07-06 09:57 - 00001760 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-07-06 09:57 - 2015-07-06 09:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-07-06 09:56 - 2015-07-06 09:57 - 00000000 ____D C:\Program Files\iTunes
2015-07-06 09:56 - 2015-07-06 09:56 - 00000000 ____D C:\Program Files\iPod
2015-07-06 09:56 - 2015-07-06 09:56 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-07-03 15:19 - 2015-07-04 08:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-01 22:37 - 2015-07-01 22:37 - 17733128 _____ C:\Users\Hermann\Downloads\PowerDVD_12.0.29544.4919_DKA_R3_Patch_DVD150113-05_Normal(1).exe
2015-06-27 13:02 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-06-27 13:02 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-06-27 13:01 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll
2015-06-22 23:35 - 2015-06-22 23:35 - 00000000 ____D C:\ProgramData\ATI
2015-06-22 21:27 - 2015-06-22 21:27 - 00056720 _____ C:\windows\SysWOW64\CCCInstall_201506222127282021.log
2015-06-22 21:27 - 2015-06-22 21:27 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2015-06-22 21:26 - 2015-06-22 21:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-06-22 21:19 - 2015-06-22 21:18 - 33869312 _____ (Advanced Micro Devices Inc.) C:\windows\system32\amdocl64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 28771840 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\amdocl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 27918848 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atio6axx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 23375872 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atioglxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 16751616 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmdag.sys
2015-06-22 21:19 - 2015-06-22 21:18 - 15716352 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticaldd64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 14302208 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticaldd.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 08044976 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd6a.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 07207592 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdva.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 07028336 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdag.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 03471376 _____ C:\windows\SysWOW64\atiumdva.cap
2015-06-22 21:19 - 2015-06-22 21:18 - 03437632 _____ C:\windows\system32\atiumd6a.cap
2015-06-22 21:19 - 2015-06-22 21:18 - 00901120 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atiadlxy.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00621056 _____ (AMD) C:\windows\system32\atieclxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00609416 _____ C:\windows\SysWOW64\atiapfxx.blb
2015-06-22 21:19 - 2015-06-22 21:18 - 00609416 _____ C:\windows\system32\atiapfxx.blb
2015-06-22 21:19 - 2015-06-22 21:18 - 00579584 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmpag.sys
2015-06-22 21:19 - 2015-06-22 21:18 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiapfxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00239616 _____ (AMD) C:\windows\system32\atiesrxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00235008 _____ C:\windows\system32\clinfo.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00190976 _____ (AMD) C:\windows\system32\atitmm64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00146944 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6txx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00133632 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atigktxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00128384 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\amdhcp64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00118096 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\amdhcp32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00102128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdave64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00100032 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiu9pag.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00098816 _____ (Advanced Micro Devices Inc.) C:\windows\system32\OpenVideo64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00096448 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdave32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atisamu64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00086528 _____ (Advanced Micro Devices Inc.) C:\windows\system32\OVDecode64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00083456 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\OpenVideo.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atisamu32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atimpc64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdpcom64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6pxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00073216 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\OVDecode.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atimpc32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdpcom32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiglpxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiglpxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00065024 _____ (Khronos Group) C:\windows\system32\OpenCL.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00062464 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalrt64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00058880 _____ (Khronos Group) C:\windows\SysWOW64\OpenCL.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00055808 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalcl64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00052224 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalrt.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00049152 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalcl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00048128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdmmcl6.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\ati2erec.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00037888 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdmmcl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00031232 _____ (AMD) C:\windows\system32\atimuixx.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-14 19:50 - 2014-11-13 20:48 - 00000000 ____D C:\Users\Hermann
2015-07-14 19:41 - 2014-11-16 13:01 - 00000000 ____D C:\Users\Hermann\Documents\Outlook-Dateien
2015-07-14 19:38 - 2009-07-14 06:45 - 00037184 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-14 19:38 - 2009-07-14 06:45 - 00037184 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-14 18:15 - 2015-05-25 11:25 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-14 18:11 - 2014-11-13 20:42 - 01962662 _____ C:\windows\WindowsUpdate.log
2015-07-14 15:29 - 2015-01-17 20:46 - 01321665 _____ C:\Users\Hermann\AppData\Local\BTServer.log
2015-07-14 15:25 - 2015-03-04 21:16 - 00006467 _____ C:\windows\SysWOW64\Gms.log
2015-07-14 15:25 - 2009-07-14 06:51 - 00450698 _____ C:\windows\setupact.log
2015-07-14 15:21 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-07-14 10:05 - 2014-11-13 20:49 - 00003946 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{B9CB2285-0914-4E35-BFE3-B897EA36700C}
2015-07-14 09:52 - 2015-04-03 14:43 - 00000000 ___SD C:\windows\SysWOW64\GWX
2015-07-14 09:52 - 2015-04-03 14:43 - 00000000 ___SD C:\windows\system32\GWX
2015-07-13 21:23 - 2014-11-21 17:41 - 00082136 _____ C:\Users\Hermann\Downloads\detekt.log
2015-07-13 18:40 - 2015-05-30 12:37 - 00000000 ____D C:\ProgramData\Rosetta Stone Backups
2015-07-12 10:08 - 2014-09-02 07:17 - 00700378 _____ C:\windows\system32\perfh007.dat
2015-07-12 10:08 - 2014-09-02 07:17 - 00149984 _____ C:\windows\system32\perfc007.dat
2015-07-12 10:08 - 2009-07-14 07:13 - 01622694 _____ C:\windows\system32\PerfStringBackup.INI
2015-07-09 18:15 - 2014-11-23 17:27 - 00000000 ____D C:\Users\Hermann\AppData\Local\CrashDumps
2015-07-08 18:13 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2015-07-08 17:00 - 2014-12-10 19:49 - 00000000 ____D C:\windows\system32\appraiser
2015-07-08 17:00 - 2014-11-14 01:29 - 00000000 ___SD C:\windows\system32\CompatTel
2015-07-08 16:55 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-07-08 16:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-07-07 14:50 - 2009-07-14 07:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2015-07-06 17:32 - 2014-11-23 15:14 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-06 09:56 - 2015-04-18 12:17 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-07-06 09:56 - 2015-04-18 12:15 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-07-04 08:42 - 2014-11-14 10:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-04 08:42 - 2010-11-21 05:47 - 01415376 _____ C:\windows\PFRO.log
2015-07-03 15:21 - 2015-05-25 11:23 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-03 15:21 - 2015-05-25 11:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-03 15:21 - 2015-05-25 11:23 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-01 22:39 - 2014-05-22 14:25 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-06-27 13:14 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions
2015-06-26 18:17 - 2014-12-26 10:24 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 20:18 - 2015-05-22 21:51 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-23 13:30 - 2010-11-21 05:27 - 00300704 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-06-22 21:27 - 2014-09-02 06:50 - 00000000 ____D C:\ProgramData\AMD
2015-06-22 21:18 - 2015-03-05 23:37 - 09313424 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atidxx32.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 01115648 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\aticfx32.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 00827392 _____ (AMD) C:\windows\system32\coinst_14.30.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 00126848 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiuxpag.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 10887776 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atidxx64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 08295784 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 01338128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\aticfx64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 01211392 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiadlxx.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atidemgy.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00144328 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiuxp64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00118096 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiu9p64.dll
2015-06-22 21:18 - 2014-03-29 01:26 - 00000000 ____D C:\SWSETUP
2015-06-21 15:25 - 2014-11-15 21:05 - 00000000 ____D C:\Users\Hermann\AppData\Local\Adobe
2015-06-19 17:16 - 2014-11-16 21:31 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2015-06-18 08:41 - 2015-05-25 11:23 - 00109272 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-06-18 08:41 - 2015-05-25 11:23 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-05-25 11:23 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
==================== Files in the root of some directories =======
2015-01-17 20:46 - 2015-07-14 15:29 - 1321665 _____ () C:\Users\Hermann\AppData\Local\BTServer.log
2014-11-14 12:58 - 2014-11-14 12:58 - 0000036 _____ () C:\Users\Hermann\AppData\Local\housecall.guid.cache
2014-09-02 06:36 - 2015-01-16 21:23 - 14953458 _____ () C:\ProgramData\hpcsmmsilogs.log
2014-09-02 07:13 - 2014-09-02 07:13 - 1262966 _____ () C:\ProgramData\hpdam_install_log.txt
2014-09-02 07:13 - 2014-09-02 07:13 - 0544160 _____ () C:\ProgramData\HPFileSanitizer_Install_Log.txt
Files to move or delete:
====================
C:\Users\Hermann\Ti_2015_MR_64_Website.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by Hermann at 2015-07-14 20:21:41
Running from C:\Users\Hermann\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1140857624-1230666902-1865050029-500 - Administrator - Disabled)
Gast (S-1-5-21-1140857624-1230666902-1865050029-501 - Limited - Disabled)
Hermann (S-1-5-21-1140857624-1230666902-1865050029-1002 - Administrator - Enabled) => C:\Users\Hermann
HomeGroupUser$ (S-1-5-21-1140857624-1230666902-1865050029-1003 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Trend Micro Internet Security (Enabled - Up to date) {8242D66F-41BD-4049-C2E6-E578E73B62A0}
AS: Trend Micro Internet Security (Enabled - Up to date) {3923378B-6787-4FC7-F856-DE0A9CBC281D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{49C639FB-E462-3CFD-9F6A-0F9033640CED}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.3207 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3920 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4513 - CyberLink Corp.)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Foxit PhantomPDF (HKLM-x32\...\{5F3E0897-97AA-4FC2-A0A9-130A39D0FDFB}) (Version: 6.0.16.324 - Foxit Corporation)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{13133E99-B0D5-4143-B832-AAD55C62A41C}) (Version: 6.0.19.1 - Hewlett-Packard Company)
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.3.7.1864 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{C0ED9561-8312-457C-BB1B-BDC7EE034CED}) (Version: 4.7.4.1 - Hewlett-Packard Company)
HP Device Access Manager (HKLM\...\{DBE16A07-DDFF-4453-807A-212EF93916E0}) (Version: 8.3.2.0 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{53AE55F3-8E99-4776-A347-06222894ECD3}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.11.10 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{56C60843-5199-47F1-9087-AE440EFFB951}) (Version: 2.5.1 - Hewlett-Packard Company)
HP File Sanitizer (HKLM-x32\...\{6349342F-9CEF-4A70-995A-2CF3704C2603}) (Version: 8.4.20.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10284 - Realtek Semiconductor Corp.)
HP Hotkey Support (HKLM-x32\...\{445CC807-9384-47FA-A2B6-FFE970352B88}) (Version: 6.0.22.1 - Hewlett-Packard Company)
HP PageLift (HKLM-x32\...\{59202086-BEA1-411A-8AA4-A5DCD28FF537}) (Version: 1.0.13.1 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{34FF930E-DBF9-4858-BAB5-BAC957BF616E}) (Version: 3.5.1.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{F6D61EC9-347B-4019-9F8E-E24169F7C330}) (Version: 8.7.5 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP System Default Settings (HKLM-x32\...\{B5BEF5F8-BD76-4174-A47D-05A06EA62615}) (Version: 2.7.1 - Hewlett-Packard Company)
HP Theft Recovery (HKLM-x32\...\InstallShield_{B1E569B6-A5EB-4C97-9F93-9ED2AA99AF0E}) (Version: 8.3.0.7 - Hewlett-Packard Company)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4112 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{978B5476-EAF9-4EB0-AD34-92689249A016}) (Version: 4.2.41.2499 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.1.41 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{4046F74A-28F8-48C6-A5D3-2AFC472574C1}) (Version: 12.2.0.145 - Apple Inc.)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
NAVIGON Fresh 3.5.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.5.1 - NAVIGON)
OEM Application Profile (HKLM-x32\...\{FA2905FA-6EB6-F61A-D565-30634F5F673E}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
OEM Application Profile (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 1.0.0.26 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.49 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.83.328.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.41 - REALTEK Semiconductor Corp.)
Rosetta Stone Language Training (HKLM-x32\...\{00384623-4937-4D7D-BDD9-23513D1C50AB}) (Version: 5.0.13.0 - Rosetta Stone, Ltd)
Rosetta Stone Ltd Services (HKLM-x32\...\{3165E4A6-D5DE-46B0-8597-D55E2B826B84}) (Version: 3.2.21 - Rosetta Stone Ltd.)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.37.3 - Synaptics Incorporated)
Trend Micro Internet Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 8.0 - Trend Micro Inc.)
Trend Micro Titanium (Version: 8.0 - Trend Micro Inc.) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{ADAA7361-54B8-4FC8-804E-94EC6C11ED68}) (Version: 4.5.133.0 - Validity Sensors, Inc.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1140857624-1230666902-1865050029-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
09-07-2015 19:17:37 Removed Rosetta Stone Ltd Services
09-07-2015 19:18:35 Removed Rosetta Stone Language Training
13-07-2015 18:38:24 Installed Rosetta Stone Ltd Services
13-07-2015 18:40:46 Installed Rosetta Stone TOTALe
13-07-2015 18:48:37 Installed Rosetta Stone Language Training
13-07-2015 21:19:05 Removed Rosetta Stone Ltd Services
13-07-2015 21:21:21 Removed Rosetta Stone Language Training
13-07-2015 21:28:49 Installed Rosetta Stone Ltd Services
13-07-2015 21:30:59 Installed Rosetta Stone TOTALe
13-07-2015 21:41:08 Installed Rosetta Stone Language Training
14-07-2015 09:39:25 Windows Update
14-07-2015 09:52:20 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1AEF737A-E226-4FB4-883E-17E66C0BE380} - System32\Tasks\{82398F1A-1133-486C-ABAF-0AB6082470DD} => Firefox.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {3C0C0479-C1E5-4A99-B7FF-AD5282789A16} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {4E047330-886F-4EA7-BFF0-EB5771AA5F05} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {59C68872-E349-4C49-B704-E9E41C18802D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {6508C247-B0AD-4D26-BC87-7EC386F70389} - System32\Tasks\HPCeeScheduleForHermann => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {853C9637-7A32-40F3-AAB1-403887541481} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {9A2D7416-B092-4803-AB70-CC40FB8BAA21} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {A71E5FFC-009B-4FE1-B298-0F0127330CFE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {B455239B-9980-4689-B7C7-9F09CCCAC0C4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {D5D12945-5DF9-43A5-B7D2-302B534AE86F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {E93DEC8E-17BF-4E21-A0DA-91D0F2DA9405} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {ECA157F6-4A31-4004-A151-12D4A4B90AFE} - System32\Tasks\{C74C3684-AF2C-4A59-AFCA-0552345E40EE} => Firefox.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {F8B9A466-02D1-48A0-97B1-FA820F9F8A88} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\HPCeeScheduleForHermann.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-14 20:42:33
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000092 TOSHIBA_ rev.AX00 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Hermann\AppData\Local\Temp\ugrirkoc.sys
---- User code sections - GMER 2.1 ----
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7562b21b C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7562b346 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 756a8f29 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 7560489d C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 756a8822 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 756a89f8 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 756a8718 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 756a8ae2 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7561fca8 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 756268ef C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 756a8fe3 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 756a8b42 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 756a86dc C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7561fd41 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7562b2dc C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 756a8ea4 C:\windows\syswow64\KERNEL32.dll
.text c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe[5628] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 756a8671 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7562b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7562b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 756a8f29 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 7560489d C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 756a8822 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 756a89f8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 756a8718 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 756a8ae2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7561fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 756268ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 756a8fe3 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 756a8b42 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 756a86dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7561fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7562b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 756a8ea4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[976] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 756a8671 C:\windows\syswow64\kernel32.dll
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{D79A9EA4-6601-4275-85C5-1537B3114052}\Connection@Name isatap.{F7165B8E-ED34-48A5-800E-1A40C51838CE}
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\38b1db9e1844
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\38b1db9e1844@000272cef315 0xC1 0x5B 0x13 0xB1 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D79A9EA4-6601-4275-85C5-1537B3114052}@InterfaceName isatap.{F7165B8E-ED34-48A5-800E-1A40C51838CE}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D79A9EA4-6601-4275-85C5-1537B3114052}@ReusableType 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\38b1db9e1844 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\38b1db9e1844@000272cef315 0xC1 0x5B 0x13 0xB1 ...
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist. |
| adobe, adware, bonjour, browser, defender, device driver, einfrieren, explorer, firefox, firefox 39.0, google, installation, maus, monitor, mozilla, programm, realtek, registry, scan, security, services.exe, software, super, system, temp, updates, usb, warum, windows |
Baum-Darstellung