| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Malware Gefunden und unerwünschte ProgrammeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.07.2015, 12:06
| #1 |
 |  Windows 7: Malware Gefunden und unerwünschte Programme Hallo, ich soll mich um den Laptop meiner Schwiegermutter kümmern und ihn von Trojanern und Viren befreien. Ich habe schon Malwarebytes durchlaufen lassen und einiges gefunden wie man im Log sehen wird. Es sind aber noch ein paar Programme drauf die sich nicht Deinstallieren wollen. Ich musste die Malwarebytes Log als 7-Zip anhängen. Ich hoffe ihr könnt mir Helfen. Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:08 on 16/07/2015 (Birte Hill)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015 Ran by Birte Hill (administrator) on BIRTEHILL-PC on 16-07-2015 12:09:08 Running from C:\Users\Birte Hill\Desktop Loaded Profiles: Birte Hill & UpdatusUser (Available Profiles: Birte Hill & UpdatusUser) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\stacsv64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe ( ) C:\Windows\System32\lxeacoms.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Roozz) C:\Program Files (x86)\Roozz\Updater.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files (x86)\Verbindungsassistent\WTGService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (1&1 Mail & Media GmbH) C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe (Google Inc.) C:\Users\Birte Hill\AppData\Local\Google\Update\GoogleUpdate.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated) HKLM\...\Run: [lxeamon.exe] => C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe [770728 2010-05-05] () HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-23] (IDT, Inc.) HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1487568 2014-03-19] (Microsoft Corporation) HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS) HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760 2010-03-14] (Nero AG) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.) HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-26] (Easybits) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-08-20] (Hewlett-Packard Company) HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard) HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [2990304 2013-10-30] (Nota Inc.) HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd) HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-21-1992077360-1904998855-2622201860-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-18\...\Run: [Skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> Startup: C:\Users\Birte Hill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2011-01-10] ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File BootExecute: autocheck autochk * sdnclean64.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://inboxtoolbar.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language HKU\S-1-5-21-1992077360-1904998855-2622201860-1003\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/ HKU\S-1-5-21-1992077360-1904998855-2622201860-1003\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/CQNOT/4 HKU\S-1-5-21-1992077360-1904998855-2622201860-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.facebook.com/ URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {1441583B-31A3-4E21-B2CD-37190D2E0361} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {1441583B-31A3-4E21-B2CD-37190D2E0361} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> {1441583B-31A3-4E21-B2CD-37190D2E0361} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> {429CACAD-3F2D-49C9-99C2-61C939CE870E} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin BHO: WEB.DE Toolbar BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\WEB.DE Toolbar\IE\uitb.dll [2011-12-12] (1und1 Mail und Media GmbH) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard) BHO-x32: ProxTube -> {0AA2810A-F009-4BD7-A10A-32F140A1B9F3} -> C:\Users\Birte Hill\AppData\LocalLow\ProxTube\IE\ProxTube.dll [2010-05-25] (Malte Goetz) BHO-x32: WEB.DE Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll [2011-03-18] (1&1 Mail & Media GmbH) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-30] (Adobe Systems Incorporated) BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll [2012-11-13] (Safer-Networking Ltd.) BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation) BHO-x32: WEB.DE Toolbar BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> No File BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-12-17] (Sun Microsystems, Inc.) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard) Toolbar: HKLM-x32 - No Name - !{D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File Toolbar: HKLM-x32 - No Name - !{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No File Toolbar: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE Toolbar\IE\uitb.dll [2011-12-12] (1und1 Mail und Media GmbH) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-11-07] (EasyBits Software Corp.) Tcpip\..\Interfaces\{F487FECE-DFFC-4AFD-A30B-1F2F55EC3BE9}: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Birte Hill\AppData\Roaming\Mozilla\Firefox\Profiles\l9xdn0q6.default FF Homepage: https://www.facebook.com/ FF NewTab: https://www.facebook.com/ FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Google FF SelectedSearchEngine: Google FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll [2014-02-28] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll [2014-02-28] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll [2013-10-25] (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_38 -> C:\Windows\SysWOW64\npdeployJava1.dll [2012-11-14] (Sun Microsystems, Inc.) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll [2012-11-14] (Sun Microsystems, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation) FF Plugin-x32: @Roozz.com/RoozzPlugin -> C:\Program Files (x86)\Roozz\nproozz.dll [2013-10-25] (Roozz.com) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2012-07-30] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Birte Hill\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Birte Hill\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @talk.google.com/O1DPlugin -> C:\Users\Birte Hill\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Birte Hill\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Birte Hill\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.) FF Plugin HKU\S-1-5-21-1992077360-1904998855-2622201860-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Birte Hill\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-02-07] (Unity Technologies ApS) FF Plugin ProgramFiles/Appdata: C:\Users\Birte Hill\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google) FF Plugin ProgramFiles/Appdata: C:\Users\Birte Hill\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google) FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF HKLM-x32\...\Firefox\Extensions: [siteranker@siteranker.com] - C:\Program Files (x86)\SiteRanker\firefox FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird Chrome: ======= CHR Profile: C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-16] CHR Extension: (YouTube) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-16] CHR Extension: (Google Search) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-16] CHR Extension: (Free Rider HD) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\emikpifndnjfkgofoglceekhkbaicbde [2014-01-14] CHR Extension: (Motocross Nitro) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdikdnjblenkgleaedpepneeafbljagc [2014-01-14] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12] CHR Extension: (Google Wallet) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22] CHR Extension: (3D Parking) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\npgjnhabcgahcfdembgboapbefikbmld [2012-12-14] CHR Extension: (Gmail) - C:\Users\Birte Hill\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-16] CHR HKLM-x32\...\Chrome\Extension: [ccbgjfdieajmokelnlapbedknchgenne] - C:\Users\BIRTEH~1\AppData\Local\Temp\ccex.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [cfpbbebonjiokndafpjhimhncilmgikc] - C:\Users\BIRTEH~1\AppData\Local\Temp\ccex.crx [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation) R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed] S3 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed] S2 lxeaCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe [45736 2010-04-14] (Lexmark International, Inc.) R2 lxea_device; C:\Windows\system32\lxeacoms.exe [1052328 2010-04-14] ( ) R2 lxea_device; C:\Windows\SysWOW64\lxeacoms.exe [598696 2010-04-14] ( ) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-02-27] () R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] () R2 Roozz Updater; C:\Program Files (x86)\Roozz\Updater.exe [428544 2013-10-25] (Roozz) [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe [247808 2010-03-23] (IDT, Inc.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WTGService; C:\Program Files (x86)\Verbindungsassistent\WTGService.exe [296400 2009-03-03] () S2 HPSLPSVC; C:\Users\BIRTEH~1\AppData\Local\Temp\7zS17C5\hpslpsvc64.dll [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 hwdatacard; C:\Windows\SysWOW64\DRIVERS\ewusbmdm.sys [115328 2008-07-24] (Huawei Technologies Co., Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation) S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [59392 2010-04-09] (Generic USB smartcard reader) S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-02] (Realtek Semiconductor Corp.) U4 eabfiltr; No ImagePath S3 iSafeKrnlBoot; system32\DRIVERS\iSafeKrnlBoot.sys [X] S1 iSafeNetFilter; system32\DRIVERS\iSafeNetFilter.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-16 12:09 - 2015-07-16 12:09 - 00024377 _____ C:\Users\Birte Hill\Desktop\FRST.txt 2015-07-16 12:08 - 2015-07-16 12:09 - 00000000 ____D C:\FRST 2015-07-16 12:08 - 2015-07-16 12:08 - 00000482 _____ C:\Users\Birte Hill\Desktop\defogger_disable.log 2015-07-16 12:08 - 2015-07-16 12:08 - 00000000 _____ C:\Users\Birte Hill\defogger_reenable 2015-07-16 12:06 - 2015-07-16 12:06 - 00050477 _____ C:\Users\Birte Hill\Desktop\Defogger.exe 2015-07-16 12:05 - 2015-07-16 12:05 - 02133504 _____ (Farbar) C:\Users\Birte Hill\Desktop\FRST64.exe 2015-07-16 12:05 - 2015-07-16 12:05 - 00380416 _____ C:\Users\Birte Hill\Desktop\Gmer-19357.exe 2015-07-15 12:56 - 2015-07-16 07:24 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-07-15 12:52 - 2015-07-15 12:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-07-15 12:52 - 2015-07-15 12:52 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-07-15 12:52 - 2015-07-15 12:52 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-07-15 12:52 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-07-15 12:52 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-07-15 12:52 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-07-15 12:51 - 2015-07-15 12:51 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Birte Hill\Downloads\mbam-setup-2.1.8.1057 (1).exe 2015-07-15 12:50 - 2015-07-15 12:50 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Birte Hill\Downloads\mbam-setup-2.1.8.1057.exe 2015-06-17 01:01 - 2015-06-17 01:01 - 01202856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL 2015-06-16 16:35 - 2015-06-16 16:37 - 00000000 ____D C:\Users\Birte Hill\Desktop\Flo ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-16 12:08 - 2010-04-03 21:19 - 00000000 ____D C:\Users\Birte Hill 2015-07-16 12:06 - 2015-06-11 14:31 - 01197508 _____ C:\Windows\WindowsUpdate.log 2015-07-16 12:05 - 2015-06-11 14:28 - 00000980 _____ C:\Windows\setupact.log 2015-07-16 12:03 - 2009-11-07 21:39 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-07-16 11:57 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-07-16 11:57 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-07-16 11:56 - 2014-02-28 19:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-16 11:53 - 2012-06-16 14:28 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004UA.job 2015-07-16 11:44 - 2013-08-14 15:04 - 00000000 ____D C:\Windows\system32\MRT 2015-07-16 11:39 - 2014-11-15 22:29 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d00112ca0a07d2.job 2015-07-16 11:39 - 2014-04-10 13:37 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf54b149cb8bf8.job 2015-07-16 11:39 - 2013-08-03 22:35 - 00000948 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001UA.job 2015-07-16 01:16 - 2011-11-10 17:32 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-07-16 01:11 - 2014-11-15 22:29 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1d00112ca0a07d2 2015-07-16 01:11 - 2011-11-10 17:32 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-07-16 01:07 - 2013-08-03 22:35 - 00000926 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core.job 2015-07-15 19:50 - 2012-02-14 20:27 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core.job 2015-07-15 16:06 - 2010-05-05 17:56 - 00134944 _____ C:\ProgramData\lxeascan.log 2015-07-15 16:05 - 2012-12-21 15:20 - 00000372 ____H C:\Windows\Tasks\ZoomExUpdaterTask{1BB1866A-44D9-4244-80F3-15927FD2CD03}.job 2015-07-15 16:05 - 2012-11-14 19:15 - 00000288 _____ C:\Windows\Tasks\AbelssoftPreloader.job 2015-07-15 16:05 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-15 16:04 - 2015-06-11 14:27 - 00429630 _____ C:\Windows\PFRO.log 2015-07-15 16:04 - 2014-12-13 01:55 - 00000000 ____D C:\Program Files (x86)\Elex-tech 2015-07-15 16:04 - 2014-12-13 01:54 - 00000000 ____D C:\Users\Birte Hill\AppData\Roaming\Elex-tech 2015-07-15 16:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Globalization 2015-07-15 14:53 - 2012-06-16 14:28 - 00001076 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004Core.job 2015-07-15 12:34 - 2010-04-27 17:43 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2015-07-11 12:34 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2015-07-11 12:33 - 2010-08-24 09:18 - 00000000 ____D C:\Users\Birte Hill\AppData\Local\CrashDumps 2015-07-11 12:32 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-07-03 08:43 - 2010-05-06 08:35 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-06-23 13:30 - 2010-04-03 21:33 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-06-16 16:39 - 2009-11-08 05:20 - 00704520 _____ C:\Windows\system32\perfh007.dat 2015-06-16 16:39 - 2009-11-08 05:20 - 00152326 _____ C:\Windows\system32\perfc007.dat 2015-06-16 16:39 - 2009-07-14 07:13 - 01634360 _____ C:\Windows\system32\PerfStringBackup.INI ==================== Files in the root of some directories ======= 2012-09-19 20:39 - 2012-08-16 00:09 - 0006511 _____ () C:\Users\Birte Hill\AppData\Roaming\aqh.class 2010-06-18 18:56 - 2011-01-29 11:07 - 0000251 _____ () C:\Users\Birte Hill\AppData\Roaming\mb3settings.xml 2012-09-19 20:39 - 2012-08-16 00:09 - 0001323 _____ () C:\Users\Birte Hill\AppData\Roaming\mod_TooManyItems.class 2010-06-18 18:56 - 2011-01-29 10:28 - 0004096 _____ () C:\Users\Birte Hill\AppData\Roaming\Tahoma_12.crd 2010-06-18 18:56 - 2011-01-29 10:28 - 0131200 _____ () C:\Users\Birte Hill\AppData\Roaming\Tahoma_12.dds 2012-09-19 20:39 - 2012-08-16 00:09 - 0010122 _____ () C:\Users\Birte Hill\AppData\Roaming\tmi.png 2012-09-19 20:39 - 2012-08-16 00:09 - 0000562 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIBlockSpawner.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0003235 _____ () C:\Users\Birte Hill\AppData\Roaming\TMICompatibility.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0007336 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIConfig.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0009461 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIController.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0003962 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIItemInfo.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000321 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIItemMushroomCap.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000776 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIPrivateFields.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000714 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIStateButtonData.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0013915 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIUtils.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0007329 _____ () C:\Users\Birte Hill\AppData\Roaming\TMIView.class 2013-01-04 15:31 - 2013-01-04 15:31 - 0000000 _____ () C:\Users\Birte Hill\AppData\Roaming\wklnhst.dat 2012-09-19 20:39 - 2012-08-16 00:09 - 0002503 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgButton.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000169 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgButtonHandler.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0005293 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgCanvas.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000762 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgImage.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000150 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgItemHandler.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0002344 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgItemPanel.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000168 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgTooltipHandler.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0001459 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgWidget.class 2012-09-19 20:39 - 2012-08-16 00:09 - 0000923 _____ () C:\Users\Birte Hill\AppData\Roaming\_tmi_MgZOrder.class 2010-04-03 21:30 - 2010-04-03 21:30 - 0000000 _____ () C:\Users\Birte Hill\AppData\Local\AtStart.txt 2010-04-03 21:30 - 2010-04-03 21:30 - 0000000 _____ () C:\Users\Birte Hill\AppData\Local\DSwitch.txt 2010-04-03 21:30 - 2010-04-03 21:30 - 0000000 _____ () C:\Users\Birte Hill\AppData\Local\QSwitch.txt 2014-02-08 17:41 - 2014-02-08 17:41 - 0000057 _____ () C:\ProgramData\Ament.ini 2010-06-15 07:29 - 2010-06-15 07:29 - 0000000 _____ () C:\ProgramData\cmn_upld.log 2010-05-05 18:10 - 2010-05-05 18:10 - 0000252 _____ () C:\ProgramData\FastPics.log 2010-04-03 21:30 - 2015-07-15 16:06 - 0000185 _____ () C:\ProgramData\HPWALog.txt 2010-05-05 18:09 - 2015-06-14 17:31 - 0015159 _____ () C:\ProgramData\lxea.log 2010-05-05 18:10 - 2010-08-06 17:22 - 0005112 _____ () C:\ProgramData\lxeaJSW.log 2010-05-05 17:56 - 2015-07-15 16:06 - 0134944 _____ () C:\ProgramData\lxeascan.log 2010-06-15 07:29 - 2010-06-15 07:29 - 0000000 _____ () C:\ProgramData\LxWbGwLog.log 2010-05-05 17:53 - 2010-05-05 17:53 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt 2009-10-15 02:36 - 2009-10-15 02:36 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log 2009-11-07 22:42 - 2009-11-07 22:43 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log 2009-10-15 02:35 - 2009-10-15 02:35 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log 2009-11-07 22:36 - 2009-11-07 22:37 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2009-10-15 02:35 - 2009-10-15 02:35 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log 2009-10-15 02:36 - 2009-10-15 02:36 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log 2009-11-07 22:35 - 2009-11-07 22:36 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log 2009-11-07 22:38 - 2009-11-07 22:42 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log 2009-10-15 02:36 - 2009-10-15 02:36 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log Files to move or delete: ==================== C:\Users\Birte Hill\infinst.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2010-05-05 21:46 ==================== End of log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by Birte Hill at 2015-07-16 12:10:20
Running from C:\Users\Birte Hill\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1992077360-1904998855-2622201860-500 - Administrator - Disabled)
Birte Hill (S-1-5-21-1992077360-1904998855-2622201860-1001 - Administrator - Enabled) => C:\Users\Birte Hill
Gast (S-1-5-21-1992077360-1904998855-2622201860-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1992077360-1904998855-2622201860-1002 - Limited - Enabled)
UpdatusUser (S-1-5-21-1992077360-1904998855-2622201860-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
4 Elements 1.0 (HKLM-x32\...\4 Elements_is1) (Version: - )
ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.2146.41621 - ABBYY Software House)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader 9.5.2 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM-x32\...\{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}) (Version: 11.0 - Adobe Systems, Inc.)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Aegypten Box (HKLM-x32\...\Aegypten Box) (Version: - )
AION Free-To-Play (HKLM-x32\...\InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}) (Version: 2.70.0000 - Gameforge)
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden
Akademie der Magie (HKLM-x32\...\Akademie der Magie) (Version: - )
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2008694014.48.56.12522874 - Audible, Inc.)
Beat Hazard (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bubble Snooker (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chuzzle Deluxe 1.0 (HKLM-x32\...\Chuzzle Deluxe 1.0) (Version: - )
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2111 - CyberLink Corp.)
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.3325 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.1.1005 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2201 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deutschland Spielt - Spiele Post (HKLM-x32\...\Deutschland Spielt - Spiele Post) (Version: 1.0.4.38 - INTENIUM GmbH)
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\DSGPlayer) (Version: 2.2.1.51 - INTENIUM GmbH)
Diamantris 2 (HKLM-x32\...\Diamantris 2_is1) (Version: - Suricate Software)
Eighteen Wheels of Steel Extreme Trucker (x32 Version: 2.2.0.87 - WildTangent) Hidden
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Galileo Family Quiz - Spezial III (HKLM-x32\...\Galileo Family Quiz - Spezial III) (Version: - SevenOne Intermedia)
Geheime Fälle: Die gestohlene Venus (HKLM-x32\...\Geheime Fälle: Die gestohlene Venus) (Version: - )
Ghost Recon Online (EU) (HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\d8be6c3f847d7d92) (Version: 1.35.2332.3 - Ubisoft)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Grand Theft Auto: Episodes from Liberty City (x32 Version: 1.0.0003.135 - Rockstar Games Inc.) Hidden
Gyazo 2.0.2 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc.)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.9512.3162 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.1.3 - WildTangent)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Quick Launch Buttons (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.13.1 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{17B4760F-334B-475D-829F-1A3E94A6A4E6}) (Version: 1.2.3560.3170 - Hewlett-Packard)
HP User Guides 0148 (HKLM-x32\...\{9D3318E1-5A9F-4A95-A7A1-7E045403AE34}) (Version: 1.01.0005 - Hewlett-Packard)
HP Wireless Assistant (HKLM-x32\...\{54CC7901-804D-4155-B353-21F0CC9112AB}) (Version: 3.50.9.1 - Hewlett-Packard)
Hühner-Attacke (HKLM-x32\...\Hühner-Attacke) (Version: - )
Hühner-Rache (HKLM-x32\...\Hühner-Rache) (Version: - )
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6230.0 - IDT)
Java(TM) 6 Update 15 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416015FF}) (Version: 6.0.150 - Sun Microsystems, Inc.)
Java(TM) 6 Update 38 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.380 - Oracle)
Java(TM) SE Development Kit 6 Update 15 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0160150}) (Version: 1.6.0.150 - Sun Microsystems, Inc.)
Jewel Empire-Hidden Secrets (HKLM-x32\...\{60356853-8141-8377-6786-288431479053}) (Version: 1.0 - rondomedia)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2111 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2111 - CyberLink Corp.) Hidden
Lexmark S300-S400 Series (HKLM\...\Lexmark S300-S400 Series) (Version: - Lexmark International, Inc.)
LightScribe System Software (HKLM-x32\...\{CC8E94A2-55C7-4460-953C-2A790180578C}) (Version: 1.18.8.1 - LightScribe)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.109 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.109 - LogMeIn, Inc.) Hidden
Luxor 5th Passage (HKLM-x32\...\Luxor 5th Passage) (Version: 1.1.0.0 - MumboJumbo)
Luxor Amun Rising with Luxor (HKLM-x32\...\Luxor Amun Rising with Luxor) (Version: - MumboJumbo, LLC)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: - EasyBits Software AS)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM-x32\...\{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}) (Version: 3.1.186.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Monarch (HKLM-x32\...\Monarch) (Version: 0.0.0.0 - INTENIUM GmbH)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
muvee Reveal (HKLM-x32\...\{43BA31BA-04BD-2EA3-0A60-A9C54E06D3F2}) (Version: 7.0.43.11502 - muvee Technologies Pte Ltd)
NC Launcher (GameForge) (HKLM-x32\...\NCLauncher_GameForge) (Version: - NCsoft)
Nero BackItUp (HKLM-x32\...\{0420F95C-11FF-4E02-B967-6CC22B188F9F}) (Version: 5.2.22001 - Nero AG)
Nero BackItUp and Burn (HKLM-x32\...\{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}) (Version: 1.2.0031 - Nero AG)
Nero BurnRights (HKLM-x32\...\{397516AE-7DFE-4F90-84E0-BD616D559434}) (Version: 3.6.26001 - Nero AG)
Nero Express (HKLM-x32\...\{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}) (Version: 9.6.16000 - Nero AG)
Nero RescueAgent (HKLM-x32\...\{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}) (Version: 2.6.26000 - Nero AG)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3.1 - )
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
Office-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.00.4 - Bibliographisches Institut & F.A. Brockhaus AG)
OpenOffice.org 3.2 (HKLM-x32\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org)
Paclands (HKLM-x32\...\Paclands) (Version: - )
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3311 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.3311 - CyberLink Corp.) Hidden
PrivitizeVPN (HKLM-x32\...\PrivitizeVPN) (Version: 1.0.0 - OOO Industry) <==== ATTENTION
QLBCASL (x32 Version: 6.40.17.2 - Hewlett-Packard) Hidden
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0007 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30104 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.2214 - CyberLink Corp.) Hidden
Roozz plugin 2.7.8 (HKLM-x32\...\Roozz plugin_is1) (Version: - roozz.com)
SKIP-BO Castaway Caper (HKLM-x32\...\SKIP-BO Castaway Caper) (Version: 1.00 - phenomedia publishing gmbh)
Snowy (HKLM-x32\...\Snowy) (Version: - )
Spiele für Windows 8 (HKLM-x32\...\Spiele für Windows 8) (Version: - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Studie zur Verbesserung von HP Deskjet 2540 series (HKLM\...\{2ECCF1B6-7045-45A9-BDE1-FE8561ED0184}) (Version: 30.0.1093.41190 - Hewlett-Packard Co.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.29.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
Trials Evolution Gold Edition Demo (HKLM-x32\...\InstallShield_{CDAC5193-036E-44AA-A1E9-E9440D9F7CEC}) (Version: 1.0.0.0 - Ubisoft)
Trials Evolution Gold Edition Demo (x32 Version: 1.0.0.0 - Ubisoft) Hidden
Unity Web Player (HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Verbindungsassistent (HKLM-x32\...\Verbindungsassistent) (Version: 2.1 - Verbindungsassistent)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WashAndGo (HKLM-x32\...\WashAndGo_is1) (Version: 17.7 - Abelssoft)
WEB.DE Internet Explorer Addon (HKLM-x32\...\1&1 Mail & Media GmbH 1und1InternetExplorerAddon) (Version: 1.0.0.3 - 1&1 Mail & Media GmbH)
WEB.DE Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 2.0.1.9 - 1&1 Mail & Media GmbH)
WEB.DE Toolbar für Internet Explorer (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 1.7.0.0 - 1&1 Mail & Media GmbH)
WEB.DE Toolbar MSVC100 CRT x64 (Version: 1.0.0 - 1&1 Mail & Media GmbH) Hidden
WEB.DE Toolbar MSVC100 CRT x86 (x32 Version: 1.0.0 - 1&1 Mail & Media GmbH) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
World Cup Cricket 20-20 (x32 Version: 2.2.0.95 - WildTangent) Hidden
ZoomEx (HKLM\...\{B3E767AD-56C8-E570-079B-1EEA6804455B}) (Version: 1.0 - )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Birte Hill\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1992077360-1904998855-2622201860-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Birte Hill\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)
==================== Restore Points =========================
11-06-2015 06:51:59 Windows Update
12-06-2015 06:51:48 Windows Update
17-06-2015 07:20:52 Windows Update
20-06-2015 21:54:34 Windows Update
25-06-2015 20:03:38 Windows Update
01-07-2015 07:16:17 Windows Update
04-07-2015 08:26:06 Windows Update
07-07-2015 19:16:16 Windows Update
14-07-2015 19:25:09 Windows Update
16-07-2015 07:25:52 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0A8FCEB8-8F73-4EE8-9407-4EA972FD15AB} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2013-02-08] (Hewlett-Packard Co.)
Task: {1745C629-8CFB-4952-BA92-B05F33786F52} - System32\Tasks\{ED000C6A-6B97-44B6-837C-0CA1EEDBE443} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.9.0.115.161/de/abandoninstall?page=tsProgressBar
Task: {274E4342-5927-4FCB-892E-1004AFE2A830} - System32\Tasks\{2E45DF56-AF32-4D28-B3AF-7D82A5AEB567} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.9.0.115.161/de/abandoninstall?page=tsProgressBar
Task: {2D8EBC50-5401-4C8A-8218-836D5E830A9C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {3292BB6C-65C8-47CF-8725-B49ABD262287} - System32\Tasks\GoogleUpdateTaskMachineUA1cf54b149cb8bf8 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {35D57A07-1B95-46B0-8E9F-CE359CCAF765} - System32\Tasks\{A6105DD8-218B-45A9-8B6D-8E41AA187129} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.115/de/abandoninstall?page=tsProgressBar
Task: {3663815A-A89C-43A5-874D-0E45AD422BD1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2015-06-30] (Microsoft)
Task: {3CCF0496-BC09-4474-91DB-5EA4B9E5D059} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core => C:\Users\Birte Hill\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-03] (Facebook Inc.)
Task: {3F04272E-86FA-4502-9961-F04D2C2AF789} - System32\Tasks\AbelssoftPreloader => C:\Program Files (x86)\WashAndGo\AbelssoftPreloader.exe [2012-09-27] (Microsoft)
Task: {48EABA83-EE11-4961-8A17-0B4D4A87CC3C} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4EA97E43-EB7D-4C95-A8FE-4979137529E6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2012-11-13] (Safer-Networking Ltd.)
Task: {4EC772D2-CEC9-4D7F-93E8-8BD175BD2BC4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2012-11-13] (Safer-Networking Ltd.)
Task: {5B409C6E-A7E3-4374-8F47-65C21B85CA1D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {64DCD51B-3C8A-4617-82F7-9B43EDDA5A10} - System32\Tasks\ZoomExUpdaterTask{1BB1866A-44D9-4244-80F3-15927FD2CD03} => C:\ProgramData\Premium\ZoomEx\ZoomEx.exe <==== ATTENTION
Task: {6D6BDAA4-1E34-46D2-95C1-9B79A6A36674} - System32\Tasks\1und1 Konfiguration => C:\ProgramData\1und1InternetExplorerAddon\ConfigTask.exe [2011-03-16] (1und1 Mail und Media GmbH)
Task: {71F0E1D3-9AC1-4ECA-81E2-88E450D25304} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004UA => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {7EE2EBC9-DFDD-4670-BDEA-CFD29947E473} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {86F7E5C8-C2A0-48F6-BFBF-39A5E1FF9EC1} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {8C3DC500-4A36-4E8D-87F9-3021D6443836} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004Core => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {8E683AC8-88F3-4D50-ABC5-0818BC630F87} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-06-16] (Hewlett-Packard)
Task: {A11A2219-A5B3-449F-9EDC-2954ADE3CAA4} - System32\Tasks\{1FA2E99D-968B-4481-9DBD-75A8860A35B9} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.9.0.115.161/de/abandoninstall?page=tsProgressBar
Task: {A1F3444E-CDDD-4042-B394-F7358890B8BC} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2011-07-28] (1&1 Mail & Media GmbH)
Task: {A539F98C-9909-47C4-A408-96E5DF31CCB4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {B3CFBE39-6EF6-4F6D-AFAA-914786F94DEE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core => C:\Users\Birte Hill\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {C58F9F59-9A9C-43B4-A659-04B9A3F5AA60} - System32\Tasks\GoogleUpdateTaskMachineUA1d00112ca0a07d2 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {C87DC486-F39A-42C5-9E54-F06F54E543E6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001UA1cf6aba44d2d583 => C:\Users\Birte Hill\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {CB0B6F83-CBF4-478B-A507-C3AED28D4743} - System32\Tasks\{38C5B52B-2A58-45AC-9878-481B00BEE4D4} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.9.0.115.161/de/abandoninstall?page=tsProgressBar
Task: {D0576959-EBFF-477C-B86E-417CCB8B756A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {E0E938E4-BAE8-4F8F-8FE6-DEBCB52EBED5} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001UA => C:\Users\Birte Hill\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-03] (Facebook Inc.)
Task: {E474F669-2228-4B98-B04E-0A84B1E98DED} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {F03F4C9B-F2C6-49D4-8CCC-102DD2DAA69A} - System32\Tasks\{09CD27C7-C32E-4573-A11E-4D55B3350332} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.115/de/abandoninstall?page=tsProgressBar
Task: {F15F9ABE-465C-4265-B70F-BDC0ABEB6392} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {F2B466D1-7581-4134-9967-F3908E32DB1B} - System32\Tasks\{975588B5-E3DA-4386-820C-8FB996E2FA9E} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.9.0.115.161/de/abandoninstall?page=tsProgressBar
Task: {F39B1336-5452-4AF1-8AF4-3C090F1858EE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {F6E49301-8D21-4EFF-8E9C-4FF003EE58B3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2012-11-13] (Safer-Networking Ltd.)
Task: {F75A385E-AF87-4D6B-9176-24D1D2AEFE96} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-28] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\AbelssoftPreloader.job => 0x01060100AC95F7D2061B874FB9EFEB2A1427D4AB4600EE00000000003C000000200000000014730F000000000013040000208021DF07070003000F00100005001A0080020000380043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C00570061007300680041006E00640047006F005C004100620065006C00730073006F00660074005000720065006C006F0061006400650072002E006500780065000000060069006E00640065007800000000000B00420069007200740065002000480069006C006C0000000000000008000000000000000000010030000000DC070B000E000000000000000000000000000000000000000000000007000000010000000000000000000000
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core.job => C:\Users\Birte Hill\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001UA.job => C:\Users\Birte Hill\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf54b149cb8bf8.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d00112ca0a07d2.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001Core.job => C:\Users\Birte Hill\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1001UA1cf6aba44d2d583.job => C:\Users\Birte Hill\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004Core.job => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1992077360-1904998855-2622201860-1004UA.job => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ZoomExUpdaterTask{1BB1866A-44D9-4244-80F3-15927FD2CD03}.job => C:\ProgramData\Premium\ZoomEx\ZoomEx.exe?/schedule /profile C:\ProgramData\Premium\ZoomEx\profile.ini <==== ATTENTION
==================== Loaded Modules (Whitelisted) ==============
2014-07-29 15:52 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-05-05 17:58 - 2009-11-04 09:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxeadrpp.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2014-02-27 22:48 - 2014-02-27 22:48 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2009-11-07 22:42 - 2009-07-06 21:20 - 00247152 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2011-07-30 19:25 - 2009-03-03 12:45 - 00296400 ____N () C:\Program Files (x86)\Verbindungsassistent\WTGService.exe
2010-05-05 17:54 - 2010-05-05 09:18 - 00770728 _____ () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe
2014-12-13 00:24 - 2014-12-13 00:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2009-07-01 16:44 - 2009-07-01 16:44 - 00632888 _____ () C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
2012-12-15 14:50 - 2012-11-13 15:06 - 00108960 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2012-12-15 14:50 - 2012-11-13 15:06 - 00416160 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2012-12-15 14:50 - 2012-11-13 15:06 - 00158624 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2012-12-15 14:50 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2012-12-15 14:50 - 2012-11-13 15:06 - 00528288 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2010-05-05 17:54 - 2010-04-01 13:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeascw.dll
2010-05-05 17:54 - 2009-05-27 14:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeadatr.dll
2010-05-05 17:54 - 2010-04-01 13:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeaDRS.dll
2010-05-05 17:54 - 2009-03-10 07:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark S300-S400 Series\lxeacaps.dll
2010-05-05 17:53 - 2009-02-20 10:48 - 00381440 _____ () C:\Windows\system32\lxeasm.dll
2010-05-05 17:53 - 2009-04-28 09:56 - 00024064 _____ () C:\Windows\system32\lxeasmr.dll
2009-08-20 12:35 - 2009-08-20 12:35 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2009-08-20 12:35 - 2009-08-20 12:35 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2009-08-20 12:35 - 2009-08-20 12:35 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
2009-09-29 16:25 - 2009-09-29 16:25 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2010-05-04 16:36 - 2010-05-04 16:36 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2012-12-15 14:50 - 2012-11-13 15:06 - 00554400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2015-07-14 18:52 - 2015-07-13 23:55 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.134\libglesv2.dll
2015-07-14 18:52 - 2015-07-13 23:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.134\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:AF54CFFD
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1992077360-1904998855-2622201860-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Birte Hill\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{4B086F20-0C84-417F-BE1B-35F627C99949}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{C43F2715-742C-46C3-8856-C36FFBB1169E}] => (Allow) svchost.exe
FirewallRules: [{D22E2EDA-4D5C-42A5-B64D-BB007AB36609}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector\PDR.EXE
FirewallRules: [{0A0234A0-9B5A-419D-A3B4-F0C5DF4B79AC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{0E2E3556-6C73-4839-AA0B-BBEDE33A70B8}] => (Allow) C:\Windows\system32\lxeacoms.exe
FirewallRules: [{47B5DDAE-6353-42AE-8D7E-7188664A945E}] => (Allow) C:\Windows\system32\LXEAcoms.exe
FirewallRules: [{E6A8E816-9A64-4E03-A9F7-03483E75C1E7}] => (Allow) C:\Windows\system32\LXEAcoms.exe
FirewallRules: [{A7720C1F-266B-4718-A7D8-7D5B27BCD52F}] => (Allow) C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe
FirewallRules: [{70D065EF-6FB7-495D-B4C0-8B42C09F2176}] => (Allow) C:\Program Files (x86)\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe
FirewallRules: [{FD559793-4B3B-471C-B188-05F405E203A1}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{1B2EB8FA-CB40-413C-B42F-25274C0FF334}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{9F459068-B528-4771-9370-FF2D6A564DED}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{04863C95-E069-41EC-AC01-C20EA406D230}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6B411C06-8DE9-4840-BB95-3ED190DCD9E7}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{12506E48-023B-422F-A5B6-A27C03021D60}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{5FAF92AC-77DF-43D2-920D-CB57EFB06B32}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{1767ADF9-48B6-49AF-B2E1-184B628C67C6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{AEF35C1D-F6C2-471E-9EA5-AAD3B7693FE4}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{CCA82AF4-EED4-4CD5-9652-E35191BF92CA}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{59826414-4B2A-44BA-9FD3-A8D6AE21F29F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C298962E-82CC-40A5-ABDB-536AC0F878D2}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{7AC70F7D-BD0A-442C-99D3-5D516852A7DD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{08D606BF-E9B9-43F7-AD93-CFB3E54B7053}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{18DF94EB-967A-48FA-85F1-27C0D4A66BFB}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{BB47CE58-5415-48E8-8967-496776507345}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6F2DC606-28F3-46E9-955F-19547A3B82A8}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{017B50FB-4C91-4DD9-9A19-095884A9441E}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{F9968947-D5BA-4EF1-B97C-44C60EA8FA5A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{AB4A6562-2E57-4885-AB00-7F46D72ED4AD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{8E758DFD-22F1-437F-A3C2-4A8DBC8662D9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{D6850534-07D9-43E6-89CD-4AF04DEAA3DA}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6F54D408-8A83-4BD3-9D04-4BD09832E908}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{2E2CFA59-37A0-43F2-A4A3-CB2659D23E54}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{AC4D2BAC-9146-4162-8E42-EA58BDB2C8DB}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{72D762C1-DDC2-474A-A6A4-C9DE7BAF3ED6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{0DA11C67-AAE9-4FF7-9B27-271583ECE1B4}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{0796C372-507D-4B55-BF8A-E82E2B027F80}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6F891E0D-E3F2-4FD2-B1D7-82DA9FE22156}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{CADE15B4-6BB6-441C-9086-951EACA13A26}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{2C9013E6-31E3-43B3-A07B-C619922EEE5C}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E9D9A81C-24E4-4A60-BDEA-1F65C6888B9C}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{72B58F8E-CCF3-4E6C-8155-8C02FD2850F5}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{A76479AE-E261-4E6A-82C5-6473F7D5E0E0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{B8259F14-E5CF-4023-8C53-342BC9374860}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{47E408EE-E011-43D0-9A26-91232CA360F4}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{78321DE0-B8D4-4315-8F3E-8C400C3A88BF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C391D2C1-ED84-4629-88DD-E53B7B2223AD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{10207741-B386-4C3D-A9D9-72E54721CD7D}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6E4E18AB-7D33-49E2-A699-C18FAB2FF989}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C0E0CD72-522D-4461-AB5E-C1375B554153}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{1EBA189F-3134-4095-AE1E-66CC6AC1E5E5}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{53B2D3A1-05BC-4800-933A-E51BB954E3EF}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{38F0C88C-EC1D-4FCF-8E50-34321FBFD251}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{5E5E3C9C-3089-40C4-BCF2-1F1799BD96E8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{7388797F-8C48-433E-9DDD-B4FA4153EB3E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [TCP Query User{1FF34039-8FCC-47EE-9AA8-53721CCB05DF}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{45675329-93D3-4647-A33D-8CBD0C5ABCC0}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{74DACD95-0130-43FD-92D3-F8AFF8BCD002}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BA8851C4-41F5-4B45-B204-2BE9E771F6A1}] => (Allow) LPort=2869
FirewallRules: [{2DF16903-3E13-4E44-8CFD-F105A3D4853B}] => (Allow) LPort=1900
FirewallRules: [{0E98B2DE-B73C-44C3-BA1C-70855A41F4C5}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{F4321412-D969-4C09-92D3-770FCD1CD372}] => (Allow) C:\Windows\SysWOW64\msiexec.exe
FirewallRules: [{AA42711C-435C-4446-B59A-7C4536C8ED4D}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{A2D5ECAD-F406-4D9A-98A4-F7FCC0936D59}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{FF7DDD69-F318-4EE2-9C7C-260D0E5E28FC}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{09F3A942-8F90-4A7E-8A65-4F9D180BC236}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{942F6DB9-6638-400D-97B9-A51DA0CB8DB1}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{3DD44E13-416C-47C6-B082-C026D1BCEC92}C:\program files\java\jre6\bin\javaw.exe] => (Block) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{84674376-8027-4ECF-A515-20C59C1C623F}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [UDP Query User{1C1B1716-D7FB-4DB3-B2CD-EB5315E28640}C:\windows\syswow64\javaw.exe] => (Allow) C:\windows\syswow64\javaw.exe
FirewallRules: [TCP Query User{CB3B1185-4476-4CCB-8151-15AF10E0957D}C:\program files\java\jre6\bin\java.exe] => (Block) C:\program files\java\jre6\bin\java.exe
FirewallRules: [UDP Query User{25FDB765-86C3-4C61-BD98-97A05099A291}C:\program files\java\jre6\bin\java.exe] => (Block) C:\program files\java\jre6\bin\java.exe
FirewallRules: [TCP Query User{CA5517B6-D512-4B23-BA8D-40AFD86D0E4B}C:\program files (x86)\java\jre6\bin\java.exe] => (Block) C:\program files (x86)\java\jre6\bin\java.exe
FirewallRules: [UDP Query User{644B9984-8577-48B1-BED8-3420C3B348BD}C:\program files (x86)\java\jre6\bin\java.exe] => (Block) C:\program files (x86)\java\jre6\bin\java.exe
FirewallRules: [{3B28F509-B0B3-4718-ADA2-62B85ECAA2A3}] => (Allow) C:\Users\Birte Hill\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{E7581706-BF68-40D7-A346-3B440290F2C6}] => (Allow) C:\Users\Birte Hill\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{CD198F25-70D5-460B-94D1-383B480B3645}] => (Allow) C:\Users\Birte Hill\AppData\Roaming\ICQM\icq.exe
FirewallRules: [{A887C164-7CAD-4F1B-A0D6-B2991F1E76E1}] => (Allow) C:\Users\Birte Hill\AppData\Roaming\ICQM\icq.exe
FirewallRules: [TCP Query User{03FCADCD-8C56-4A49-9C3E-0AE2EEF83D97}C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe] => (Allow) C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe
FirewallRules: [UDP Query User{2D6D26B6-C984-4F0C-86C0-4B34DA92AEF2}C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe] => (Allow) C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe
FirewallRules: [{22DCB99B-A3F1-4C03-8330-B34E61C1FBB9}] => (Block) C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe
FirewallRules: [{40379C11-6A24-4B84-B18C-A9D3918E91B6}] => (Block) C:\users\birte hill\appdata\local\apps\2.0\aqjp8orr.9je\y2d2chkb.6vj\laun...app_59711684aa47878d_0001.001d_82c2447510b53390\launcher.exe
FirewallRules: [{666D7A4A-510F-4FC6-A69B-597FBF469F33}] => (Allow) C:\Users\Birte Hill\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{9A18C5FE-0068-4CFF-9B64-BF8E4DB2E6F7}] => (Allow) C:\Users\Birte Hill\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{86229F51-423A-4379-AC77-7E30B22C9903}] => (Allow) C:\Program Files (x86)\Ubisoft\Trials Evolution Gold Edition Demo\datapack\trialsFMX.exe
FirewallRules: [{EFF153BF-E8DC-444C-89DA-5281F13B73A4}] => (Allow) C:\Program Files (x86)\Ubisoft\Trials Evolution Gold Edition Demo\datapack\trialsFMX.exe
FirewallRules: [{ABFBC0A9-2855-4F51-BE4E-BA9B72F20D1D}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{94244D5C-41D8-4A51-A12E-D03591BAA1AB}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{9BBF26E6-C80E-4D45-BA40-8BB6FC1C4E90}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{DC249CCB-8701-4DC9-9A7A-33002D3EE234}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{6B0B16F9-F216-4F38-BA42-61C88052B99D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{DFE65004-1CE6-449C-980C-BA9CE2019906}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{DFE37906-1B56-432D-8CDC-B3E6B1B3A7BD}] => (Allow) C:\Users\Birte Hill\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{EF4F93A0-45A4-4ADC-8F36-93437E11253A}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{52641709-918D-4459-9E9B-227AF71C84F9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{D169D2DC-1AF8-4CF0-A758-81AD1D973606}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot-S&D 2 Tray Icon
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Faulty Device Manager Devices =============
Name: YAC NDIS Driver
Description: YAC NDIS Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: iSafeNetFilter
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/11/2015 12:33:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18762, Zeitstempel: 0x54dd89c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005072a
ID des fehlerhaften Prozesses: 0x9e0
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (07/06/2015 12:45:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007feeb077a1e
ID des fehlerhaften Prozesses: 0x1ca8
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (07/04/2015 09:33:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007feeb0773c0
ID des fehlerhaften Prozesses: 0x14a4
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (07/03/2015 09:32:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef27673c0
ID des fehlerhaften Prozesses: 0x1ee0
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (07/01/2015 07:57:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef2c773c0
ID des fehlerhaften Prozesses: 0x1b5c
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (07/01/2015 03:05:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: hpasset.exe, Version: 3.0.3.1, Zeitstempel: 0x5202c98c
Name des fehlerhaften Moduls: hpasset.exe, Version: 3.0.3.1, Zeitstempel: 0x5202c98c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002b78a
ID des fehlerhaften Prozesses: 0x14e8
Startzeit der fehlerhaften Anwendung: 0xhpasset.exe0
Pfad der fehlerhaften Anwendung: hpasset.exe1
Pfad des fehlerhaften Moduls: hpasset.exe2
Berichtskennung: hpasset.exe3
Error: (06/30/2015 07:56:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef27673c0
ID des fehlerhaften Prozesses: 0x19f4
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (06/29/2015 07:55:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007feeb0773c0
ID des fehlerhaften Prozesses: 0x1c78
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (06/25/2015 06:54:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3165, Zeitstempel: 0x52677fe0
Name des fehlerhaften Moduls: NvUpdt.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52676b2f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007feeb077a1e
ID des fehlerhaften Prozesses: 0x15a4
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (06/24/2015 04:27:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: hpasset.exe, Version: 3.0.3.1, Zeitstempel: 0x5202c98c
Name des fehlerhaften Moduls: hpasset.exe, Version: 3.0.3.1, Zeitstempel: 0x5202c98c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002b78a
ID des fehlerhaften Prozesses: 0x1618
Startzeit der fehlerhaften Anwendung: 0xhpasset.exe0
Pfad der fehlerhaften Anwendung: hpasset.exe1
Pfad des fehlerhaften Moduls: hpasset.exe2
Berichtskennung: hpasset.exe3
System errors:
=============
Error: (07/15/2015 04:08:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (07/15/2015 04:06:11 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
iSafeNetFilter
Error: (07/15/2015 04:05:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lxeaCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/15/2015 04:05:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxeaCATSCustConnectService erreicht.
Error: (07/15/2015 04:05:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Software Framework Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (07/15/2015 04:05:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst HP Software Framework Service erreicht.
Error: (07/15/2015 04:01:59 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {3EB3C877-1F16-487C-9050-104DBCD66683}
Error: (07/15/2015 04:01:39 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (06/17/2015 10:22:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (06/17/2015 10:20:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lxeaCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Microsoft Office:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz
Percentage of memory in use: 69%
Total physical RAM: 4062.93 MB
Available physical RAM: 1247.66 MB
Total Virtual: 8124.06 MB
Available Virtual: 4359.63 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:452.8 GB) (Free:246.94 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:12.76 GB) (Free:2.13 GB) NTFS ==>[system with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 5B1FB528)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=452.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12.8 GB) - (Type=07 NTFS)
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-07-16 12:37:08 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK5056GSY rev.LH003C 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\BIRTEH~1\AppData\Local\Temp\uwliyuoc.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960000d4d00 7 bytes [00, 89, F3, FF, C1, 98, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960000d4d08 3 bytes [C0, 06, 02] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074bb1401 2 bytes JMP 76c4b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074bb1419 2 bytes JMP 76c4b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074bb1431 2 bytes JMP 76cc8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074bb144a 2 bytes CALL 76c2489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074bb14dd 2 bytes JMP 76cc8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074bb14f5 2 bytes JMP 76cc89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074bb150d 2 bytes JMP 76cc8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074bb1525 2 bytes JMP 76cc8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074bb153d 2 bytes JMP 76c3fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074bb1555 2 bytes JMP 76c468ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074bb156d 2 bytes JMP 76cc8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074bb1585 2 bytes JMP 76cc8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074bb159d 2 bytes JMP 76cc86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074bb15b5 2 bytes JMP 76c3fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074bb15cd 2 bytes JMP 76c4b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074bb16b2 2 bytes JMP 76cc8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074bb16bd 2 bytes JMP 76cc8671 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [2704] entry point in ".rdata" section 000000006b5b71e6 ---- Threads - GMER 2.1 ---- Thread c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1140:1924] 000007fef7da3e0c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1140:1920] 000007fef7da3e0c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1140:1972] 000007fef3bbbc60 Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:2188] 000007fef7da3e0c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:2192] 000007fef57ff5f8 Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:2196] 000007fef7da3e0c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:2200] 000007fef3bbbc60 Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:2204] 000007fef7da3e0c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1200:5692] 000007fef7da3e0c ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0011675ab0e5 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{34B8F28D-B5F1-489F-A14E-C7C2D12D3718}@LeaseObtainedTime 1437042109 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{34B8F28D-B5F1-489F-A14E-C7C2D12D3718}@T1 1437042236 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{34B8F28D-B5F1-489F-A14E-C7C2D12D3718}@T2 1437042332 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{34B8F28D-B5F1-489F-A14E-C7C2D12D3718}@LeaseTerminatesTime 1437042364 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0011675ab0e5 (not active ControlSet) Reg HKCU\Software\Microsoft\Windows Live\Companion\flo.hill1@web.de@5c3a671bf7510a076b3aa2ebfed10fe5\r\n 0xA0 0xE9 0x88 0x3D ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- |
| Themen zu Windows 7: Malware Gefunden und unerwünschte Programme |
| adobe, adware, browser, cpu, defender, device driver, excel, failed, flash player, google, home, homepage, iexplore.exe, launch, malware, mozilla, newtab, programm, realtek, registry, scan, security, services.exe, system, teredo, trojaner, udp, viren, windows |
Baum-Darstellung