| |
| |||||||
Log-Analyse und Auswertung: Makrovirus in mail von "Berges Antriebstechnik"?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
23.12.2015, 16:47
| #1 |
 |  Makrovirus in mail von "Berges Antriebstechnik"? Liebe Helfer, am 21.12.15 habe ich eine mail mit dem Betreff "Bestellung" von der Firma Berges Antriebstechnik erhalten. Im Anhang befand sich ein word-Dokument, welches ich dummerweise geöffnet habe (ohne Textinhalt). Im Nachhinein habe ich nun erfahren, dass in dem Anhang ein Trojaner eingebaut sein könnte. Daher habe ich meinen Virenscanner (Avira free antivirus Produktversion 15.0.15.129 03.12.2015) bemüht, der auch diverse Viren finden konnte (siehe log-Datei). Zusätzlich habe ich anschließend den Scanner Malwarebytes laufen lassen. Auch dieser hat diverse Funde erzeugt. Problem: Wie kann ich sicher sein, dass ich mir keine Schadsoftware eingefangen habe? Welchen Schaden kann ein möglicher Trojaner anrichten? Könnte es beim Online-banking gefährlich werden? Sicherheitshalber habe ich den Zugang von meiner Bank sperren lassen. Gruß Martin |
|
23.12.2015, 20:00
| #2 |
| /// TB-Ausbilder /// Anleitungs-Guru  | Makrovirus in mail von "Berges Antriebstechnik"? Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das... 
 Hinweis:Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean  bekommst.Los geht's: Schritt 1   Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff Posten in CODE-Tags: So gehts... Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
23.12.2015, 21:37
| #3 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo Jürgen,
__________________vielen Dank für Deine Bereitschaft, mir zu helfen! Super! Die Installation von Farbar's Recovery Scan Tool und die Untersuchung hat prima funktioniert. Hier nun die FRST.txt-Datei: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-12-2015 durchgeführt von Martin Sudbrock (Administrator) auf MARTINSUDBROCK (23-12-2015 21:12:53) Gestartet von C:\Users\Martin Sudbrock\Desktop\Downloads Geladene Profile: Martin Sudbrock & (Verfügbare Profile: Martin Sudbrock & UpdatusUser) Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Chrome) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe () C:\Windows\Installer\MSI2D4A.tmp (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe () C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe (Dropbox, Inc.) C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (Dropbox, Inc.) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Sony Corporation) C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe (Acer Group) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Program Files\WinZip Driver Updater\DriverUpdater.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10806816 2010-04-30] (Realtek Semiconductor) HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe [611872 2010-08-04] () HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [Reader Application Helper] => C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2014-10-24] (Sony Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1067736 2015-10-28] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-12-08] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [803200 2015-12-03] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2433024 2011-08-12] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [phonostar-PlayerTimer] => C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [43008 2015-10-15] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [Dropbox Update] => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3639280 2015-12-20] (Electronic Arts) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\MountPoints2: {68166438-66a3-11e5-bdb5-1078d272153b} - E:\OnePlus_setup.exe /s HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\MountPoints2: {6fce6da9-291a-11e5-946d-1078d272153b} - E:\LaunchU3.exe -a HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\MountPoints2: {ffab7981-d755-11df-acfe-806e6f6e6963} - D:\wubi.exe HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2433024 2011-08-12] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [phonostar-PlayerTimer] => C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [43008 2015-10-15] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Dropbox Update] => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3639280 2015-12-20] (Electronic Arts) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {68166438-66a3-11e5-bdb5-1078d272153b} - E:\OnePlus_setup.exe /s HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {6fce6da9-291a-11e5-946d-1078d272153b} - E:\LaunchU3.exe -a HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {ffab7981-d755-11df-acfe-806e6f6e6963} - D:\wubi.exe HKU\S-1-5-21-1418818919-2476079493-1430080804-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [ScrSav] => C:\Program Files (x86)\eMachines\Screensaver\run_eMachines.exe [154144 2010-07-29] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\eMachines.scr [456224 2010-07-29] () ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-22] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-22] ShortcutTarget: Dropbox.lnk -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2015-12-22] ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{C6A3E703-E7F6-46DF-B206-0338AC0FCE10}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {72952258-72F6-4AD8-B6CA-DBBAFE179B93} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {B62A53F7-416C-44A4-B8C4-5CAB1F4F43C2} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=ab96a47a-0013-43ce-9f07-2c42ac6ee9d2&apn_sauid=32E7B5FD-2C4E-4A5F-96DB-801ACA79E001 SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {72952258-72F6-4AD8-B6CA-DBBAFE179B93} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {B62A53F7-416C-44A4-B8C4-5CAB1F4F43C2} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=ab96a47a-0013-43ce-9f07-2c42ac6ee9d2&apn_sauid=32E7B5FD-2C4E-4A5F-96DB-801ACA79E001 BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2012-11-22] (pdfforge GbR) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-25] (Oracle Corporation) BHO-x32: MimalaAmazonToolbar.ShowToolbarBHO -> {86a3cdaa-9b25-480e-b73f-c2d359b87966} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-25] (Oracle Corporation) Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll [2012-11-22] (pdfforge GbR) Toolbar: HKLM-x32 - Mimala Amazon Toolbar - {691ca8ec-7205-4aa9-bdd6-15493d16f835} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation) Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> Kein Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - Keine Datei Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - Keine Datei Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default FF DefaultSearchEngine: Yahoo Web FF SearchEngineOrder.1: FF SelectedSearchEngine: Delta Search FF Homepage: hxxps://de.yahoo.com/?type=orcl_hpset FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll [2015-08-08] () FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll [2015-08-08] () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-25] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-25] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation) FF Plugin-x32: @sony.com/ReaderDesktop -> C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll [2014-10-24] (Sony Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\8\NP_wtapp.dll [2014-05-03] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1418818919-2476079493-1430080804-1000: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll [2015-10-15] ( ) FF Plugin HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll [2015-10-15] ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\searchplugins\yahoo-ysp.xml [2015-11-25] FF Extension: Toolbar für amazon.de - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\0001.amztoolbar@minimalarts.de [2013-05-27] [ist nicht signiert] FF Extension: LyricXeeker - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\128 [2013-08-16] [ist nicht signiert] FF Extension: LyricXeeker - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\130 [2013-08-27] [ist nicht signiert] FF Extension: Avira Browser Safety - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\abs@avira.com [2015-12-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-06-19] [ist nicht signiert] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-06-19] [ist nicht signiert] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-01] [ist nicht signiert] Chrome: ======= CHR DefaultSearchURL: Default -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default CHR DefaultSearchKeyword: Default -> Yahoo CHR DefaultSuggestURL: Default -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10 CHR Profile: C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04] CHR Extension: (Google Docs) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04] CHR Extension: (Google Drive) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21] CHR Extension: (YouTube) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Google Tabellen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04] CHR Extension: (Avira Browserschutz) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-12-15] CHR Extension: (Google Docs Offline) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28] CHR Extension: (Google Mail) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [npdicihegicnhaangkdmcgbjceoemeoo] - hxxps://clients2.google.com/service/update2/crx ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [948392 2015-12-03] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [466408 2015-12-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [466408 2015-12-03] (Avira Operations GmbH & Co. KG) R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [251160 2015-12-08] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [506288 2011-02-08] (REINER SCT) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) R2 GREGService; C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) R2 IBYKUS AG: ELSA-Suite update permissions manager. 32063.; C:\Windows\Installer\MSI2D4A.tmp [675840 2015-01-20] () [Datei ist nicht signiert] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2015-12-20] (Electronic Arts) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2014-04-25] (Sony Corporation) [Datei ist nicht signiert] R2 StarMoney 7.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [554160 2011-11-08] (Star Finanz - Software Entwicklung und Vertriebs GmbH) R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH) R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [277904 2011-06-23] (Protect Software GmbH) R2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [228000 2011-06-23] (Protect Software GmbH) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-08-14] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162072 2015-12-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [140448 2015-12-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-12-03] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [75472 2015-12-03] (Avira Operations GmbH & Co. KG) R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2010-11-27] (REINER SCT) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-07-09] (DT Soft Ltd) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-08-14] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-23] (Malwarebytes) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation) S2 AVMPORT; \SystemRoot\System32\drivers\avmport.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-23 21:12 - 2015-12-23 21:12 - 00000000 ____D C:\FRST 2015-12-23 21:07 - 2015-12-23 21:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-12-23 21:04 - 2015-12-23 21:07 - 00000897 _____ C:\Users\Public\Desktop\WinZip Driver Updater.lnk 2015-12-23 21:04 - 2015-12-23 21:07 - 00000322 _____ C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000322 _____ C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock at logon.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000296 _____ C:\Windows\Tasks\Start WinZip Driver Updater for MartinSudbrock@Martin Sudbrock(logon).job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000286 _____ C:\Windows\Tasks\Start WinZip Driver Updater Update.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000280 _____ C:\Windows\Tasks\Start WinZip Driver Updater Schedule.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000000 ____D C:\ProgramData\WinZip 2015-12-23 21:04 - 2015-12-23 21:07 - 00000000 ____D C:\Program Files\WinZip Driver Updater 2015-12-23 16:19 - 2015-12-23 16:42 - 00000000 ____D C:\Users\Martin Sudbrock\Desktop\logfiles Virenscan 2015-12-22 22:52 - 2015-12-22 22:52 - 00000000 ____D C:\ubuntu 2015-12-22 16:58 - 2015-12-23 18:46 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-12-22 16:58 - 2015-12-22 21:33 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-12-22 16:58 - 2015-12-22 16:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-12-22 16:57 - 2015-12-22 16:58 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-12-22 16:57 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-12-22 16:57 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-12-22 16:57 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2015-12-21 19:38 - 2015-12-21 19:38 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Avira 2015-12-21 19:35 - 2015-12-03 15:24 - 00162072 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00140448 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00075472 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-12-17 17:36 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll 2015-12-17 17:35 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll 2015-12-17 17:35 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll 2015-12-17 17:34 - 2015-12-17 17:36 - 00000000 ____D C:\Windows\SysWOW64\directx 2015-12-17 17:34 - 2015-12-17 17:35 - 00000000 ___HD C:\Windows\msdownld.tmp 2015-12-17 17:34 - 2015-12-17 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks 2015-12-17 17:34 - 2015-12-17 17:34 - 00000000 ____D C:\Games 2015-12-16 08:05 - 2015-12-16 08:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2015-12-11 21:17 - 2015-12-11 21:17 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-12-09 21:52 - 2015-12-09 21:52 - 00377817 _____ C:\Users\Martin Sudbrock\Documents\Scan0005.pdf 2015-12-08 22:20 - 2015-11-20 19:54 - 03170304 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00709632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-12-08 22:20 - 2015-11-20 19:54 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-12-08 22:20 - 2015-11-20 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-12-08 22:20 - 2015-11-20 19:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-12-08 22:20 - 2015-11-10 19:55 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-12-08 22:20 - 2015-11-10 19:55 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-12-08 22:20 - 2015-11-10 19:55 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll 2015-12-08 22:20 - 2015-11-10 19:39 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-12-08 22:20 - 2015-11-10 19:37 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll 2015-12-08 22:20 - 2015-11-10 18:47 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-12-08 22:20 - 2015-11-05 20:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll 2015-12-08 22:20 - 2015-11-05 20:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshrm.dll 2015-12-08 22:20 - 2015-11-05 20:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2015-12-08 22:20 - 2015-11-05 20:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2015-12-08 22:20 - 2015-11-05 10:53 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys 2015-12-08 22:20 - 2015-11-03 20:04 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2015-12-08 22:20 - 2015-11-03 19:56 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2015-12-08 22:20 - 2015-10-09 00:22 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL 2015-12-08 22:20 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll 2015-12-08 22:20 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\SysWOW64\locale.nls 2015-12-08 22:20 - 2015-10-08 19:52 - 00419928 _____ C:\Windows\system32\locale.nls 2015-12-08 22:19 - 2015-11-11 22:12 - 00387792 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-12-08 22:19 - 2015-11-11 21:52 - 00341192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-12-08 22:19 - 2015-11-11 19:53 - 01735680 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll 2015-12-08 22:19 - 2015-11-11 19:53 - 00525312 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll 2015-12-08 22:19 - 2015-11-11 19:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll 2015-12-08 22:19 - 2015-11-11 19:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll 2015-12-08 22:19 - 2015-11-11 17:21 - 25837568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-12-08 22:19 - 2015-11-11 17:00 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-12-08 22:19 - 2015-11-11 16:44 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-12-08 22:19 - 2015-11-11 16:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-12-08 22:19 - 2015-11-11 16:41 - 20366848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-12-08 22:19 - 2015-11-11 16:12 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-12-08 22:19 - 2015-11-11 15:57 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-12-08 22:19 - 2015-11-10 01:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-12-08 22:19 - 2015-11-10 01:13 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-12-08 22:19 - 2015-11-10 01:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-12-08 22:19 - 2015-11-10 01:12 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-12-08 22:19 - 2015-11-10 01:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-12-08 22:19 - 2015-11-10 01:11 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-12-08 22:19 - 2015-11-10 01:08 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-12-08 22:19 - 2015-11-10 01:06 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-12-08 22:19 - 2015-11-10 01:06 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-12-08 22:19 - 2015-11-10 01:04 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-12-08 22:19 - 2015-11-10 01:03 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-12-08 22:19 - 2015-11-10 01:02 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-12-08 22:19 - 2015-11-10 01:02 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-12-08 22:19 - 2015-11-10 00:50 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-12-08 22:19 - 2015-11-10 00:47 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-12-08 22:19 - 2015-11-10 00:46 - 04514816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-12-08 22:19 - 2015-11-10 00:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2015-12-08 22:19 - 2015-11-10 00:37 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-12-08 22:19 - 2015-11-10 00:36 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-12-08 22:19 - 2015-11-10 00:36 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-12-08 22:19 - 2015-11-10 00:35 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-12-08 22:19 - 2015-11-10 00:17 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-12-08 22:19 - 2015-11-10 00:14 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-12-08 22:19 - 2015-11-10 00:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-12-08 22:19 - 2015-11-08 23:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-12-08 22:19 - 2015-11-08 23:32 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-12-08 22:19 - 2015-11-08 23:16 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 02887168 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 00571392 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-12-08 22:19 - 2015-11-08 23:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-12-08 22:19 - 2015-11-08 23:14 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-12-08 22:19 - 2015-11-08 23:07 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-12-08 22:19 - 2015-11-08 23:06 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-12-08 22:19 - 2015-11-08 23:04 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-12-08 22:19 - 2015-11-08 23:02 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-12-08 22:19 - 2015-11-08 23:01 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-12-08 22:19 - 2015-11-08 22:52 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-12-08 22:19 - 2015-11-08 22:48 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-12-08 22:19 - 2015-11-08 22:40 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-12-08 22:19 - 2015-11-08 22:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-12-08 22:19 - 2015-11-08 22:32 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-12-08 22:19 - 2015-11-08 22:29 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2015-12-08 22:19 - 2015-11-08 22:18 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-12-08 22:19 - 2015-11-08 22:15 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-12-08 22:19 - 2015-11-08 22:15 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-12-08 22:19 - 2015-11-08 22:14 - 14456832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-12-08 22:19 - 2015-11-08 22:14 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-12-08 22:19 - 2015-11-08 22:13 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-12-08 22:19 - 2015-11-08 21:53 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-12-08 22:19 - 2015-11-08 21:41 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-12-08 22:19 - 2015-11-08 21:30 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-12-08 22:19 - 2015-11-03 20:04 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\els.dll 2015-12-08 22:19 - 2015-11-03 19:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\els.dll 2015-12-05 18:16 - 2015-12-05 22:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2015-12-03 16:05 - 2015-12-03 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-12-02 08:29 - 2015-12-02 08:29 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12cd32399d857.job 2015-11-28 19:02 - 2015-11-28 19:02 - 00000000 ____D C:\Program Files (x86)\Origin Games 2015-11-28 18:49 - 2015-11-28 19:21 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Origin 2015-11-28 18:49 - 2015-11-28 19:02 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\Origin 2015-11-28 18:46 - 2015-12-23 10:54 - 00000000 ____D C:\ProgramData\Origin 2015-11-28 18:46 - 2015-11-28 18:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin 2015-11-28 18:44 - 2015-12-20 11:39 - 00000000 ____D C:\Program Files (x86)\Origin 2015-11-27 16:13 - 2015-11-27 16:13 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\FIFA 12 2015-11-26 20:40 - 2015-12-22 21:33 - 00002181 _____ C:\Users\Public\Desktop\UEFA EURO 2012.lnk 2015-11-25 20:19 - 2015-11-25 20:19 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\FBV 2015-11-25 12:36 - 2015-11-25 12:36 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\YSearchUtil 2015-11-25 12:36 - 2015-11-25 12:36 - 00000000 ____D C:\Program Files (x86)\Yahoo! 2015-11-25 12:34 - 2015-11-25 12:34 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Sun 2015-11-25 12:34 - 2015-11-25 12:34 - 00000000 ____D C:\Users\Martin Sudbrock\.oracle_jre_usage 2015-11-25 12:32 - 2015-11-25 12:32 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\LocalLow\Oracle 2015-11-24 18:25 - 2015-11-24 18:25 - 00698125 _____ C:\Users\Martin Sudbrock\Documents\Scan0004.pdf ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-23 21:12 - 2007-07-12 02:48 - 00000000 ____D C:\Windows 2015-12-23 14:25 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Lebendiger Adventskalender 2015-12-23 11:01 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-12-23 11:01 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-12-23 10:53 - 2014-06-17 21:52 - 00000000 ___RD C:\Users\Martin Sudbrock\Dropbox 2015-12-23 10:53 - 2011-06-19 09:29 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox 2015-12-23 10:52 - 2011-09-03 16:58 - 00000000 ____D C:\Users\Martin Sudbrock\.rainlendar2 2015-12-23 10:52 - 2010-10-14 06:50 - 00000000 ____D C:\ProgramData\NVIDIA 2015-12-22 21:33 - 2015-09-02 18:57 - 00001191 _____ C:\Users\Public\Desktop\Avira Launcher.lnk 2015-12-22 21:33 - 2015-08-10 18:35 - 00002153 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk 2015-12-22 21:33 - 2015-04-04 11:23 - 00001575 _____ C:\Users\Public\Desktop\Digitale Antragstellung 2015.lnk 2015-12-22 21:33 - 2014-11-17 21:32 - 00002178 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-12-22 21:33 - 2014-11-17 21:15 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-12-22 21:33 - 2014-11-17 20:46 - 00002022 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2015-12-22 21:33 - 2014-11-05 08:05 - 00001971 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2015-12-22 21:33 - 2014-03-23 13:41 - 00002176 _____ C:\Users\Public\Desktop\Meine Tierklinik.lnk 2015-12-22 21:33 - 2013-11-01 18:55 - 00002045 _____ C:\Users\Public\Desktop\StarMoney 9.0.lnk 2015-12-22 21:33 - 2013-03-07 17:37 - 00001038 _____ C:\Users\Public\Desktop\PDFCreator.lnk 2015-12-22 21:33 - 2013-03-06 18:52 - 00002068 _____ C:\Users\Public\Desktop\Reader for PC.lnk 2015-12-22 21:33 - 2012-10-14 13:09 - 00001230 _____ C:\Users\Public\Desktop\Rossmann Fotowelt Software.lnk 2015-12-22 21:33 - 2012-07-09 17:21 - 00001957 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk 2015-12-22 21:33 - 2012-04-29 16:52 - 00001073 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-12-22 21:33 - 2012-03-18 13:00 - 00002044 _____ C:\Users\Public\Desktop\Microsoft LifeCam.lnk 2015-12-22 21:33 - 2012-03-14 18:01 - 00002693 _____ C:\Users\Public\Desktop\Skype.lnk 2015-12-22 21:33 - 2011-11-19 18:58 - 00000960 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00002227 _____ C:\Users\Public\Desktop\HP Officejet Pro 8500 A910.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00001890 _____ C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8500 A910.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00001227 _____ C:\Users\Public\Desktop\HP Officejet Pro 8500 A910 Scan.lnk 2015-12-22 21:33 - 2011-09-03 16:58 - 00001940 _____ C:\Users\Public\Desktop\Rainlendar2.lnk 2015-12-22 21:33 - 2011-09-03 16:12 - 00001216 _____ C:\Users\Public\Desktop\ElsterFormular.lnk 2015-12-22 21:33 - 2011-07-26 18:40 - 00002099 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk 2015-12-22 21:33 - 2011-05-22 17:38 - 00001142 _____ C:\Users\Public\Desktop\cyberJack Gerätemanager, Funktionstest.lnk 2015-12-22 21:33 - 2011-05-14 17:25 - 00001840 _____ C:\Users\Public\Desktop\ELSA-agrar.lnk 2015-12-22 21:33 - 2011-04-10 13:33 - 00001147 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-12-22 21:33 - 2011-04-10 13:33 - 00001141 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-12-22 21:33 - 2010-09-10 12:23 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk 2015-12-22 21:33 - 2010-09-10 12:23 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk 2015-12-22 21:33 - 2009-07-14 05:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk 2015-12-22 21:32 - 2014-06-17 21:52 - 00001049 _____ C:\Users\Martin Sudbrock\Desktop\Dropbox.lnk 2015-12-22 21:32 - 2013-08-02 12:56 - 00001161 _____ C:\Users\Martin Sudbrock\Desktop\Continue Zip Opener Installation.lnk 2015-12-22 21:32 - 2013-07-29 14:08 - 00001296 _____ C:\Users\Martin Sudbrock\Desktop\Landwirtschafts Simulator 2013.lnk 2015-12-22 21:32 - 2012-12-01 15:04 - 00001006 _____ C:\Users\Martin Sudbrock\Desktop\PDF Architect.lnk 2015-12-22 21:32 - 2012-11-16 18:35 - 00001081 _____ C:\Users\Martin Sudbrock\Desktop\phonostar-Player.lnk 2015-12-22 21:32 - 2012-03-15 19:20 - 00001142 _____ C:\Users\Martin Sudbrock\Desktop\Free Sound Recorder.lnk 2015-12-22 21:32 - 2012-02-12 20:33 - 00013017 _____ C:\Users\Martin Sudbrock\Desktop\Avira AntiVir Personal - Verknüpfung.lnk 2015-12-22 21:32 - 2011-08-14 11:55 - 00000640 _____ C:\Users\Martin Sudbrock\Desktop\Anno 1404 - Verknüpfung.lnk 2015-12-22 21:32 - 2011-05-02 10:43 - 00001908 _____ C:\Users\Martin Sudbrock\Desktop\Kamerabilder - Verknüpfung.lnk 2015-12-22 21:32 - 2011-04-21 16:35 - 00007271 _____ C:\Users\Martin Sudbrock\Desktop\Zählerstande_aktuell - Verknüpfung.lnk 2015-12-22 21:32 - 2011-02-05 17:13 - 00001434 _____ C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-12-22 21:32 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk 2015-12-22 21:32 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk 2015-12-22 21:27 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\addins 2015-12-22 19:32 - 2010-09-28 20:26 - 00699432 _____ C:\Windows\system32\perfh007.dat 2015-12-22 19:32 - 2010-09-28 20:26 - 00149572 _____ C:\Windows\system32\perfc007.dat 2015-12-22 19:32 - 2009-07-14 06:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI 2015-12-22 19:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2015-12-22 18:16 - 2012-07-31 18:32 - 00000000 ____D C:\Program Files (x86)\Electronic Arts 2015-12-22 18:05 - 2011-05-28 22:51 - 00000000 ____D C:\Tivola 2015-12-22 18:04 - 2015-11-22 19:07 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2015-12-22 18:04 - 2013-07-30 14:32 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\BabSolution 2015-12-22 18:04 - 2013-07-30 14:32 - 00000000 ____D C:\Program Files (x86)\Delta 2015-12-22 18:03 - 2012-03-15 19:21 - 00000000 ____D C:\Program Files (x86)\FreeSoundRecorder 2015-12-22 16:57 - 2014-03-23 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-12-21 22:03 - 2013-11-01 18:52 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0 2015-12-21 21:42 - 2011-02-05 17:11 - 00000000 ____D C:\Users\Martin Sudbrock 2015-12-21 20:05 - 2013-03-16 14:18 - 00121856 ___SH C:\Users\Martin Sudbrock\Documents\Thumbs.db 2015-12-21 19:39 - 2013-02-23 10:31 - 00000000 ____D C:\Program Files (x86)\Avira 2015-12-21 19:37 - 2015-07-06 08:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-12-21 19:35 - 2012-11-03 08:44 - 00000000 ____D C:\ProgramData\Avira 2015-12-21 19:34 - 2014-08-07 13:19 - 00000000 ____D C:\ProgramData\Package Cache 2015-12-21 09:06 - 2012-04-29 16:52 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\vlc 2015-12-20 19:58 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Landwirtschaft 2015-12-20 15:53 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Photovoltaik_Alfred 2015-12-20 15:45 - 2015-04-04 11:23 - 00000000 ____D C:\DigitaleAntragstellung2015 2015-12-19 20:01 - 2011-04-10 20:45 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\CrashDumps 2015-12-19 01:15 - 2014-01-29 22:30 - 01594028 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2015-12-19 01:13 - 2015-04-04 20:10 - 00000000 ___SD C:\Windows\SysWOW64\GWX 2015-12-19 01:13 - 2015-04-04 20:10 - 00000000 ___SD C:\Windows\system32\GWX 2015-12-17 16:33 - 2011-04-07 20:23 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Bewerbung Sophia 2015-12-16 22:21 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Trachtenkapelle Großentaft 2015-12-16 16:27 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\CDU-Ortsverband Großentaft 2015-12-16 08:05 - 2015-11-18 08:08 - 00000000 ____D C:\Program Files\McAfee Security Scan 2015-12-15 20:08 - 2013-02-18 14:41 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Josephine 2015-12-14 21:27 - 2015-08-07 10:14 - 00000298 ____H C:\Windows\Tasks\Microsoft_Hardware_Launch_IcePick_exe.job 2015-12-13 23:29 - 2012-03-14 18:01 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Skype 2015-12-09 15:26 - 2009-07-14 05:45 - 00413464 _____ C:\Windows\system32\FNTCACHE.DAT 2015-12-08 22:59 - 2011-04-09 20:10 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-12-08 22:58 - 2012-05-18 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-12-08 22:57 - 2012-05-18 18:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2015-12-08 22:57 - 2012-05-18 18:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2015-12-08 22:55 - 2013-08-14 21:23 - 00000000 ____D C:\Windows\system32\MRT 2015-12-08 22:45 - 2011-04-13 13:36 - 140158008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-12-06 11:25 - 2012-05-04 07:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-12-03 16:05 - 2012-03-14 18:01 - 00000000 ___RD C:\Program Files (x86)\Skype 2015-12-03 16:05 - 2012-03-14 18:01 - 00000000 ____D C:\ProgramData\Skype 2015-12-02 13:18 - 2011-04-09 17:50 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-12-02 08:29 - 2015-09-15 13:41 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0efb3d6202b56.job 2015-11-30 18:44 - 2012-03-12 17:17 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Michel 2015-11-29 11:04 - 2014-08-02 12:00 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Sparkasse 2015-11-28 18:46 - 2011-06-25 07:22 - 00003702 _____ C:\Windows\wininit.ini 2015-11-28 15:12 - 2015-11-22 19:07 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\GTA San Andreas User Files 2015-11-27 16:11 - 2011-02-05 17:11 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\VirtualStore 2015-11-26 20:40 - 2012-07-09 17:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Sports 2015-11-26 20:35 - 2012-07-09 17:23 - 00000000 ____D C:\Program Files (x86)\EA Sports 2015-11-25 18:28 - 2012-11-16 18:35 - 00000000 ____D C:\Program Files (x86)\phonostar-Player 2015-11-25 13:40 - 2014-03-31 09:42 - 00000000 ____D C:\ProgramData\Oracle 2015-11-25 12:34 - 2014-03-31 09:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-11-25 12:34 - 2012-03-09 08:47 - 00000000 ____D C:\Program Files (x86)\Java 2015-11-25 12:33 - 2014-03-31 09:41 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2015-11-24 15:29 - 2012-02-16 19:13 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\.minecraft 2015-11-23 08:17 - 2007-07-12 02:49 - 00000000 ____D C:\Windows\Panther 2015-11-23 08:09 - 2015-09-10 07:42 - 00000000 ___HD C:\$Windows.~BT ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-07-16 02:35 - 2015-07-16 02:35 - 6420480 _____ () C:\Program Files (x86)\GUTD7FE.tmp 2013-07-30 15:31 - 2013-09-05 14:19 - 0000077 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\WB.CFG 2013-07-30 15:31 - 2013-09-05 14:19 - 0000005 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\WBPU-TTL.DAT 2012-05-07 18:22 - 2012-05-07 18:22 - 0003584 _____ () C:\Users\Martin Sudbrock\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini Dateien, die verschoben oder gelöscht werden sollten: ==================== C:\Users\Public\AlexaNSISPlugin.852.dll Einige Dateien in TEMP: ==================== C:\Users\Martin Sudbrock\AppData\Local\Temp\AskSLib.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\AutoRunGUI.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\avgnt.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\drm_dialogs.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\drm_dyndata_7270006.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsdyf3x.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\eauninstall.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\Need for Speed Most Wanted_uninst.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl2E31.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl3330.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl5994.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl9C0F.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pylBD17.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pylD77A.tmp.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2013-09-02 15:55 ==================== Ende von FRST.txt ============================ |
|
23.12.2015, 21:38
| #4 |
| | Makrovirus in mail von "Berges Antriebstechnik"? zusätzlich noch wie gewünscht die addition.txt-Datei: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-12-2015
durchgeführt von Martin Sudbrock (2015-12-23 21:14:21)
Gestartet von C:\Users\Martin Sudbrock\Desktop\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2011-02-05 16:11:30)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1418818919-2476079493-1430080804-500 - Administrator - Disabled)
Gast (S-1-5-21-1418818919-2476079493-1430080804-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1418818919-2476079493-1430080804-1002 - Limited - Enabled)
Martin Sudbrock (S-1-5-21-1418818919-2476079493-1430080804-1000 - Administrator - Enabled) => C:\Users\Martin Sudbrock
UpdatusUser (S-1-5-21-1418818919-2476079493-1430080804-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.117 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.95 - WildTangent) Hidden
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.02.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.15.129 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{eac7da46-2097-4dd4-80a6-8b67cbb2b23f}) (Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG) Hidden
AVM ISDN CAPI Port (HKLM-x32\...\AVM ISDN CAPI Port) (Version: - )
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.9.10 - REINER SCT)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0314 - DT Soft Ltd)
Die Siedler II - Die nächste Generation (HKLM-x32\...\S2TNG) (Version: - )
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dropbox (HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
ELSA-Suite (HKLM-x32\...\{5AD7FA06-9EF6-4373-957E-B2EA165B2EAA}) (Version: 10.0 - IBYKUS Software GmbH & Co. KG)
ElsterFormular-Upgrade (HKLM-x32\...\ElsterFormular für Unternehmer 12.3.2.6814u) (Version: 16.2.17437 - Landesfinanzdirektion Thüringen)
eMachines Games (HKLM-x32\...\WildTangent emachines Master Uninstall) (Version: 1.0.2.5 - WildTangent)
eMachines Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)
eMachines Registration (HKLM-x32\...\eMachines Registration) (Version: 1.03.3003 - Acer Incorporated)
eMachines ScreenSaver (HKLM-x32\...\eMachines Screensaver) (Version: 1.1.0825.2010 - Acer Incorporated)
eMachines Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
FreeSoundRecorder Toolbar (HKLM-x32\...\FreeSoundRecorder Toolbar) (Version: 6.8.5.1 - FreeSoundRecorder) <==== ACHTUNG
FRITZ! (HKLM-x32\...\FRITZ! 2.0) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 2.05.3009 - Acer Incorporated)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (HKLM\...\{E0FE1E14-3A7A-4DB0-9FFA-0DD945AE84DB}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (HKLM-x32\...\{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Madagascar (HKLM-x32\...\InstallShield_{0FB261F3-6F16-43FD-A404-F377C169B937}) (Version: 1.00.0000 - Activision)
Madagascar (TM) (x32 Version: 1.00.0000 - Activision) Hidden
Mah Jong Quest (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Marketsplash Schnellzugriffe (HKLM-x32\...\{7A108EBC-C9DF-4E14-93A8-42CF316F1ECF}) (Version: 1.0.1.7 - Hewlett-Packard)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.266.3 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
minimal arts - Toolbar für amazon.de (HKLM-x32\...\{37D290AF-6602-4C22-9AF8-66CB7231C729}) (Version: 1.0.0 - minimal arts UG (haftungsbeschränkt))
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 38.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.4.0 (x86 de)) (Version: 38.4.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{0d106b0b-aa4a-453d-88d8-312b4046b4d1}) (Version: - Nero AG)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9793 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.61.39 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}) (Version: 9.10.0223 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.10.2.4863 - Electronic Arts, Inc.)
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
ProtectDisc Helper Driver 10 (HKLM-x32\...\ProtectDisc Driver 10) (Version: 10.0.0.3 - )
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
Reader for PC (HKLM-x32\...\{D279DFB7-97A3-439D-8BE9-95D8AFA68562}) (Version: 2.4.01.10241 - Sony Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6101 - Realtek Semiconductor Corp.)
Rossmann Fotowelt Software 4.12.1 (HKLM-x32\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Secret of the Magic Crystals (x32 Version: 2.2.0.97 - WildTangent) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.15 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.15.103 - Skype Technologies S.A.)
Spielkanäle (x32 Version: 3.1.0.10 - WildTangent, Inc.) Hidden
StarMoney (x32 Version: 2.0 - StarFinanz) Hidden
StarMoney (x32 Version: 3.0.0.124 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 7.0 (HKLM-x32\...\{31777559-E7A1-461D-A9A1-B98C5226F0D3}) (Version: 7.0 - Star Finanz GmbH)
StarMoney 8.0 S-Edition (HKLM-x32\...\{F94EB2F5-7D75-4D0D-8B3A-B13140B5E978}) (Version: 8.0 - Star Finanz GmbH)
StarMoney 9.0 (HKLM-x32\...\{982F7E88-DDDF-46E2-B8D6-74AB86362F32}) (Version: 9.0 - Star Finanz GmbH)
Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (HKLM\...\{D7B11BA7-15D3-4E84-8974-20258D4A1701}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
Ubuntu (HKLM-x32\...\Wubi) (Version: 12.04-rev272 - Ubuntu)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
VLC media player 2.0.1 (HKLM-x32\...\VLC media player) (Version: 2.0.1 - VideoLAN)
Welcome Center (HKLM-x32\...\eMachines Welcome Center) (Version: 1.02.3004 - Acer Incorporated)
WildTangent Games App (x32 Version: 4.0.11.9 - WildTangent) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinZip Driver Updater (HKLM\...\WinZip Driver Updater) (Version: 5.3.2.54 - VAPC (Lux) S.a.r.L)
Yahoo Search Set (HKLM-x32\...\Yahoo! SearchSet) (Version: - Yahoo Inc.)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
08-12-2015 22:42:25 Windows Update
15-12-2015 14:02:09 Windows Update
17-12-2015 17:35:06 DirectX wurde installiert
19-12-2015 01:13:01 Windows Update
22-12-2015 18:06:23 Lauras Tierklinik wird entfernt
22-12-2015 18:09:55 Removed Need for Speed(TM) Hot Pursuit
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 03:34 - 2015-12-16 08:05 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0CE02750-DB6D-49CB-A0A6-0E76B5EB1281} - System32\Tasks\{6FD87C20-28D1-4D30-9625-3E509A4F460B} => pcalua.exe -a D:\WINPORT\CAPIPORT.W98\Setup.exe -d D:\WINPORT\CAPIPORT.W98
Task: {1008115E-E228-4F39-98FC-EFE17C1DC80F} - \DigitalSite -> Keine Datei <==== ACHTUNG
Task: {1AE5A96D-79E8-4928-9AF0-159D3433C141} - System32\Tasks\{0D3BA2E3-2451-429F-9D48-9E859DD9535F} => Iexplore.exe hxxp://ui.skype.com/ui/0/4.1.0.179.369/de/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
Task: {327210B9-1643-476A-AD12-42E339925E29} - System32\Tasks\{804D6923-B4D4-4161-A92E-00915238FC4C} => pcalua.exe -a "C:\Users\Martin Sudbrock\AppData\Local\Temp\Temp1_Fendt_300Vario_1280.zip\Fendt_300Vario_1280.exe"
Task: {3C12560D-A745-4F4A-8F58-1BA50EC9AB30} - \DealPly -> Keine Datei <==== ACHTUNG
Task: {4714A1B3-DF4D-40C2-8F67-D00BCD2005FB} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {56CF5C37-32B1-4D29-AF7F-3A9724CA5A1B} - System32\Tasks\{FD60EF79-67B5-4A0B-A4B0-07EC6033D438} => pcalua.exe -a "C:\Users\Martin Sudbrock\AppData\Local\Temp\Temp1_Black_Beauty_Screensaver.zip\Black_Beauty_Screensaver.exe"
Task: {5F4C5A0D-8344-4FE9-9552-7DD06F4BE1E5} - System32\Tasks\{43BA10D0-9901-4A9B-B718-06268C855DB5} => pcalua.exe -a D:\autorun.exe -d D:\
Task: {6D6A4307-307D-42D4-A5D2-5452003B16FA} - System32\Tasks\{D84A1803-73B1-43EB-B491-19DA0CD30C4C} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=4.1.0.179.369&LastError=404
Task: {70AA49E9-EB76-4A2A-AD0B-399F44776F28} - System32\Tasks\{94770038-F4A2-459E-8124-85D38055BD39} => pcalua.exe -a C:\Tivola\Lillifee2\setup.exe -d D:
Task: {81B519DC-C5C8-43C3-A9DD-2123EF1F460E} - \EPUpdater -> Keine Datei <==== ACHTUNG
Task: {AAEC0B80-5AEF-489A-962C-9EF9A242C3EF} - \DealPlyUpdate -> Keine Datei <==== ACHTUNG
Task: {AFEBBF9E-F4DD-4AF1-9FA6-4B2FF6FABF98} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-08] (Adobe Systems Incorporated)
Task: {B8E6C28F-B868-478D-BA7B-1EC8A8AB5C6C} - System32\Tasks\{404F0ECF-F736-4F46-AAD4-BA3B329490D5} => pcalua.exe -a "C:\Users\Martin Sudbrock\Documents\Downloads\rescue2usb.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {BB3C31B6-6C6E-49BD-86D8-1F878D76C7B4} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ACHTUNG
Task: {E3F9477C-7A42-4935-BD3E-98EEA3D517DF} - System32\Tasks\QtraxPlayer => 945421242.portal.qtrax.com
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Acrobat Update Task.job => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1418818919-2476079493-1430080804-1000Core1d0c21a25a75a3c.job => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8ab695139e13.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfe9eb531c6b9e.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfffd4879e665b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d03ff56b5e0de0.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d08f99e3bd4e3c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0bfc04b095aff.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e15b9fba2c4b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0efb3d6202b56.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12cd32399d857.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Microsoft_Hardware_Launch_IcePick_exe.job => C:\Program Files (x86)\Microsoft LifeCam\IcePick.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater for MartinSudbrock@Martin Sudbrock(logon).job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater Schedule.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater Update.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock at logon.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe-runExecutable SRTray.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe-runExecutable SRTray.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2012-11-18 22:28 - 2013-01-18 16:00 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-20 16:22 - 2015-01-20 16:22 - 00675840 _____ () C:\Windows\Installer\MSI2D4A.tmp
2011-08-12 06:45 - 2011-08-12 06:45 - 02433024 _____ () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
2012-11-16 18:35 - 2015-10-15 15:21 - 00043008 _____ () C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
2010-08-04 13:40 - 2010-08-04 13:40 - 00611872 _____ () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe
2015-12-23 21:07 - 2015-12-09 16:32 - 20354560 _____ () C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
2011-05-22 17:38 - 2007-05-31 06:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2011-11-10 19:31 - 2009-10-06 13:36 - 00205312 _____ () C:\Program Files (x86)\StarMoney 7.0\ouservice\PATCHW32.dll
2013-02-07 18:19 - 2011-01-13 09:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\PATCHW32.dll
2014-07-30 12:48 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2010-05-23 19:20 - 2010-05-23 19:20 - 00126976 _____ () C:\Program Files (x86)\Rainlendar2\lua51.dll
2011-08-12 06:45 - 2011-08-12 06:45 - 00198144 _____ () C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll
2010-05-23 19:20 - 2010-05-23 19:20 - 00012288 _____ () C:\Program Files (x86)\Rainlendar2\lfs.dll
2015-12-11 21:17 - 2015-10-31 01:59 - 00034768 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00022848 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Random.OSRNG.winrandom.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00023352 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Util._counter.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00042296 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Cipher._AES.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00116688 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-11 21:17 - 2015-10-31 01:59 - 00093640 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00018376 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00019760 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00105928 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32api.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00392144 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-11 21:17 - 2015-12-08 22:36 - 00381752 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00692688 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020816 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00109520 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 01737032 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020808 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020800 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_python_x66cf7a7cx17a72769.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021840 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00038696 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\fastpath.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00024528 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00020936 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00114640 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021320 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00124880 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32file.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00030160 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00043472 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00175560 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00028616 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32ts.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00048592 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32service.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00024392 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00036296 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\librsync.dll
2015-12-11 21:17 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32profile.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00117056 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00023376 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00134608 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00134088 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00240584 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020280 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00052024 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021304 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Util.strxor.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00350152 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00084792 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2015-12-11 21:17 - 2015-12-08 22:36 - 01826608 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00083912 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\sip.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 03891504 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 01950000 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00519984 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00133936 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00225080 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00207672 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00024904 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00486704 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00357680 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-03-04 22:45 - 2015-10-31 02:01 - 00019920 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00786904 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 11:47 - 2015-10-31 02:00 - 00063448 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2010-08-04 10:47 - 2010-08-04 10:47 - 00144896 _____ () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyHook.dll
2014-10-24 21:34 - 2014-10-24 21:34 - 00880640 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\fsk.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00040264 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00239944 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\Fskin.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00026952 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2014-04-25 21:46 - 2014-04-25 21:46 - 00798720 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00125256 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00016200 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskPower.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00024904 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00017224 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00015176 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00034632 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ticket.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00018760 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00092488 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00149832 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00178504 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\USBDetector.dll
2015-12-17 07:48 - 2015-12-11 04:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-17 07:48 - 2015-12-11 04:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{DE107992-F302-4891-B71F-C308FC9E1079}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{267C2801-50A1-4F35-A180-55488BBA95EA}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1CDFF5E1-0664-4322-81FE-F9D94D53990A}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\app\StarMoney.exe
FirewallRules: [{A8EB0599-26F1-4DA7-847A-4EAA305A3980}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\app\StarMoney.exe
FirewallRules: [TCP Query User{E033FD6B-D66F-4963-A1FE-36438F47A9E0}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe] => (Block) C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe
FirewallRules: [UDP Query User{6AAA94D8-9504-4F40-A3BA-6655995F06F3}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe] => (Block) C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe
FirewallRules: [{4D25E564-2466-46B4-A5C7-1EC605B0887A}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{D91CA12A-330E-45B4-972E-1FFEB153E902}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{B85E700A-FD0B-4009-8829-BC4824F738B9}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\app\StarMoney.exe
FirewallRules: [{D7A3CC9E-776B-48A7-9ECB-E5366B8044EF}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\app\StarMoney.exe
FirewallRules: [{F7A05EE7-189E-41F7-99CD-C0CBCF6E142E}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\Anno4.exe
FirewallRules: [{07DDA04D-C180-42D8-95F2-905FC6CF6CDE}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\Anno4.exe
FirewallRules: [{2E4E1259-2C85-49F1-A429-983B43FC6045}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe
FirewallRules: [{49C9A1B3-F9CF-49C3-946A-DA4D1AE44916}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe
FirewallRules: [{E55E0F43-11B1-4B97-98D4-D0439A95F275}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe
FirewallRules: [{79C10299-F2E6-4230-9B50-B17BC0D0DCB8}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe
FirewallRules: [{F4CA6433-EBB0-40B3-963A-99275FA5EE81}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe
FirewallRules: [{AD544139-16EC-4A2F-B4AE-68BF34BCB5DD}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe
FirewallRules: [TCP Query User{70A6B330-F05F-4797-94B0-3EF879F8DE69}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Block) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe
FirewallRules: [UDP Query User{FE6D2BD2-5E73-449E-81FC-4607C49CF4B6}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Block) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe
FirewallRules: [{A0BB04EA-EA61-4CD3-8EDC-AC352CEB04B5}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{B75746B7-0408-4379-A477-0AEBACFBA1E5}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{30E44D41-4302-4A8B-A0F0-D544612BC7D7}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{A9DF5F13-2632-4218-A37E-D788C46D5302}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{973C73B0-4D17-44E8-86CD-FA28021F18F6}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{9DD1171C-37AC-478D-B913-A39647CA9EBA}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{9F9466C0-D7E9-4B8E-8132-326874E1A80A}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{E9B26C3F-F8A9-4E35-A635-0254806493CB}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{C52A35AC-DEE8-49FE-A465-1AC7913A50E3}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [TCP Query User{EBEA0B78-E8E9-467E-AA80-2F2C813DB43B}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{BCC78221-4057-4C34-A401-9CB9D232EB5C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{3CA882F2-06E4-46FC-8A70-C4503D7908C1}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{E12B600B-A8D6-46B2-AB6B-8FB15D3417C5}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{C9223E5D-1E65-4525-95EE-3302924F2496}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Allow) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [UDP Query User{E4153112-9F05-4936-9FBA-91C171761882}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Allow) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [TCP Query User{6922D609-3884-4550-9813-DA48F03DA7D7}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Block) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [UDP Query User{E9C404A8-4E08-4003-B2D3-5F32B1792F10}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Block) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [{4EE53FFC-C748-4FBA-9BFA-403CF154D57A}] => (Allow) C:\Program Files (x86)\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe
FirewallRules: [{A71A495D-29F5-457A-A8B7-9C2AB3D3EAA8}] => (Allow) C:\Program Files (x86)\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe
FirewallRules: [TCP Query User{21BCAF4E-EFDB-4E33-9696-1FD7BB629DA9}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{9753DB88-8A97-43A3-A1B0-EC3CE0BB46BD}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{0780D13F-4F87-4A46-A43B-944193852643}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{AA9F5BB0-AB7A-4165-9559-3B4F35797459}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{C9116AE2-25EE-41B5-8FA6-BDB6B0C5460C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{0BA837AF-FA85-453F-B32F-B87C199B0180}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{5260A5B8-838A-4351-8220-FC04C35D504A}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe
FirewallRules: [{0B52A01C-A471-4EE8-BCDC-E55B0A2475AD}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe
FirewallRules: [{E7D96B2D-AB8F-4A45-A87F-6B01E5337E72}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe
FirewallRules: [{23B725D5-8E9B-4301-8C6F-E4B948470767}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe
FirewallRules: [TCP Query User{F31C2034-70C4-4D88-B53B-B32172CA2243}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{806A698B-BDD2-4C5C-92C4-5E0F63ACABA6}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{9C01397E-8F41-48D8-8715-1370EFC6139A}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{65E8BCBC-C47F-4B1A-83DA-1167140FCEC6}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{ED1A510E-63B3-46D4-9587-EFABA9E086D3}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{3C37365D-1A53-497C-B8E9-F7AE265BA206}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{246C558F-F294-4E61-8505-1F7279B96026}] => (Allow) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{516C893B-E8E8-44CB-B650-A199E85618A7}] => (Allow) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9500ABC5-DCEA-4BEE-9148-1616F58BE819}C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{DF030DE1-4C46-4EA3-A0D3-4930AB588CFE}C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{DA4F56D6-5743-4F71-BBB5-ECA7371F9C3E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{354F183C-0F8D-432D-8549-22A3AE79FB47}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{D89421EC-5F41-405E-B11C-B75ED4D183C0}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{2BD9D150-6CFC-483B-9AB4-335E4738F004}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{2F0076DD-60AB-44D6-9426-74FDD3194817}] => (Allow) D:\fsetup.exe
FirewallRules: [{7FAFE1BD-BA61-43CE-8960-CA45194CAB32}] => (Allow) D:\fsetup.exe
FirewallRules: [TCP Query User{534B8A1C-AECB-4ECE-A50E-D885F5B67050}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{B6230257-EBCE-4DB7-8AC9-19188272CAF7}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{DC10FFAB-5B5E-4CFA-8AFD-77EF0A811AE1}E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe] => (Block) E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{45CD4ACC-4398-4D47-8F93-7DCE0FC5CAF3}E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe] => (Block) E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe
FirewallRules: [TCP Query User{94CD5501-6031-45C7-8D46-F5F8D6344C38}E:\florian\spiele\world of tanks\worldoftanks.exe] => (Block) E:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [UDP Query User{E7CEFF36-8246-4CC8-B80F-EDE1C58E4F30}E:\florian\spiele\world of tanks\worldoftanks.exe] => (Block) E:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [TCP Query User{1EF7FA65-A312-42FB-A5EA-5BF2D72EB5E0}M:\florian\spiele\world of tanks\worldoftanks.exe] => (Allow) M:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [UDP Query User{97A9EB05-B817-4929-8CF3-587B93922B9B}M:\florian\spiele\world of tanks\worldoftanks.exe] => (Allow) M:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [{98DBE797-7714-449A-92F0-40108F0DAA37}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{F3CCF7F0-4F7E-4B47-8825-7741CBB6C2F4}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{7182A828-B155-4087-AE94-4753964411EF}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{D639FC5E-B046-448D-B6A8-06DED4A6A18E}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{83ED619C-925C-4CC8-B459-3961F49BE7D0}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (12/23/2015 02:21:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 14.0.7164.5001, Zeitstempel: 0x564cb687
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56258e62
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003d968
ID des fehlerhaften Prozesses: 0x384
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3
Error: (12/22/2015 06:01:08 PM) (Source: VSS) (EventID: 12298) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (12/22/2015 06:01:08 PM) (Source: VSS) (EventID: 12310) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{ffab797e-d755-11df-acfe-806e6f6e6963} - 0000000000000130,0x0053c010,000000000021E560,0,00000000003BFFD0,4096,[0]).
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (12/21/2015 07:39:15 PM) (Source: MsiInstaller) (EventID: 11722) (User: NT-AUTORITÄT)
Description: Product: Avira Browser Safety -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action CreateScheduledTask, location: C:\, command: "C:\Windows\SysWOW64\SCHTASKS.EXE" /CREATE /SC HOURLY /MO 6 /TN "Avira Browser Safety Updater Task" /TR "'C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe'" /RU "NT Authority\System" /RP /RL HIGHEST
Error: (12/19/2015 08:00:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Name des fehlerhaften Moduls: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00346979
ID des fehlerhaften Prozesses: 0x1174
Startzeit der fehlerhaften Anwendung: 0xgta_sa.exe0
Pfad der fehlerhaften Anwendung: gta_sa.exe1
Pfad des fehlerhaften Moduls: gta_sa.exe2
Berichtskennung: gta_sa.exe3
Error: (12/19/2015 08:00:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: HotkeyUtility.exe, Version: 2.5.3009.0, Zeitstempel: 0x4c595f20
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56258e62
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032e65
ID des fehlerhaften Prozesses: 0xa74
Startzeit der fehlerhaften Anwendung: 0xHotkeyUtility.exe0
Pfad der fehlerhaften Anwendung: HotkeyUtility.exe1
Pfad des fehlerhaften Moduls: HotkeyUtility.exe2
Berichtskennung: HotkeyUtility.exe3
Error: (12/17/2015 02:29:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Name des fehlerhaften Moduls: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003f0618
ID des fehlerhaften Prozesses: 0x63c
Startzeit der fehlerhaften Anwendung: 0xgta_sa.exe0
Pfad der fehlerhaften Anwendung: gta_sa.exe1
Pfad des fehlerhaften Moduls: gta_sa.exe2
Berichtskennung: gta_sa.exe3
Error: (12/14/2015 09:27:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MSCamS64.exe, Version: 3.22.270.0, Zeitstempel: 0x4bf46f0c
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56259271
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000000b3dd
ID des fehlerhaften Prozesses: 0x448
Startzeit der fehlerhaften Anwendung: 0xMSCamS64.exe0
Pfad der fehlerhaften Anwendung: MSCamS64.exe1
Pfad des fehlerhaften Moduls: MSCamS64.exe2
Berichtskennung: MSCamS64.exe3
Error: (12/14/2015 07:40:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.49.18939, Zeitstempel: 0x561e029a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56258f05
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0xa44
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Error: (12/14/2015 07:40:27 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.InvalidOperationException
Stapel:
bei System.ThrowHelper.ThrowInvalidOperationException(System.ExceptionResource)
bei System.Collections.Generic.Dictionary`2+ValueCollection+Enumerator[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].MoveNext()
bei Avira.OE.ServiceHost.ServiceStatusProviderContainer.GetDeviceStatus()
bei Avira.OE.ServiceHost.ComputerAndServicesInfoFactory.CreateComputerAndServicesInfo()
bei Avira.OE.ServiceHost.AnonymousUserDeviceStatusConnector.UpdateCurrentComputerAndServiceInfo()
bei Avira.OE.ServiceHost.AnonymousUserDeviceStatusConnector.SendAnonymousSyncStatus()
bei Avira.OE.ServiceHost.AnonymousUserDeviceStatusConnector.AnonymousSyncStatusNeeded(System.Object, System.EventArgs)
bei Avira.OE.WinCore.EventHandlerExtensions.SafeInvoke[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.EventHandler`1<System.__Canon>, System.Object, System.__Canon)
bei Avira.OE.Communicator.Communicator.CheckAndRequestAnonymousSyncStatus()
bei Avira.OE.Communicator.Communicator.CreateAndSendDeviceUpdateDataMessage(System.String)
bei Avira.OE.Communicator.Communicator.SessionChanged(Avira.OE.WinCore.Interface.Session, Avira.OE.WinCore.Interface.Session)
bei Avira.OE.Communicator.Communicator.OnActiveSessionChanged(System.Object, Avira.OE.WinCore.Interface.ActiveSessionChangedEventArgs)
bei Avira.OE.WinCore.EventHandlerExtensions.SafeInvoke[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.EventHandler`1<System.__Canon>, System.Object, System.__Canon)
bei Avira.OE.ServiceHost.SessionManager.FireActiveSessionChangeAndSetActiveSession(Avira.OE.WinCore.Interface.Session)
bei Avira.OE.ServiceHost.SessionManager.Initialize()
bei Avira.OE.ServiceHost.ServiceHost.Initialize()
bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Systemfehler:
=============
Error: (12/23/2015 10:55:51 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (12/23/2015 10:55:51 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (12/23/2015 10:53:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/23/2015 10:52:14 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (12/22/2015 10:53:24 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/22/2015 10:51:07 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/22/2015 10:47:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (12/22/2015 10:47:58 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (12/22/2015 10:47:24 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/22/2015 10:47:10 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
==================== Speicherinformationen ===========================
Prozessor: Pentium(R) Dual-Core CPU E5700 @ 3.00GHz
Prozentuale Nutzung des RAM: 56%
Installierter physikalischer RAM: 3071.24 MB
Verfügbarer physikalischer RAM: 1329.34 MB
Summe virtueller Speicher: 6140.69 MB
Verfügbarer virtueller Speicher: 3349.98 MB
==================== Laufwerke ================================
Drive c: (eMachines) (Fixed) (Total:453.66 GB) (Free:274.6 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 572EBBD4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453.7 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
Martin |
|
24.12.2015, 19:15
| #5 |
| /// TB-Ausbilder /// Anleitungs-Guru | Makrovirus in mail von "Berges Antriebstechnik"? Frohe Weihnachten!  Schritt 1 Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ Gruß deeprybka  Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
25.12.2015, 09:40
| #6 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo, auch von mir Dir und Deinem ganzen Team frohe Weihnachten. Anbei der logfile des TDSSKiller. Es sind anscheinend keine infizierten Objekte gefunden worden: Code:
ATTFilter 09:09:14.0197 0x16c0 TDSS rootkit removing tool 3.1.0.9 Dec 11 2015 22:49:12
09:09:26.0648 0x16c0 ============================================================
09:09:26.0648 0x16c0 Current date / time: 2015/12/25 09:09:26.0648
09:09:26.0648 0x16c0 SystemInfo:
09:09:26.0648 0x16c0
09:09:26.0648 0x16c0 OS Version: 6.1.7601 ServicePack: 1.0
09:09:26.0648 0x16c0 Product type: Workstation
09:09:26.0648 0x16c0 ComputerName: MARTINSUDBROCK
09:09:26.0648 0x16c0 UserName: Martin Sudbrock
09:09:26.0648 0x16c0 Windows directory: C:\Windows
09:09:26.0648 0x16c0 System windows directory: C:\Windows
09:09:26.0648 0x16c0 Running under WOW64
09:09:26.0648 0x16c0 Processor architecture: Intel x64
09:09:26.0648 0x16c0 Number of processors: 2
09:09:26.0648 0x16c0 Page size: 0x1000
09:09:26.0648 0x16c0 Boot type: Normal boot
09:09:26.0648 0x16c0 ============================================================
09:09:28.0046 0x16c0 KLMD registered as C:\Windows\system32\drivers\40731091.sys
09:09:28.0748 0x16c0 System UUID: {6A22EBF1-55EA-A6CC-E5F3-88D094F07A09}
09:09:30.0260 0x16c0 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:09:30.0307 0x16c0 ============================================================
09:09:30.0307 0x16c0 \Device\Harddisk0\DR0:
09:09:30.0307 0x16c0 MBR partitions:
09:09:30.0307 0x16c0 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1800800, BlocksNum 0x32000
09:09:30.0307 0x16c0 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1832800, BlocksNum 0x38B53030
09:09:30.0307 0x16c0 ============================================================
09:09:30.0338 0x16c0 C: <-> \Device\Harddisk0\DR0\Partition2
09:09:30.0338 0x16c0 ============================================================
09:09:30.0338 0x16c0 Initialize success
09:09:30.0338 0x16c0 ============================================================
09:33:46.0586 0x1414 ============================================================
09:33:46.0586 0x1414 Scan started
09:33:46.0586 0x1414 Mode: Manual; SigCheck; TDLFS;
09:33:46.0586 0x1414 ============================================================
09:33:46.0586 0x1414 KSN ping started
09:33:49.0382 0x1414 KSN ping finished: true
09:33:51.0614 0x1414 ================ Scan system memory ========================
09:33:51.0614 0x1414 System memory - ok
09:33:51.0614 0x1414 ================ Scan services =============================
09:33:51.0738 0x1414 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
09:33:51.0910 0x1414 1394ohci - ok
09:33:51.0988 0x1414 [ 156BC3F91DCF43510C28E75CC5CEE3C7, 2594A26281B5E167C212549D5C4FABBB2A9A75DFCB9A2526159E035F3B89C678 ] acedrv10 C:\Windows\system32\drivers\acedrv10.sys
09:33:52.0066 0x1414 acedrv10 - ok
09:33:52.0082 0x1414 [ 1AFE4120F70962B4A773008557F660CD, 1DB220FBECFA39EF084CD6AA3C2BFA1D4E189F807E1FD7AA4416C0DB924F98F9 ] acehlp10 C:\Windows\system32\drivers\acehlp10.sys
09:33:52.0113 0x1414 acehlp10 - ok
09:33:52.0128 0x1414 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
09:33:52.0144 0x1414 ACPI - ok
09:33:52.0175 0x1414 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
09:33:52.0269 0x1414 AcpiPmi - ok
09:33:52.0394 0x1414 [ 5DB2C6B908C50767E2EDAA294A7566B5, 13AE4879D679BB0C6B2A5A5B13910359815A9D2E569BC1DE740B5A387A78CF33 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
09:33:52.0409 0x1414 AdobeARMservice - ok
09:33:52.0518 0x1414 [ A283108E14F3970432C21AF4C0CB1BCE, 1D3219EF916D54232838870EDE557296AACB714B456ED0AAE0DE3CE3822F4643 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
09:33:52.0581 0x1414 AdobeFlashPlayerUpdateSvc - ok
09:33:52.0612 0x1414 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
09:33:52.0674 0x1414 adp94xx - ok
09:33:52.0674 0x1414 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
09:33:52.0706 0x1414 adpahci - ok
09:33:52.0737 0x1414 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
09:33:52.0752 0x1414 adpu320 - ok
09:33:52.0784 0x1414 [ 262D7C87D0AC20B96EF9877D3CA478A0, 54F7E5A5F8991C5525500C1ECCF3D3135D13F48866C366E52DF1D052DB2EE15B ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
09:33:52.0846 0x1414 AeLookupSvc - ok
09:33:52.0924 0x1414 [ 9A4A1EEE802BF2F878EE8EAB407B21B7, 177EB7DF4B35FE4C0E45E775A0FD5D48D39B410052E3EE18BDEEC809E152D9D8 ] AFD C:\Windows\system32\drivers\afd.sys
09:33:53.0018 0x1414 AFD - ok
09:33:53.0064 0x1414 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
09:33:53.0080 0x1414 agp440 - ok
09:33:53.0111 0x1414 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
09:33:53.0142 0x1414 ALG - ok
09:33:53.0174 0x1414 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
09:33:53.0220 0x1414 aliide - ok
09:33:53.0220 0x1414 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
09:33:53.0236 0x1414 amdide - ok
09:33:53.0267 0x1414 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
09:33:53.0345 0x1414 AmdK8 - ok
09:33:53.0361 0x1414 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
09:33:53.0408 0x1414 AmdPPM - ok
09:33:53.0439 0x1414 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
09:33:53.0454 0x1414 amdsata - ok
09:33:53.0470 0x1414 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
09:33:53.0501 0x1414 amdsbs - ok
09:33:53.0517 0x1414 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
09:33:53.0532 0x1414 amdxata - ok
09:33:53.0751 0x1414 [ 81E02299B534F61E104C1235519C37B3, B389458C13A0E0717365B7CE371A6B768EB2F98C4CDBAA6DCBBBDE3A2B1D8B14 ] AntiVirMailService C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
09:33:53.0813 0x1414 AntiVirMailService - ok
09:33:53.0907 0x1414 [ 3CBE5047BB08BD363420D68364F9E829, 7A6C59E9B98C1A50CB5FB895050127C5A433BA825D3832FC6DDA2A41AE986543 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\Antivirus\sched.exe
09:33:53.0938 0x1414 AntiVirSchedulerService - ok
09:33:53.0985 0x1414 [ 3CBE5047BB08BD363420D68364F9E829, 7A6C59E9B98C1A50CB5FB895050127C5A433BA825D3832FC6DDA2A41AE986543 ] AntiVirService C:\Program Files (x86)\Avira\Antivirus\avguard.exe
09:33:54.0000 0x1414 AntiVirService - ok
09:33:54.0047 0x1414 AntiVirWebService - ok
09:33:54.0078 0x1414 [ 27DABFB4A6B0140C34DBEC713469592B, A355170D353AFBF0DE4EF53282F8404788FBBD0E2A1B7282B1B2925923E83141 ] AppID C:\Windows\system32\drivers\appid.sys
09:33:54.0141 0x1414 AppID - ok
09:33:54.0156 0x1414 [ ABC373B9C6275D45F17DB559408FFD1B, 12B355393BEBE2D1D24D7A9DA5E69E03E334899407503BC1CADCF7BE39828223 ] AppIDSvc C:\Windows\System32\appidsvc.dll
09:33:54.0219 0x1414 AppIDSvc - ok
09:33:54.0250 0x1414 [ 3EA5DA3F459F6ED19E10166965F6892F, F5618A5FA72C5E57BCFA6F2ECB840B1AEC60C72840AF3C1D94D5FCDB5ED2BF5E ] Appinfo C:\Windows\System32\appinfo.dll
09:33:54.0297 0x1414 Appinfo - ok
09:33:54.0328 0x1414 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
09:33:54.0375 0x1414 arc - ok
09:33:54.0390 0x1414 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
09:33:54.0406 0x1414 arcsas - ok
09:33:54.0546 0x1414 [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
09:33:54.0640 0x1414 aspnet_state - ok
09:33:54.0656 0x1414 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
09:33:54.0796 0x1414 AsyncMac - ok
09:33:54.0827 0x1414 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
09:33:54.0843 0x1414 atapi - ok
09:33:54.0874 0x1414 [ FC0E8778C000291CAF60EB88C011E931, 09BCCA3DE01021AEF76DFB46F01D21BA6FF409E816FA7547E5C3DFBF3A615ED2 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
09:33:54.0905 0x1414 atksgt - ok
09:33:54.0968 0x1414 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
09:33:55.0061 0x1414 AudioEndpointBuilder - ok
09:33:55.0077 0x1414 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv C:\Windows\System32\Audiosrv.dll
09:33:55.0108 0x1414 AudioSrv - ok
09:33:55.0170 0x1414 [ 29E019B4607E410BFE4DB778C3300BC5, 32D1A5A5836152BAAA168B4A06AC6F52DBC19150D339B5F87E8E3A1E1EE580C3 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
09:33:55.0186 0x1414 avgntflt - ok
09:33:55.0217 0x1414 [ 1AD2C8F543F261F0AB90AD80767AB21D, 364DA0D0B8A91688CE39FEDF68EB93260819849097444F6A10A3F95CC32F9EA5 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
09:33:55.0233 0x1414 avipbb - ok
09:33:55.0342 0x1414 [ BB73DD7B20132FB1A30990E025DEA1E4, 6A474ABB8B2D696ECBC50D717AF11E8F77DA65DEDA4B663E4496B89F624847DE ] Avira.ServiceHost C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
09:33:55.0420 0x1414 Avira.ServiceHost - ok
09:33:55.0436 0x1414 [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
09:33:55.0451 0x1414 avkmgr - ok
09:33:55.0467 0x1414 AVMPORT - ok
09:33:55.0529 0x1414 [ 99672CCD11058D6E2F627473B773F971, 4EF2BCDA4678F9ECE499F216AC0F8105F37D2AB0320064741A8DFB5C39E5048C ] avnetflt C:\Windows\system32\DRIVERS\avnetflt.sys
09:33:55.0560 0x1414 avnetflt - ok
09:33:55.0623 0x1414 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
09:33:55.0716 0x1414 AxInstSV - ok
09:33:55.0794 0x1414 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
09:33:55.0888 0x1414 b06bdrv - ok
09:33:55.0919 0x1414 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
09:33:55.0982 0x1414 b57nd60a - ok
09:33:56.0013 0x1414 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
09:33:56.0044 0x1414 BDESVC - ok
09:33:56.0060 0x1414 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
09:33:56.0138 0x1414 Beep - ok
09:33:56.0231 0x1414 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
09:33:56.0294 0x1414 BFE - ok
09:33:56.0340 0x1414 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
09:33:56.0512 0x1414 BITS - ok
09:33:56.0543 0x1414 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
09:33:56.0574 0x1414 blbdrive - ok
09:33:56.0606 0x1414 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
09:33:56.0637 0x1414 bowser - ok
09:33:56.0652 0x1414 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:33:56.0730 0x1414 BrFiltLo - ok
09:33:56.0746 0x1414 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:33:56.0762 0x1414 BrFiltUp - ok
09:33:56.0777 0x1414 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
09:33:56.0793 0x102c Object required for P2P: [ 81E02299B534F61E104C1235519C37B3 ] AntiVirMailService
09:33:56.0840 0x1414 Browser - ok
09:33:56.0855 0x1414 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
09:33:56.0918 0x1414 Brserid - ok
09:33:56.0933 0x1414 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
09:33:56.0980 0x1414 BrSerWdm - ok
09:33:56.0980 0x1414 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
09:33:57.0027 0x1414 BrUsbMdm - ok
09:33:57.0027 0x1414 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
09:33:57.0042 0x1414 BrUsbSer - ok
09:33:57.0058 0x1414 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
09:33:57.0074 0x1414 BTHMODEM - ok
09:33:57.0120 0x1414 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
09:33:57.0152 0x1414 bthserv - ok
09:33:57.0308 0x1414 [ 68BD23A0AD9E934F037A1D8A1929D1E2, 7104B04435930D085D01779065C8F293A265800D90C9DEFB19C998D9326E44E7 ] c2cautoupdatesvc C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
09:33:57.0354 0x1414 c2cautoupdatesvc - ok
09:33:57.0510 0x1414 [ 13297729C696656F990A5DBA53023129, EB2B34B04B79756199DBBBDE99ACBB576D20C7C0AF3E4F3C0CF0040948216AAC ] c2cpnrsvc C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
09:33:57.0588 0x1414 c2cpnrsvc - ok
09:33:57.0604 0x1414 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
09:33:57.0669 0x1414 cdfs - ok
09:33:57.0701 0x1414 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
09:33:57.0732 0x1414 cdrom - ok
09:33:57.0781 0x1414 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
09:33:57.0816 0x1414 CertPropSvc - ok
09:33:57.0839 0x1414 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
09:33:57.0883 0x1414 circlass - ok
09:33:57.0967 0x1414 [ BDF4915D53BDEF80738A30AC3F7CDC76, 766269A5EB662644F9C0376A999D96DD32890427A32CAF983F83179D55B54251 ] cjpcsc C:\Windows\SysWOW64\cjpcsc.exe
09:33:58.0022 0x1414 cjpcsc - ok
09:33:58.0060 0x1414 [ B0218E3212F4F691B5117D0EA15B1EB9, FD2BE8698F40B7C0F69080579769B30C9EAEAE1960B9A07CF0166850094AE97B ] cjusb C:\Windows\system32\DRIVERS\cjusb.sys
09:33:58.0079 0x1414 cjusb - ok
09:33:58.0115 0x1414 [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS C:\Windows\system32\CLFS.sys
09:33:58.0135 0x1414 CLFS - ok
09:33:58.0195 0x1414 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:33:58.0226 0x1414 clr_optimization_v2.0.50727_32 - ok
09:33:58.0257 0x1414 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
09:33:58.0288 0x1414 clr_optimization_v2.0.50727_64 - ok
09:33:58.0366 0x1414 [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:33:58.0491 0x1414 clr_optimization_v4.0.30319_32 - ok
09:33:58.0569 0x1414 [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
09:33:58.0616 0x1414 clr_optimization_v4.0.30319_64 - ok
09:33:58.0647 0x1414 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
09:33:58.0694 0x1414 CmBatt - ok
09:33:58.0725 0x1414 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
09:33:58.0741 0x1414 cmdide - ok
09:33:58.0787 0x1414 [ EC0511BB85BAA42A9734011685A6732C, 10B52F0860CCB3AA0FC34DDA5C5538BFCF7B6D40738B7756297237FD2D9E01C1 ] CNG C:\Windows\system32\Drivers\cng.sys
09:33:58.0819 0x1414 CNG - ok
09:33:58.0850 0x1414 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
09:33:58.0865 0x1414 Compbatt - ok
09:33:58.0897 0x1414 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
09:33:58.0943 0x1414 CompositeBus - ok
09:33:58.0959 0x1414 COMSysApp - ok
09:33:58.0990 0x1414 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
09:33:59.0021 0x1414 crcdisk - ok
09:33:59.0053 0x1414 [ 7BC3E861F7E8EB543A630090FAE779E0, 52A538F25C853AAC9706CD0D4EBF80B1963391AA175895CFD9D44C8ABBFCFB74 ] CryptSvc C:\Windows\system32\cryptsvc.dll
09:33:59.0084 0x1414 CryptSvc - ok
09:33:59.0131 0x1414 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
09:33:59.0193 0x1414 DcomLaunch - ok
09:33:59.0240 0x1414 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
09:33:59.0287 0x1414 defragsvc - ok
09:33:59.0302 0x102c Object send P2P result: true
09:33:59.0302 0x102c Object required for P2P: [ 3CBE5047BB08BD363420D68364F9E829 ] AntiVirSchedulerService
09:33:59.0318 0x1414 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
09:33:59.0349 0x1414 DfsC - ok
09:33:59.0396 0x1414 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
09:33:59.0427 0x0814 Object required for P2P: [ BB73DD7B20132FB1A30990E025DEA1E4 ] Avira.ServiceHost
09:33:59.0443 0x1414 Dhcp - ok
09:33:59.0536 0x1414 [ EC3F433D00365F1A9BC3411BCA7C7140, 0852D747359DE573504EBBDB99DA26D3BFA8B3C7A4836F8E3A5AD94B5571AD5C ] DiagTrack C:\Windows\system32\diagtrack.dll
09:33:59.0619 0x1414 DiagTrack - ok
09:33:59.0650 0x1414 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
09:33:59.0732 0x1414 discache - ok
09:33:59.0758 0x1414 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
09:33:59.0774 0x1414 Disk - ok
09:33:59.0807 0x1414 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
09:33:59.0868 0x1414 Dnscache - ok
09:33:59.0906 0x1414 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
09:33:59.0947 0x1414 dot3svc - ok
09:33:59.0978 0x1414 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
09:34:00.0025 0x1414 DPS - ok
09:34:00.0087 0x1414 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
09:34:00.0150 0x1414 drmkaud - ok
09:34:00.0212 0x1414 [ 46571ED73AE84469DCA53081D33CF3C8, 8BB386BB4F6AD39F06A8607CD1DF3D67CFA45BBE52E40EDB90EB8C862283EBFF ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys
09:34:00.0243 0x1414 dtsoftbus01 - ok
09:34:00.0290 0x1414 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
09:34:00.0337 0x1414 DXGKrnl - ok
09:34:00.0353 0x1414 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
09:34:00.0415 0x1414 EapHost - ok
09:34:00.0540 0x1414 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
09:34:00.0743 0x1414 ebdrv - ok
09:34:00.0790 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] EFS C:\Windows\System32\lsass.exe
09:34:00.0821 0x1414 EFS - ok
09:34:00.0914 0x1414 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
09:34:00.0974 0x1414 ehRecvr - ok
09:34:01.0005 0x1414 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
09:34:01.0020 0x1414 ehSched - ok
09:34:01.0067 0x1414 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
09:34:01.0098 0x1414 elxstor - ok
09:34:01.0145 0x1414 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
09:34:01.0176 0x1414 ErrDev - ok
09:34:01.0223 0x1414 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
09:34:01.0270 0x1414 EventSystem - ok
09:34:01.0286 0x1414 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
09:34:01.0332 0x1414 exfat - ok
09:34:01.0348 0x1414 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
09:34:01.0410 0x1414 fastfat - ok
09:34:01.0488 0x1414 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
09:34:01.0535 0x1414 Fax - ok
09:34:01.0551 0x1414 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
09:34:01.0566 0x1414 fdc - ok
09:34:01.0582 0x1414 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
09:34:01.0644 0x1414 fdPHost - ok
09:34:01.0660 0x1414 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
09:34:01.0707 0x1414 FDResPub - ok
09:34:01.0722 0x1414 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
09:34:01.0722 0x1414 FileInfo - ok
09:34:01.0754 0x1414 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
09:34:01.0769 0x102c Object send P2P result: true
09:34:01.0769 0x102c Object required for P2P: [ 3CBE5047BB08BD363420D68364F9E829 ] AntiVirService
09:34:01.0800 0x1414 Filetrace - ok
09:34:01.0816 0x1414 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
09:34:01.0832 0x1414 flpydisk - ok
09:34:01.0878 0x0814 Object send P2P result: true
09:34:01.0894 0x1414 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
09:34:01.0910 0x1414 FltMgr - ok
09:34:01.0972 0x1414 [ BCB16AE33AA58E0042F3EF34CFB6396A, E8ADA10DE60A94E4BABE9FCA6D0AA83B11520C092D49057E17F6C6059D35A323 ] FontCache C:\Windows\system32\FntCache.dll
09:34:02.0050 0x1414 FontCache - ok
09:34:02.0112 0x1414 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
09:34:02.0112 0x1414 FontCache3.0.0.0 - ok
09:34:02.0128 0x1414 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
09:34:02.0144 0x1414 FsDepends - ok
09:34:02.0175 0x1414 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
09:34:02.0190 0x1414 Fs_Rec - ok
09:34:02.0222 0x1414 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
09:34:02.0253 0x1414 fvevol - ok
09:34:02.0268 0x1414 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
09:34:02.0284 0x1414 gagp30kx - ok
09:34:02.0424 0x1414 [ 4A336C92A790A3F7C2D9952C73FCFA16, 2EB400EBAA2B50A97F442D18107316A172A92660F5D712D1C58D39172C9CD80C ] GamesAppIntegrationService C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
09:34:02.0518 0x1414 GamesAppIntegrationService - ok
09:34:02.0674 0x1414 [ A404AE536DD73FC8118A15BFF0BD4FC0, EA24D7866FEB40DD72713601E14DBDA60497324222196B8E0791DA656DBF5DA7 ] GamesAppService C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
09:34:02.0752 0x1414 GamesAppService - ok
09:34:02.0814 0x1414 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
09:34:02.0908 0x1414 gpsvc - ok
09:34:02.0970 0x1414 [ 0191DEE9B9EB7902AF2CF4F67301095D, 9E2E263E84167E1AD3FFCEA84066AF07CD6A653F5D8266A619E4973BC4B25460 ] GREGService C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe
09:34:02.0986 0x1414 GREGService - ok
09:34:03.0048 0x1414 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
09:34:03.0080 0x1414 gupdate - ok
09:34:03.0111 0x1414 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
09:34:03.0111 0x1414 gupdatem - ok
09:34:03.0142 0x1414 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
09:34:03.0173 0x1414 hcw85cir - ok
09:34:03.0220 0x1414 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
09:34:03.0267 0x1414 HdAudAddService - ok
09:34:03.0298 0x1414 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
09:34:03.0329 0x1414 HDAudBus - ok
09:34:03.0360 0x1414 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
09:34:03.0376 0x1414 HidBatt - ok
09:34:03.0376 0x1414 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
09:34:03.0423 0x1414 HidBth - ok
09:34:03.0454 0x1414 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
09:34:03.0485 0x1414 HidIr - ok
09:34:03.0516 0x1414 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\system32\hidserv.dll
09:34:03.0594 0x1414 hidserv - ok
09:34:03.0641 0x1414 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
09:34:03.0672 0x1414 HidUsb - ok
09:34:03.0719 0x1414 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
09:34:03.0766 0x1414 hkmsvc - ok
09:34:03.0813 0x1414 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
09:34:03.0844 0x1414 HomeGroupListener - ok
09:34:03.0875 0x1414 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
09:34:03.0906 0x1414 HomeGroupProvider - ok
09:34:03.0953 0x1414 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
09:34:03.0969 0x1414 HpSAMD - ok
09:34:04.0016 0x1414 [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP C:\Windows\system32\drivers\HTTP.sys
09:34:04.0062 0x1414 HTTP - ok
09:34:04.0109 0x1414 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
09:34:04.0125 0x1414 hwpolicy - ok
09:34:04.0172 0x1414 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
09:34:04.0187 0x1414 i8042prt - ok
09:34:04.0218 0x1414 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
09:34:04.0218 0x102c Object send P2P result: true
09:34:04.0234 0x1414 iaStorV - ok
09:34:04.0343 0x1414 IBYKUS AG: ELSA-Suite update permissions manager. 32063. - ok
09:34:04.0437 0x1414 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
09:34:04.0468 0x1414 idsvc - ok
09:34:04.0484 0x1414 IEEtwCollectorService - ok
09:34:04.0718 0x1414 [ A87261EF1546325B559374F5689CF5BC, 8DE48A8A13A32AAAC54CDDF58F3F61BE3E2802C1D9CA1CA98E57EB0D65FB6002 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
09:34:04.0998 0x1414 igfx - ok
09:34:05.0045 0x1414 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
09:34:05.0061 0x1414 iirsp - ok
09:34:05.0123 0x1414 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
09:34:05.0170 0x1414 IKEEXT - ok
09:34:05.0264 0x1414 [ 96B0A408842B0E214EDCB41E89438999, 7197284D9585EF34A0376EA773F9B7C68E3AEBB8C9F7A3E44DFAA461872F2600 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
09:34:05.0373 0x1414 IntcAzAudAddService - ok
09:34:05.0404 0x1414 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
09:34:05.0435 0x1414 intelide - ok
09:34:05.0451 0x1414 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
09:34:05.0482 0x1414 intelppm - ok
09:34:05.0513 0x1414 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
09:34:05.0560 0x1414 IPBusEnum - ok
09:34:05.0591 0x1414 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:34:05.0669 0x1414 IpFilterDriver - ok
09:34:05.0732 0x1414 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
09:34:05.0825 0x1414 iphlpsvc - ok
09:34:05.0888 0x1414 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
09:34:05.0950 0x1414 IPMIDRV - ok
09:34:05.0981 0x1414 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
09:34:06.0028 0x1414 IPNAT - ok
09:34:06.0059 0x1414 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
09:34:06.0137 0x1414 IRENUM - ok
09:34:06.0153 0x1414 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
09:34:06.0168 0x1414 isapnp - ok
09:34:06.0200 0x1414 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
09:34:06.0215 0x1414 iScsiPrt - ok
09:34:06.0231 0x1414 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
09:34:06.0246 0x1414 kbdclass - ok
09:34:06.0262 0x1414 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
09:34:06.0309 0x1414 kbdhid - ok
09:34:06.0324 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] KeyIso C:\Windows\system32\lsass.exe
09:34:06.0340 0x1414 KeyIso - ok
09:34:06.0371 0x1414 [ BCC83F22805F560C8A487F2F296A78FE, B6729B9D85CC3B9377E3143FEF920EFAA82D152845A43074417E9266C9F5C1A8 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
09:34:06.0402 0x1414 KSecDD - ok
09:34:06.0434 0x1414 [ 33D52A96BEEE8AFCE9E07EEC9FE0C9DB, 5367B46A43296792A0E6294906D40511079D5CAA23F08D5A7EDE02C06AD34484 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
09:34:06.0449 0x1414 KSecPkg - ok
09:34:06.0465 0x1414 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
09:34:06.0543 0x1414 ksthunk - ok
09:34:06.0574 0x1414 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
09:34:06.0636 0x1414 KtmRm - ok
09:34:06.0683 0x1414 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\system32\srvsvc.dll
09:34:06.0761 0x1414 LanmanServer - ok
09:34:06.0792 0x1414 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
09:34:06.0839 0x1414 LanmanWorkstation - ok
09:34:06.0870 0x1414 [ 156AB2E56DC3CA0B582E3362E07CDED7, 7B03929273861690DC42E4C686E655BE5A1C60136AE5E739D7E62306AFD4AB9A ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
09:34:06.0886 0x1414 lirsgt - ok
09:34:06.0902 0x1414 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
09:34:06.0933 0x1414 lltdio - ok
09:34:06.0964 0x1414 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
09:34:06.0995 0x1414 lltdsvc - ok
09:34:07.0011 0x1414 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
09:34:07.0073 0x1414 lmhosts - ok
09:34:07.0115 0x1414 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
09:34:07.0131 0x1414 LSI_FC - ok
09:34:07.0162 0x1414 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
09:34:07.0178 0x1414 LSI_SAS - ok
09:34:07.0193 0x1414 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:34:07.0209 0x1414 LSI_SAS2 - ok
09:34:07.0225 0x1414 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:34:07.0256 0x1414 LSI_SCSI - ok
09:34:07.0287 0x1414 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
09:34:07.0349 0x1414 luafv - ok
09:34:07.0412 0x1414 [ CFBC6C6D8A492697CABD1D353EE64933, DDAA844908324740C891EB8F08E2A8BB00457063B31C4A762745C1C2415FC12D ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
09:34:07.0427 0x1414 MBAMProtector - ok
09:34:07.0583 0x1414 [ AB176B9E59C0435499D83047D84EDD59, 85B826A3972CE9AD885313B69B9C60328B850257667D0EB65DDE890D0BB06361 ] MBAMScheduler C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
09:34:07.0661 0x1414 MBAMScheduler - ok
09:34:07.0739 0x1414 [ 40C126CB15FAB7D6C66490DCA9C1AED2, B32CEE2D2409232C245427D5E9647FDF59AF1D8AB5E8A98EE2D1F1314599FD14 ] MBAMService C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
09:34:07.0786 0x1414 MBAMService - ok
09:34:07.0848 0x1414 [ 78488AF2AB2111D67B3C4044707A519B, 7AA71B9C4C7949A1A21F60EF7CCEDE0079794990696B60557B5DC86F4D47223A ] MBAMSwissArmy C:\Windows\system32\drivers\MBAMSwissArmy.sys
09:34:07.0879 0x1414 MBAMSwissArmy - ok
09:34:07.0912 0x1414 [ D61070CFAD43038DC56AEAD9BFE9CE2A, BD77AEF60E7FD2015CB14A464799304359547146C14A47F8D25274ACFA2E42D5 ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
09:34:07.0922 0x1414 MBAMWebAccessControl - ok
09:34:08.0069 0x1414 [ 3763AFE14AAE525812EB1600B1BB2D51, 277D72523C7B7970F24674BB688D1FE916F28378EC39A31C1132EEA6F4C3BD70 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe
09:34:08.0112 0x1414 McComponentHostService - ok
09:34:08.0149 0x1414 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
09:34:08.0165 0x1414 Mcx2Svc - ok
09:34:08.0182 0x1414 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
09:34:08.0200 0x1414 megasas - ok
09:34:08.0238 0x1414 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
09:34:08.0275 0x1414 MegaSR - ok
09:34:08.0311 0x1414 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
09:34:08.0362 0x1414 MMCSS - ok
09:34:08.0383 0x1414 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
09:34:08.0435 0x1414 Modem - ok
09:34:08.0460 0x1414 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
09:34:08.0492 0x1414 monitor - ok
09:34:08.0539 0x1414 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
09:34:08.0553 0x1414 mouclass - ok
09:34:08.0568 0x1414 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
09:34:08.0592 0x1414 mouhid - ok
09:34:08.0622 0x1414 [ 67050452C0118BAF2883928E6FCCFE47, 335FC0AEB7B47DCC7CE0CF3F424EB60ACB1327D2FF6515F04D9AC03A10FF1E31 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
09:34:08.0636 0x1414 mountmgr - ok
09:34:08.0711 0x1414 [ 9D665BF5A855CD65E6D724F480501B3F, 899AD70D4B14B604D160A30D64EB42A56877744F2F53AA23E3702731A87A5DD3 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
09:34:08.0752 0x1414 MozillaMaintenance - ok
09:34:08.0774 0x1414 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
09:34:08.0783 0x1414 mpio - ok
09:34:08.0798 0x1414 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
09:34:08.0835 0x1414 mpsdrv - ok
09:34:08.0894 0x1414 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
09:34:08.0957 0x1414 MpsSvc - ok
09:34:09.0006 0x1414 [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
09:34:09.0035 0x1414 MRxDAV - ok
09:34:09.0066 0x1414 [ 73ADDCC406B86E7DA4416691E8E74BDA, 4EC970B9095E6DAA79BF7EFB92DF3F2C0AB0C46739AA36C171A262E05B63CBB5 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
09:34:09.0093 0x1414 mrxsmb - ok
09:34:09.0111 0x1414 [ 7C81098FBAF2EAF5B54B939F832B0F61, 999435DF4638ECB136D5BF1B84305A84B215BAB542E4D5301E57D28D507E11B3 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:34:09.0142 0x1414 mrxsmb10 - ok
09:34:09.0173 0x1414 [ ACB763673BCCE6C7B3B8F858C9FE4F1F, CCD49558F8A01A225AEAE60BF299BCA6E9399E39F4F553FABC36CADB164BBBC0 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:34:09.0189 0x1414 mrxsmb20 - ok
09:34:09.0220 0x1414 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
09:34:09.0236 0x1414 msahci - ok
09:34:09.0282 0x1414 [ A592A054D78750B4D73ABAA4C94DECDF, 40B135C9F9EE698EC78BD19BD18353AE2CF4D020DDB9CFC37CD2FDBF7602614A ] MSCamSvc C:\Program Files\Microsoft LifeCam\MSCamS64.exe
09:34:09.0314 0x1414 MSCamSvc - ok
09:34:09.0363 0x1414 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
09:34:09.0378 0x1414 msdsm - ok
09:34:09.0401 0x1414 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
09:34:09.0440 0x1414 MSDTC - ok
09:34:09.0477 0x1414 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
09:34:09.0532 0x1414 Msfs - ok
09:34:09.0554 0x1414 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
09:34:09.0583 0x1414 mshidkmdf - ok
09:34:09.0617 0x1414 [ 55218F924E55FD2786ED40EDF4ED79C3, C6000DE3A1FB526ECB77438A03F7212517CCD5E0CC9DDA07826865F8B980BEA0 ] MSHUSBVideo C:\Windows\system32\Drivers\nx6000.sys
09:34:09.0645 0x1414 MSHUSBVideo - ok
09:34:09.0678 0x1414 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
09:34:09.0678 0x1414 msisadrv - ok
09:34:09.0710 0x1414 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
09:34:09.0768 0x1414 MSiSCSI - ok
09:34:09.0768 0x1414 msiserver - ok
09:34:09.0815 0x1414 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
09:34:09.0866 0x1414 MSKSSRV - ok
09:34:09.0888 0x1414 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
09:34:09.0919 0x1414 MSPCLOCK - ok
09:34:09.0934 0x1414 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
09:34:09.0985 0x1414 MSPQM - ok
09:34:10.0034 0x1414 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
09:34:10.0054 0x1414 MsRPC - ok
09:34:10.0064 0x1414 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
09:34:10.0064 0x1414 mssmbios - ok
09:34:10.0079 0x1414 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
09:34:10.0143 0x1414 MSTEE - ok
09:34:10.0164 0x1414 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
09:34:10.0187 0x1414 MTConfig - ok
09:34:10.0202 0x1414 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
09:34:10.0220 0x1414 Mup - ok
09:34:10.0251 0x1414 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
09:34:10.0298 0x1414 napagent - ok
09:34:10.0313 0x1414 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
09:34:10.0360 0x1414 NativeWifiP - ok
09:34:10.0454 0x1414 [ F7309F42555F8AAB7144A51A1F2585B0, 065277A8AFAEE3888C997A76D2F751070F92DF4C3354D16B194860B4BDAFF937 ] NDIS C:\Windows\system32\drivers\ndis.sys
09:34:10.0501 0x1414 NDIS - ok
09:34:10.0532 0x1414 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
09:34:10.0579 0x1414 NdisCap - ok
09:34:10.0610 0x1414 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
09:34:10.0641 0x1414 NdisTapi - ok
09:34:10.0672 0x1414 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
09:34:10.0735 0x1414 Ndisuio - ok
09:34:10.0766 0x1414 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
09:34:10.0813 0x1414 NdisWan - ok
09:34:10.0844 0x1414 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
09:34:10.0922 0x1414 NDProxy - ok
09:34:11.0015 0x1414 [ 7D2633295EB6FF2B938185874884059D, B3A4E52ABCB2E2720D8ADB0B68C222D4AB98E838D40B6A731D15EB1D6C9DEA15 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
09:34:11.0093 0x1414 Nero BackItUp Scheduler 4.0 - ok
09:34:11.0109 0x1414 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
09:34:11.0140 0x1414 NetBIOS - ok
09:34:11.0187 0x1414 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
09:34:11.0249 0x1414 NetBT - ok
09:34:11.0265 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] Netlogon C:\Windows\system32\lsass.exe
09:34:11.0296 0x1414 Netlogon - ok
09:34:11.0327 0x1414 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
09:34:11.0374 0x1414 Netman - ok
09:34:11.0421 0x1414 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:34:11.0530 0x1414 NetMsmqActivator - ok
09:34:11.0561 0x1414 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:34:11.0577 0x1414 NetPipeActivator - ok
09:34:11.0593 0x1414 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
09:34:11.0655 0x1414 netprofm - ok
09:34:11.0655 0x1414 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:34:11.0671 0x1414 NetTcpActivator - ok
09:34:11.0686 0x1414 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:34:11.0702 0x1414 NetTcpPortSharing - ok
09:34:11.0717 0x1414 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
09:34:11.0733 0x1414 nfrd960 - ok
09:34:11.0780 0x1414 [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\Windows\System32\nlasvc.dll
09:34:11.0811 0x1414 NlaSvc - ok
09:34:11.0811 0x1414 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
09:34:11.0842 0x1414 Npfs - ok
09:34:11.0873 0x1414 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
09:34:11.0905 0x1414 nsi - ok
09:34:11.0905 0x1414 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
09:34:11.0936 0x1414 nsiproxy - ok
09:34:12.0014 0x1414 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
09:34:12.0061 0x1414 Ntfs - ok
09:34:12.0092 0x1414 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
09:34:12.0123 0x1414 Null - ok
09:34:12.0170 0x1414 [ CDDD4478757288DF4BB1494BFD084259, 2063A1B4F24BD466A501198B12574D830BC4696ED53CDFF96C1EE91EE8CD1BB0 ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys
09:34:12.0185 0x1414 NVHDA - ok
09:34:12.0482 0x1414 [ FCBA1C22727939E7CFF9EB08FE9692AB, 081FBF38EA17746C5CF2260AD32B62385D4A075476E30CBB9A2AA080F8AA0CA4 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
09:34:12.0897 0x1414 nvlddmkm - ok
09:34:12.0962 0x1414 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
09:34:12.0977 0x1414 nvraid - ok
09:34:13.0008 0x1414 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
09:34:13.0024 0x1414 nvstor - ok
09:34:13.0071 0x1414 [ 10C232F6CFFD51D2332898AE7AE0FF23, 92E5452D8467852C22D702ACAFB5DBFD312A8F72A4353B8D0A9C18AEFCE4B2B2 ] nvsvc C:\Windows\system32\nvvsvc.exe
09:34:13.0102 0x1414 nvsvc - ok
09:34:13.0196 0x1414 [ 4789E020D2617046862D1790FC235FF6, FCFD56DF2CADA830E7B2D4B91D5A9D2FE783B1396CBA124000765168FA5B6574 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
09:34:13.0305 0x1414 nvUpdatusService - ok
09:34:13.0320 0x1414 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
09:34:13.0352 0x1414 nv_agp - ok
09:34:13.0383 0x1414 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
09:34:13.0383 0x1414 ohci1394 - ok
09:34:13.0554 0x1414 [ 40CB809645F1D0A93C535F9B0402F269, E683ED4ED824CE4E49715F23E3D3E8245B398D7A0D279E1F31470B9D7AF7E223 ] Origin Client Service C:\Program Files (x86)\Origin\OriginClientService.exe
09:34:13.0726 0x1414 Origin Client Service - ok
09:34:13.0773 0x1414 [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:34:13.0788 0x1414 ose - ok
09:34:13.0960 0x1414 [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
09:34:14.0132 0x1414 osppsvc - ok
09:34:14.0178 0x1414 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
09:34:14.0241 0x1414 p2pimsvc - ok
09:34:14.0256 0x1414 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
09:34:14.0303 0x1414 p2psvc - ok
09:34:14.0334 0x1414 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
09:34:14.0366 0x1414 Parport - ok
09:34:14.0412 0x1414 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
09:34:14.0412 0x1414 partmgr - ok
09:34:14.0444 0x1414 [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc C:\Windows\System32\pcasvc.dll
09:34:14.0506 0x1414 PcaSvc - ok
09:34:14.0537 0x1414 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
09:34:14.0553 0x1414 pci - ok
09:34:14.0584 0x1414 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
09:34:14.0600 0x1414 pciide - ok
09:34:14.0615 0x1414 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
09:34:14.0646 0x1414 pcmcia - ok
09:34:14.0662 0x1414 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
09:34:14.0662 0x1414 pcw - ok
09:34:14.0787 0x1414 [ 98655F862BB07CFB1CCC9262DA621AE1, 6903FA802D73A2450DE29BBA9283EC9C256C4C08D848201952D51DBBD9630A9A ] PDF Architect Helper Service C:\Program Files (x86)\PDF Architect\HelperService.exe
09:34:14.0858 0x1414 PDF Architect Helper Service - ok
09:34:14.0913 0x1414 [ 73406F96E946F2B38615375269EF286F, 28170FF1F3B641B013DDB57582F8D9E6ED4205D8C63C89EA685FEC1E42833309 ] PDF Architect Service C:\Program Files (x86)\PDF Architect\ConversionService.exe
09:34:14.0951 0x1414 PDF Architect Service - ok
09:34:15.0002 0x1414 [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
09:34:15.0042 0x1414 PEAUTH - ok
09:34:15.0118 0x1414 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
09:34:15.0156 0x1414 PerfHost - ok
09:34:15.0243 0x1414 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
09:34:15.0327 0x1414 pla - ok
09:34:15.0364 0x1414 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
09:34:15.0389 0x1414 PlugPlay - ok
09:34:15.0413 0x1414 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
09:34:15.0458 0x1414 PNRPAutoReg - ok
09:34:15.0476 0x1414 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
09:34:15.0498 0x1414 PNRPsvc - ok
09:34:15.0530 0x1414 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
09:34:15.0574 0x1414 PolicyAgent - ok
09:34:15.0601 0x1414 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
09:34:15.0637 0x1414 Power - ok
09:34:15.0684 0x1414 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
09:34:15.0746 0x1414 PptpMiniport - ok
09:34:15.0777 0x1414 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
09:34:15.0824 0x1414 Processor - ok
09:34:15.0871 0x1414 [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\Windows\system32\profsvc.dll
09:34:15.0933 0x1414 ProfSvc - ok
09:34:15.0949 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] ProtectedStorage C:\Windows\system32\lsass.exe
09:34:15.0964 0x1414 ProtectedStorage - ok
09:34:16.0011 0x1414 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
09:34:16.0058 0x1414 Psched - ok
09:34:16.0105 0x1414 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
09:34:16.0183 0x1414 ql2300 - ok
09:34:16.0222 0x1414 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
09:34:16.0238 0x1414 ql40xx - ok
09:34:16.0254 0x1414 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
09:34:16.0269 0x1414 QWAVE - ok
09:34:16.0291 0x1414 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
09:34:16.0325 0x1414 QWAVEdrv - ok
09:34:16.0351 0x1414 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
09:34:16.0419 0x1414 RasAcd - ok
09:34:16.0465 0x1414 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
09:34:16.0496 0x1414 RasAgileVpn - ok
09:34:16.0502 0x1414 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
09:34:16.0538 0x1414 RasAuto - ok
09:34:16.0567 0x1414 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
09:34:16.0601 0x1414 Rasl2tp - ok
09:34:16.0639 0x1414 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
09:34:16.0688 0x1414 RasMan - ok
09:34:16.0701 0x1414 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
09:34:16.0752 0x1414 RasPppoe - ok
09:34:16.0781 0x1414 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
09:34:16.0816 0x1414 RasSstp - ok
09:34:16.0848 0x1414 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
09:34:16.0899 0x1414 rdbss - ok
09:34:16.0907 0x1414 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
09:34:16.0954 0x1414 rdpbus - ok
09:34:16.0969 0x1414 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
09:34:17.0001 0x1414 RDPCDD - ok
09:34:17.0032 0x1414 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
09:34:17.0084 0x1414 RDPENCDD - ok
09:34:17.0108 0x1414 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
09:34:17.0139 0x1414 RDPREFMP - ok
09:34:17.0176 0x1414 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
09:34:17.0208 0x1414 RDPWD - ok
09:34:17.0240 0x1414 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
09:34:17.0255 0x1414 rdyboost - ok
09:34:17.0290 0x1414 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
09:34:17.0342 0x1414 RemoteAccess - ok
09:34:17.0376 0x1414 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
09:34:17.0413 0x1414 RemoteRegistry - ok
09:34:17.0444 0x1414 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
09:34:17.0478 0x1414 RpcEptMapper - ok
09:34:17.0502 0x1414 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
09:34:17.0515 0x1414 RpcLocator - ok
09:34:17.0560 0x1414 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
09:34:17.0597 0x1414 RpcSs - ok
09:34:17.0613 0x1414 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
09:34:17.0644 0x1414 rspndr - ok
09:34:17.0660 0x1414 [ B49DC435AE3695BAC5623DD94B05732D, D63160B09385ED31C2A479ADC5AFCA483906F38598874972025D680BDB45ECA0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
09:34:17.0706 0x1414 RTL8167 - ok
09:34:17.0738 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] SamSs C:\Windows\system32\lsass.exe
09:34:17.0790 0x1414 SamSs - ok
09:34:17.0824 0x1414 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
09:34:17.0840 0x1414 sbp2port - ok
09:34:17.0881 0x1414 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
09:34:17.0919 0x1414 SCardSvr - ok
09:34:17.0950 0x1414 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
09:34:17.0998 0x1414 scfilter - ok
09:34:18.0060 0x1414 [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule C:\Windows\system32\schedsvc.dll
09:34:18.0139 0x1414 Schedule - ok
09:34:18.0158 0x1414 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
09:34:18.0201 0x1414 SCPolicySvc - ok
09:34:18.0269 0x1414 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
09:34:18.0300 0x1414 SDRSVC - ok
09:34:18.0331 0x1414 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
09:34:18.0384 0x1414 secdrv - ok
09:34:18.0414 0x1414 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
09:34:18.0468 0x1414 seclogon - ok
09:34:18.0488 0x1414 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\System32\sens.dll
09:34:18.0521 0x1414 SENS - ok
09:34:18.0538 0x1414 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
09:34:18.0586 0x1414 SensrSvc - ok
09:34:18.0605 0x1414 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
09:34:18.0619 0x1414 Serenum - ok
09:34:18.0639 0x1414 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
09:34:18.0652 0x1414 Serial - ok
09:34:18.0678 0x1414 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
09:34:18.0718 0x1414 sermouse - ok
09:34:18.0744 0x1414 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
09:34:18.0788 0x1414 SessionEnv - ok
09:34:18.0821 0x1414 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
09:34:18.0844 0x1414 sffdisk - ok
09:34:18.0856 0x1414 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
09:34:18.0878 0x1414 sffp_mmc - ok
09:34:18.0890 0x1414 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
09:34:18.0905 0x1414 sffp_sd - ok
09:34:18.0924 0x1414 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
09:34:18.0943 0x1414 sfloppy - ok
09:34:18.0967 0x1414 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
09:34:19.0022 0x1414 SharedAccess - ok
09:34:19.0053 0x1414 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
09:34:19.0100 0x1414 ShellHWDetection - ok
09:34:19.0131 0x1414 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:34:19.0147 0x1414 SiSRaid2 - ok
09:34:19.0162 0x1414 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
09:34:19.0178 0x1414 SiSRaid4 - ok
09:34:19.0283 0x1414 [ 52F7E8603E888E3DB0A8B3D1804098E9, 4E23DC9442C0C14AAE7146DACBB0B39743F1FFAA463EE7069CCDF866AD27BD77 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
09:34:19.0337 0x1414 SkypeUpdate - ok
09:34:19.0371 0x1414 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
09:34:19.0419 0x1414 Smb - ok
09:34:19.0453 0x1414 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
09:34:19.0467 0x1414 SNMPTRAP - ok
09:34:19.0512 0x1414 [ 3BB48F7E33C2B76184DDF233000C09CD, D1AAE5B0425047CA0C2D376D3E59324D35A90DF9074CD442DFD0ED6E434D3C84 ] Sony SCSI Helper Service C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
09:34:19.0565 0x1414 Sony SCSI Helper Service - detected UnsignedFile.Multi.Generic ( 1 )
09:34:21.0914 0x1414 Detect skipped due to KSN trusted
09:34:21.0914 0x1414 Sony SCSI Helper Service - ok
09:34:21.0916 0x1414 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
09:34:21.0962 0x1414 spldr - ok
09:34:22.0012 0x1414 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
09:34:22.0051 0x1414 Spooler - ok
09:34:22.0176 0x1414 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
09:34:22.0347 0x1414 sppsvc - ok
09:34:22.0378 0x1414 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
09:34:22.0410 0x1414 sppuinotify - ok
09:34:22.0456 0x1414 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
09:34:22.0533 0x1414 srv - ok
09:34:22.0564 0x1414 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
09:34:22.0580 0x1414 srv2 - ok
09:34:22.0595 0x1414 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
09:34:22.0626 0x1414 srvnet - ok
09:34:22.0658 0x1414 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
09:34:22.0704 0x1414 SSDPSRV - ok
09:34:22.0736 0x1414 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
09:34:22.0767 0x1414 SstpSvc - ok
09:34:22.0850 0x1414 [ E8606BF6BE3B7481D95F1DD2E4F3FCBA, 522646B5266C3E18AF909CB49F411ABB10F5DCD02A2B923C1EA209529AFD1A94 ] StarMoney 7.0 OnlineUpdate C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
09:34:22.0862 0x1414 StarMoney 7.0 OnlineUpdate - ok
09:34:22.0987 0x1414 [ 98CC6BDCB5F593394CE2000EC454AEE4, 13973E69DDFB5A0494141C60ABF0E6F7EF555B476AC4171B18A31FF04618D54B ] StarMoney 8.0 OnlineUpdate C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
09:34:23.0018 0x1414 StarMoney 8.0 OnlineUpdate - ok
09:34:23.0127 0x1414 [ 3BF022F8064A83A23DF90971DD78CA83, 85754DF1C6DE745ADF9A0BAB1948AFF2CA16C4569128DA90AF610D199E621BF4 ] StarMoney 9.0 OnlineUpdate C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
09:34:23.0189 0x1414 StarMoney 9.0 OnlineUpdate - ok
09:34:23.0252 0x1414 [ 5A19667A580B1CE886EAF968B9743F45, 0A9EBE4057A0A6EF4732623794C2416A6BD8B87356DA46652BD92762505F57C7 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
09:34:23.0299 0x1414 Stereo Service - ok
09:34:23.0314 0x1414 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
09:34:23.0330 0x1414 stexstor - ok
09:34:23.0377 0x1414 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
09:34:23.0423 0x1414 stisvc - ok
09:34:23.0470 0x1414 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
09:34:23.0486 0x1414 swenum - ok
09:34:23.0517 0x1414 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
09:34:23.0564 0x1414 swprv - ok
09:34:23.0657 0x1414 [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain C:\Windows\system32\sysmain.dll
09:34:23.0767 0x1414 SysMain - ok
09:34:23.0813 0x1414 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
09:34:23.0845 0x1414 TabletInputService - ok
09:34:23.0876 0x1414 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
09:34:23.0938 0x1414 TapiSrv - ok
09:34:23.0938 0x1414 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
09:34:23.0969 0x1414 TBS - ok
09:34:24.0063 0x1414 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
09:34:24.0132 0x1414 Tcpip - ok
09:34:24.0179 0x1414 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
09:34:24.0226 0x1414 TCPIP6 - ok
09:34:24.0273 0x1414 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
09:34:24.0288 0x1414 tcpipreg - ok
09:34:24.0320 0x1414 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
09:34:24.0351 0x1414 TDPIPE - ok
09:34:24.0382 0x1414 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
09:34:24.0398 0x1414 TDTCP - ok
09:34:24.0444 0x1414 [ AA77EB517D2F07A947294F260E3ACA83, B7A5DF3066830C0C2302B059778A67419792058A0D300C471DE40AB245EA7E58 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
09:34:24.0476 0x1414 tdx - ok
09:34:24.0507 0x1414 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
09:34:24.0507 0x1414 TermDD - ok
09:34:24.0554 0x1414 [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
09:34:24.0632 0x1414 TermService - ok
09:34:24.0663 0x1414 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
09:34:24.0678 0x1414 Themes - ok
09:34:24.0710 0x1414 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
09:34:24.0741 0x1414 THREADORDER - ok
09:34:24.0741 0x1414 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
09:34:24.0788 0x1414 TrkWks - ok
09:34:24.0850 0x1414 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
09:34:24.0881 0x1414 TrustedInstaller - ok
09:34:24.0928 0x1414 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
09:34:24.0928 0x1414 tssecsrv - ok
09:34:24.0990 0x1414 [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
09:34:25.0037 0x1414 TsUsbFlt - ok
09:34:25.0084 0x1414 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
09:34:25.0146 0x1414 tunnel - ok
09:34:25.0178 0x1414 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
09:34:25.0224 0x1414 uagp35 - ok
09:34:25.0271 0x1414 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
09:34:25.0302 0x1414 udfs - ok
09:34:25.0318 0x1414 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
09:34:25.0334 0x1414 UI0Detect - ok
09:34:25.0365 0x1414 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
09:34:25.0380 0x1414 uliagpkx - ok
09:34:25.0427 0x1414 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\drivers\umbus.sys
09:34:25.0443 0x1414 umbus - ok
09:34:25.0458 0x1414 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
09:34:25.0474 0x1414 UmPass - ok
09:34:25.0531 0x1414 [ F9EC9ACD504D823D9B9CA98A4F8D3CA2, 58DAD5111C598F14CB199FE6A61FA5918F29513B778A8664FD05EFAB3C665D4F ] Updater Service C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
09:34:25.0546 0x1414 Updater Service - ok
09:34:25.0562 0x1414 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
09:34:25.0609 0x1414 upnphost - ok
09:34:25.0640 0x1414 [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
09:34:25.0695 0x1414 usbaudio - ok
09:34:25.0728 0x1414 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
09:34:25.0776 0x1414 usbccgp - ok
09:34:25.0823 0x1414 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
09:34:25.0894 0x1414 usbcir - ok
09:34:25.0925 0x1414 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
09:34:25.0960 0x1414 usbehci - ok
09:34:26.0009 0x1414 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
09:34:26.0057 0x1414 usbhub - ok
09:34:26.0079 0x1414 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
09:34:26.0102 0x1414 usbohci - ok
09:34:26.0116 0x1414 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
09:34:26.0131 0x1414 usbprint - ok
09:34:26.0147 0x1414 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
09:34:26.0208 0x1414 usbscan - ok
09:34:26.0239 0x1414 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:34:26.0286 0x1414 USBSTOR - ok
09:34:26.0301 0x1414 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
09:34:26.0348 0x1414 usbuhci - ok
09:34:26.0379 0x1414 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
09:34:26.0410 0x1414 usbvideo - ok
09:34:26.0426 0x1414 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
09:34:26.0473 0x1414 UxSms - ok
09:34:26.0504 0x1414 [ 2BC45F4CF55B45BDD650828192F132B8, 4ABBC1DE6B17F7FEE9CB0BEEFEB6C88321826B4D52FBDF8B4B885CEA3CFD24F7 ] VaultSvc C:\Windows\system32\lsass.exe
09:34:26.0535 0x1414 VaultSvc - ok
09:34:26.0566 0x1414 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
09:34:26.0598 0x1414 vdrvroot - ok
09:34:26.0629 0x1414 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
09:34:26.0676 0x1414 vds - ok
09:34:26.0707 0x1414 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
09:34:26.0738 0x1414 vga - ok
09:34:26.0769 0x1414 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
09:34:26.0800 0x1414 VgaSave - ok
09:34:26.0832 0x1414 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
09:34:26.0847 0x1414 vhdmp - ok
09:34:26.0878 0x1414 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
09:34:26.0925 0x1414 viaide - ok
09:34:26.0941 0x1414 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
09:34:26.0956 0x1414 volmgr - ok
09:34:27.0003 0x1414 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
09:34:27.0019 0x1414 volmgrx - ok
09:34:27.0034 0x1414 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
09:34:27.0050 0x1414 volsnap - ok
09:34:27.0066 0x1414 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
09:34:27.0112 0x1414 vsmraid - ok
09:34:27.0206 0x1414 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
09:34:27.0284 0x1414 VSS - ok
09:34:27.0284 0x1414 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
09:34:27.0300 0x1414 vwifibus - ok
09:34:27.0331 0x1414 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
09:34:27.0378 0x1414 W32Time - ok
09:34:27.0393 0x1414 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
09:34:27.0424 0x1414 WacomPen - ok
09:34:27.0456 0x1414 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
09:34:27.0487 0x1414 WANARP - ok
09:34:27.0502 0x1414 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
09:34:27.0534 0x1414 Wanarpv6 - ok
09:34:27.0627 0x1414 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
09:34:27.0674 0x1414 WatAdminSvc - ok
09:34:27.0752 0x1414 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
09:34:27.0861 0x1414 wbengine - ok
09:34:27.0877 0x1414 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
09:34:27.0908 0x1414 WbioSrvc - ok
09:34:27.0955 0x1414 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
09:34:27.0970 0x1414 wcncsvc - ok
09:34:27.0986 0x1414 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
09:34:28.0033 0x1414 WcsPlugInService - ok
09:34:28.0048 0x1414 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
09:34:28.0111 0x1414 Wd - ok
09:34:28.0173 0x1414 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
09:34:28.0220 0x1414 Wdf01000 - ok
09:34:28.0251 0x1414 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost C:\Windows\system32\wdi.dll
09:34:28.0282 0x1414 WdiServiceHost - ok
09:34:28.0282 0x1414 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost C:\Windows\system32\wdi.dll
09:34:28.0298 0x1414 WdiSystemHost - ok
09:34:28.0345 0x1414 [ 4E89FC53493704BF835F0300DC201C34, FB3080725E144D93512DED81047D21C0582BC3412250EFF37E039108D7351F53 ] WebClient C:\Windows\System32\webclnt.dll
09:34:28.0360 0x1414 WebClient - ok
09:34:28.0376 0x1414 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
09:34:28.0423 0x1414 Wecsvc - ok
09:34:28.0454 0x1414 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
09:34:28.0485 0x1414 wercplsupport - ok
09:34:28.0501 0x1414 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
09:34:28.0532 0x1414 WerSvc - ok
09:34:28.0548 0x1414 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
09:34:28.0579 0x1414 WfpLwf - ok
09:34:28.0594 0x1414 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
09:34:28.0594 0x1414 WIMMount - ok
09:34:28.0626 0x1414 WinDefend - ok
09:34:28.0626 0x1414 WinHttpAutoProxySvc - ok
09:34:28.0688 0x1414 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
09:34:28.0735 0x1414 Winmgmt - ok
09:34:28.0860 0x1414 [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\Windows\system32\WsmSvc.dll
09:34:28.0938 0x1414 WinRM - ok
09:34:29.0000 0x1414 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
09:34:29.0047 0x1414 WinUsb - ok
09:34:29.0109 0x1414 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
09:34:29.0156 0x1414 Wlansvc - ok
09:34:29.0187 0x1414 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
09:34:29.0234 0x1414 WmiAcpi - ok
09:34:29.0265 0x1414 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
09:34:29.0281 0x1414 wmiApSrv - ok
09:34:29.0296 0x1414 WMPNetworkSvc - ok
09:34:29.0312 0x1414 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
09:34:29.0374 0x1414 WPCSvc - ok
09:34:29.0421 0x1414 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
09:34:29.0437 0x1414 WPDBusEnum - ok
09:34:29.0452 0x1414 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
09:34:29.0484 0x1414 ws2ifsl - ok
09:34:29.0499 0x1414 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\System32\wscsvc.dll
09:34:29.0515 0x1414 wscsvc - ok
09:34:29.0530 0x1414 WSearch - ok
09:34:29.0655 0x1414 [ 6075791ED85E47A2A2916B1F34582944, 25B5FAD161711875B38BDD014A26FA527C8EE4854D485989D19A72D5EBBA4054 ] wuauserv C:\Windows\system32\wuaueng.dll
09:34:29.0780 0x1414 wuauserv - ok
09:34:29.0827 0x1414 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
09:34:29.0874 0x1414 WudfPf - ok
09:34:29.0905 0x1414 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
09:34:29.0920 0x1414 WUDFRd - ok
09:34:29.0952 0x1414 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
09:34:29.0983 0x1414 wudfsvc - ok
09:34:30.0014 0x1414 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
09:34:30.0045 0x1414 WwanSvc - ok
09:34:30.0092 0x1414 [ 2EE48CFCE7CA8E0DB4C44C7476C0943B, 2C324592F3F2D50BABA7123B6F9FC922667CC132777E019FF615F2D6F273A45E ] xusb21 C:\Windows\system32\DRIVERS\xusb21.sys
09:34:30.0170 0x1414 xusb21 - ok
09:34:30.0186 0x1414 ================ Scan global ===============================
09:34:30.0217 0x1414 [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\Windows\system32\basesrv.dll
09:34:30.0264 0x1414 [ FF41063E45C6238CAF48CBE6D0D6FC4B, 9B755EA23E7D2554E3AC3ADFFC4AFF7EB4F4A0F5CD3E6F2300BC98B21474CBC6 ] C:\Windows\system32\winsrv.dll
09:34:30.0295 0x1414 [ FF41063E45C6238CAF48CBE6D0D6FC4B, 9B755EA23E7D2554E3AC3ADFFC4AFF7EB4F4A0F5CD3E6F2300BC98B21474CBC6 ] C:\Windows\system32\winsrv.dll
09:34:30.0342 0x1414 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
09:34:30.0373 0x1414 [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
09:34:30.0373 0x1414 [ Global ] - ok
09:34:30.0373 0x1414 ================ Scan MBR ==================================
09:34:30.0388 0x1414 [ 70E629B51C16B3C007730C6AE57144C9 ] \Device\Harddisk0\DR0
09:34:32.0214 0x1414 \Device\Harddisk0\DR0 - ok
09:34:32.0214 0x1414 ================ Scan VBR ==================================
09:34:32.0214 0x1414 [ CBB0435C5F331D2790BA0AA8EB48F9E5 ] \Device\Harddisk0\DR0\Partition1
09:34:32.0229 0x1414 \Device\Harddisk0\DR0\Partition1 - ok
09:34:32.0260 0x1414 [ D0983C6036C758C895FCC11F0476665F ] \Device\Harddisk0\DR0\Partition2
09:34:32.0260 0x1414 \Device\Harddisk0\DR0\Partition2 - ok
09:34:32.0260 0x1414 ================ Scan generic autorun ======================
09:34:32.0541 0x1414 [ 3E29E8CA08090F0CDE23247C8C74A542, D348415E0C9AE37F9C1017B9DA53C7F2FAE6FF6665F593A0686B9738C31CEAE3 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
09:34:32.0853 0x1414 RtHDVCpl - ok
09:34:32.0947 0x1414 [ 0540C38069CD5212B241E62AC1990201, DAAD37478187B62D27FCF2D2A979C76C8B465FF4F56215BE259D18EF3CBC9E73 ] C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe
09:34:32.0978 0x1414 Hotkey Utility - ok
09:34:33.0040 0x1414 [ D658AB1B55127D18DCFBCAC8CAAEA522, 9FB818F3899542CB7F1B979644423A66842D98D1762B1C38AE04AEE23320DA8E ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
09:34:33.0056 0x1414 HP Software Update - ok
09:34:33.0118 0x1414 [ 0133E5265FDD7063F87856C9BD5156C9, 27C0389B3FA0209C6B4D1A8A75AAD23525DD3B5DB7B0CD7358D1D6417818C8EF ] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
09:34:33.0181 0x1414 LifeCam - ok
09:34:33.0290 0x1414 [ 893B731FD112DF51F5CD095DAD622F16, 68BAF0342F0C8AC68CDA0F1EBE1AB5D65625EB545CF85DBB659AFD999C6D4335 ] C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
09:34:33.0337 0x1414 Reader Application Helper - ok
09:34:33.0430 0x1414 [ B89A82FB10E98F2FDF51FA82C7366DD3, 154A791E737A878965EB50EA879BC96857EF88602D94E169A75B1A6607E6018E ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
09:34:33.0477 0x1414 Adobe ARM - ok
09:34:33.0571 0x1414 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
09:34:33.0633 0x1414 Sidebar - ok
09:34:33.0649 0x1414 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
09:34:33.0664 0x1414 mctadmin - ok
09:34:33.0696 0x1414 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
09:34:33.0727 0x1414 Sidebar - ok
09:34:33.0742 0x1414 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
09:34:33.0758 0x1414 mctadmin - ok
09:34:33.0883 0x1414 [ B67322F9FF401846E56F3D719069270E, 312FE11F1C024DDD75F636B426E8BACDD1C57949F0171BCC2E6FB9EC9AE4B65A ] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
09:34:33.0961 0x1414 Rainlendar2 - detected UnsignedFile.Multi.Generic ( 1 )
09:34:36.0295 0x1414 Detect skipped due to KSN trusted
09:34:36.0295 0x1414 Rainlendar2 - ok
09:34:36.0424 0x1414 [ DC34596BFCF0BD472AA1D48449D8A7DF, B1A1AD8A72D585525CC4FEA4984EAD0AC0077640D2A4CF478BAA10BA3F08711A ] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
09:34:36.0517 0x1414 DAEMON Tools Lite - ok
09:34:36.0580 0x1414 [ AB3FF5AA877505B82C6F0B917CF5839B, 909006733CE97377AAD15D45C250054FCBB7A5942E28674E74373C213D2AC042 ] C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
09:34:36.0595 0x1414 phonostar-PlayerTimer - detected UnsignedFile.Multi.Generic ( 1 )
09:34:38.0444 0x1694 Object required for P2P: [ B89A82FB10E98F2FDF51FA82C7366DD3 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
09:34:38.0940 0x1414 Detect skipped due to KSN trusted
09:34:38.0940 0x1414 phonostar-PlayerTimer - ok
09:34:39.0034 0x1414 [ 7C6D524C78A1722AD987B9E47AC1FEE2, FFDC6C92ABB547D0DCD2621EC423C755A78079B061A41FA1751A56799D1A79A5 ] C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe
09:34:39.0065 0x1414 Dropbox Update - ok
09:34:39.0241 0x1414 [ 8B8E3CEECD3C9709D1E0DAB2E25565F7, C9ACD0669136667157AF433A96C0C00F771122CE4A3BA0D3924DD635C37BF5D0 ] C:\Program Files (x86)\Origin\Origin.exe
09:34:39.0366 0x1414 EADM - ok
09:34:39.0428 0x1414 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
09:34:39.0459 0x1414 Sidebar - ok
09:34:39.0475 0x1414 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
09:34:39.0490 0x1414 mctadmin - ok
09:34:39.0522 0x1414 [ 6E9DBF6B982AEA2EC6614F0B81AB2846, BEBD1E26E3C2810B19A71446A2CC5B9BD9436E802DD8CD0432DFC35BFF248593 ] C:\Program Files (x86)\eMachines\Screensaver\run_eMachines.exe
09:34:39.0609 0x1414 ScrSav - ok
09:34:39.0611 0x1414 Waiting for KSN requests completion. In queue: 11
09:34:40.0624 0x1414 Waiting for KSN requests completion. In queue: 11
09:34:40.0888 0x1694 Object send P2P result: true
09:34:41.0637 0x1414 Waiting for KSN requests completion. In queue: 4
09:34:42.0947 0x1414 AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\Antivirus\wsctool.exe ( 15.0.15.106 ), 0x41000 ( enabled : updated )
09:34:43.0025 0x1414 Win FW state via NFP2: enabled ( trusted )
09:34:45.0475 0x1414 ============================================================
09:34:45.0475 0x1414 Scan finished
09:34:45.0475 0x1414 ============================================================
09:34:45.0490 0x1284 Detected object count: 0
09:34:45.0490 0x1284 Actual detected object count: 0
Martin |
|
25.12.2015, 16:14
| #7 |
| /// TB-Ausbilder /// Anleitungs-Guru | Makrovirus in mail von "Berges Antriebstechnik"? Hallo Martin, diese Art von Makromalware lädt normalerweise "nur" andere Malware nach. Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Rootkit-Suche aktivieren: Schritt 2  
Schritt 3 ESET Online Scanner
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
25.12.2015, 21:22
| #8 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo Jürgen, hier nun zunächst die lod-Datei des adwcleaners: Code:
ATTFilter # AdwCleaner v5.026 - Bericht erstellt am 25/12/2015 um 17:24:20
# Aktualisiert am 21/12/2015 von Xplode
# Datenbank : 2015-12-23.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Martin Sudbrock - MARTINSUDBROCK
# Gestartet von : C:\Users\Martin Sudbrock\Desktop\Downloads\AdwCleaner_5.026.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
[-] Ordner Gelöscht : C:\Program Files\WinZip Driver Updater
[-] Ordner Gelöscht : C:\Program Files (x86)\Delta
[-] Ordner Gelöscht : C:\ProgramData\Ask
[-] Ordner Gelöscht : C:\ProgramData\Babylon
[-] Ordner Gelöscht : C:\ProgramData\Premium
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\Qtrax
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\YSearchUtil
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\LocalLow\Conduit
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\BabSolution
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\Babylon
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\digitalsite
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\dvdvideosoftiehelpers
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
[-] Ordner Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\130
[-] Ordner Gelöscht : C:\Users\Public\Documents\iWin
[-] Ordner Gelöscht : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil
***** [ Dateien ] *****
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.lyricsfreak.com_0.localstorage
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\local storage\hxxp_www.lyricsfreak.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_productivityboss.dl.myway.com_0.localstorage
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_productivityboss.dl.myway.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_productivityboss.dl.tb.ask.com_0.localstorage
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_productivityboss.dl.tb.ask.com_0.localstorage-journal
[-] Datei Gelöscht : C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\invalidprefs.js
[-] Datei Gelöscht : C:\Users\Public\Desktop\WinZip Driver Updater.lnk
***** [ DLLs ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
[-] Geplante Aufgabe Gelöscht : QtraxPlayer
[-] Geplante Aufgabe Gelöscht : Scheduled Update for Ask Toolbar
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduitapps.com
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities\Search\ask.com
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{915BB7D5-082E-3B91-B1E0-45B5FDE01F24}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}
[-] Schlüssel Gelöscht : HKCU\Software\f578dd0bd6fee42
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\f578dd0bd6fee42
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
[-] Schlüssel Gelöscht : HKCU\Software\Classes\CLSID\{32B29DF0-2237-4370-9A29-37CEBB730E9B}
[-] Schlüssel Gelöscht : HKCU\Software\Classes\CLSID\{66E8DCC7-97D2-4A89-8E08-D0610FF0878C}
[-] Schlüssel Gelöscht : HKCU\Software\Classes\CLSID\{A5812E8F-0E16-4C65-88F7-492D36174CB2}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DE27CF30-9C47-4FF7-AE8A-2C3DF0ABDE90}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{81CA8FCD-1420-4A07-B47D-B30F3DDA79E1}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
[-] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Schlüssel Gelöscht : HKCU\Software\Alexa Internet
[-] Schlüssel Gelöscht : HKCU\Software\BABSOLUTION
[-] Schlüssel Gelöscht : HKCU\Software\Delta
[-] Schlüssel Gelöscht : HKCU\Software\distromatic
[-] Schlüssel Gelöscht : HKCU\Software\qtrax
[-] Schlüssel Gelöscht : HKCU\Software\Softonic
[-] Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
[-] Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
[-] Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
[-] Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
[-] Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\lyrixeeker
[-] Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainerV2
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Delta
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet
[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B62A53F7-416C-44A4-B8C4-5CAB1F4F43C2}
[!] Schlüssel Nicht Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduitapps.com
***** [ Internetbrowser ] *****
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("CommunityToolbar.ConduitSearchList", "DVDVideoSoftTB Customized Web Search");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("browser.search.defaultthis.engineName", "DVDVideoSoftTB Customized Web Search");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("browser.search.param.yahoo-fr", "chr-greentree_ff&type=827316&ilc=12");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("browser.search.selectedEngine", "Delta Search");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.admin", false);
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.aflt", "babsst");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.autoRvrt", "false");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.dfltLng", "de");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.excTlbr", false);
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.id", "dac99c230000000000001078d272153b");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.instlDay", "15916");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.instlRef", "sst");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.newTab", false);
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.prdct", "delta");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.prtnrId", "delta");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.rvrt", "false");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.smplGrp", "none");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.tlbrId", "base");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.vrsn", "1.8.22.0");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.22.015:32:42");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta.vrsni", "1.8.22.0");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta_i.babExt", "");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=4959");
[-] [C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\prefs.js] [Preference] Gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
[-] [C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : fbdownloader_search
[-] [C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : npdicihegicnhaangkdmcgbjceoemeoo
*************************
:: "Tracing" Schlüssel gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Chrome Richtlinien gelöscht
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [15677 Bytes] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 25.12.2015 Suchlaufzeit: 17:32 Protokolldatei: mbam.txt Administrator: Ja Version: 2.2.0.1024 Malware-Datenbank: v2015.12.25.04 Rootkit-Datenbank: v2015.12.18.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Martin Sudbrock Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 409344 Abgelaufene Zeit: 41 Min., 50 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 2 PUP.Optional.Yontoo, C:\Users\Martin Sudbrock\Desktop\Downloads\FLVPlayer-Chrome (1).exe, In Quarantäne, [60e85653fb904de9b9f21da010f136ca], PUP.Optional.Yontoo, C:\Users\Martin Sudbrock\Desktop\Downloads\FLVPlayer-Chrome.exe, In Quarantäne, [c38553568efdf44244676f4e57aa6997], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=1e319b18f0901c4fb4d111041931fbe6
# end=init
# utc_time=2015-12-25 05:25:59
# local_time=2015-12-25 06:25:59 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 27357
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=1e319b18f0901c4fb4d111041931fbe6
# end=updated
# utc_time=2015-12-25 05:28:30
# local_time=2015-12-25 06:28:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=1e319b18f0901c4fb4d111041931fbe6
# engine=27357
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-12-25 08:13:28
# local_time=2015-12-25 09:13:28 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 441504 202704258 0 0
# scanned=368670
# found=20
# cleaned=0
# scan_time=9897
sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\FreeSoundRecorder\FreeSoundRecorderToolbarHelper.exe"
sh=F73DC75C88BB432464CE189EB0684C5973431F76 ft=1 fh=8ae662074c4d8368 vn="Variante von Win32/InstalleRex.U evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{62A7DAF2-DA4C-8E1D-6CF6-926EB944F804}\_Setupx.dll"
sh=F73DC75C88BB432464CE189EB0684C5973431F76 ft=1 fh=8ae662074c4d8368 vn="Variante von Win32/InstalleRex.U evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{62A7DAF2-DA4C-8E1D-6CF6-926EB944F804}\_Setupx.dll"
sh=D3CBDD7C6ED2C9D81DA4FCF9AF57CDD5D3711ED3 ft=1 fh=86dbe26399c3d0fa vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVPN7OBT\TBUpdaterLogic[1].dll"
sh=314F703F0F190BF70F0386509C10998D4E2BD10B ft=1 fh=2f9f46df1834d950 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXLBZVXX\TBUpdaterLogic[1].dll"
sh=1F55D8E2F8FC4E59BD273385B36F587A6339D154 ft=1 fh=cff91789842d382b vn="Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\hk64tbFre0.dll"
sh=37FDC039C02562267559D42D94DDB64B692FD091 ft=1 fh=7aeecd1bb81f6a22 vn="Variante von Win64/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\hk64tbFre2.dll"
sh=580C2639CC01D65EB0FCEB9DD82C837172F1685A ft=1 fh=1952ebb7aff3fa0f vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\hktbFre0.dll"
sh=A6D053127826CDA8DD8FCDBB4E81F63000910624 ft=1 fh=e8f05c501331b563 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\hktbFre2.dll"
sh=EBAFB2A15CAC7320C18180C08C710DDF26D2377D ft=1 fh=719e845c1b9128d3 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\ldrtbFre0.dll"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\ldrtbFree.dll"
sh=AA02280C86FEA8E28A4DFF9716B10A8A78000A4B ft=1 fh=4057356bf50aa26b vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\prxtbFre0.dll"
sh=7BBC831D6FFD6C5E502F77E8F9CEA30E3591B4D5 ft=1 fh=115fba91741456d3 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\tbFre0.dll"
sh=A7EBFC93E91E27D27C26D1E9483909E41F3A32FC ft=1 fh=ea857f061ec5d00e vn="Variante von Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\tbFre1.dll"
sh=7148AC44C7FE0CB8D30A12ACB28171AE1F609C20 ft=1 fh=779162af1796b620 vn="Variante von Win32/Toolbar.Conduit.X evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\tbFre2.dll"
sh=3E30150D840AC9A0C0A7969D2FFD45118BE827D6 ft=1 fh=afbdb7c39edb934a vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\tbFree.dll"
sh=B5C93DA0C608B26C9487ABC49CCB643C9A15ED33 ft=1 fh=75f1c65aa8a331ed vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll"
sh=A981E3D6F03D3BD57D1472F33A4093A01533F8A8 ft=1 fh=7aaf7b3d0491af48 vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Martin Sudbrock\Documents\Downloads\wzmp_8.exe"
sh=FF273D0017363755214FA5CD888C2C2D54721700 ft=1 fh=0089eae0191970f8 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll"
sh=A70EFAB5F2D2D83AD2B7E0304169C73F6D0EC700 ft=1 fh=011924ad9c4ebdbf vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"
Gruß Martin |
|
26.12.2015, 17:16
| #9 |
| /// TB-Ausbilder /// Anleitungs-Guru | Makrovirus in mail von "Berges Antriebstechnik"? Aber keine Malware. Löschen dann später das Zeug. Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
26.12.2015, 18:58
| #10 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo, nein, derzeit gibt es keine Probleme mit dem PC. Läuft alles einwandfrei. Gruß Martin |
|
27.12.2015, 12:46
| #11 |
| /// TB-Ausbilder /// Anleitungs-Guru | Makrovirus in mail von "Berges Antriebstechnik"? Gut dann bitte nochmal frische FRST-Logs. Schritt 1 Bitte starte FRST erneut, markiere auch die checkbox  und drücke auf Untersuchen. Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
27.12.2015, 13:54
| #12 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo, anbei die beiden logfiles: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-12-2015 durchgeführt von Martin Sudbrock (Administrator) auf MARTINSUDBROCK (27-12-2015 13:50:07) Gestartet von C:\Users\Martin Sudbrock\Desktop Geladene Profile: Martin Sudbrock & (Verfügbare Profile: Martin Sudbrock & UpdatusUser) Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Chrome) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe () C:\Windows\Installer\MSI2D4A.tmp (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe () C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe (Dropbox, Inc.) C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Acer Group) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Sony Corporation) C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Dropbox, Inc.) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10806816 2010-04-30] (Realtek Semiconductor) HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe [611872 2010-08-04] () HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [Reader Application Helper] => C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2014-10-24] (Sony Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1067736 2015-10-28] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-12-08] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [803200 2015-12-03] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2433024 2011-08-12] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [phonostar-PlayerTimer] => C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [43008 2015-10-15] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [Dropbox Update] => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3639280 2015-12-20] (Electronic Arts) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\MountPoints2: {68166438-66a3-11e5-bdb5-1078d272153b} - E:\OnePlus_setup.exe /s HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\MountPoints2: {6fce6da9-291a-11e5-946d-1078d272153b} - E:\LaunchU3.exe -a HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2433024 2011-08-12] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [phonostar-PlayerTimer] => C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe [43008 2015-10-15] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Dropbox Update] => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3639280 2015-12-20] (Electronic Arts) HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {68166438-66a3-11e5-bdb5-1078d272153b} - E:\OnePlus_setup.exe /s HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {6fce6da9-291a-11e5-946d-1078d272153b} - E:\LaunchU3.exe -a HKU\S-1-5-21-1418818919-2476079493-1430080804-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [ScrSav] => C:\Program Files (x86)\eMachines\Screensaver\run_eMachines.exe [154144 2010-07-29] () HKU\S-1-5-21-1418818919-2476079493-1430080804-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\eMachines.scr [456224 2010-07-29] () ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-12-08] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-22] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-22] ShortcutTarget: Dropbox.lnk -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2015-12-22] ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{C6A3E703-E7F6-46DF-B206-0338AC0FCE10}: [DhcpNameServer] 192.168.178.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net/#web/result?source=art&q= HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net/#web/result?source=art&q= SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {72952258-72F6-4AD8-B6CA-DBBAFE179B93} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL = SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {72952258-72F6-4AD8-B6CA-DBBAFE179B93} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2012-11-22] (pdfforge GbR) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-25] (Oracle Corporation) BHO-x32: MimalaAmazonToolbar.ShowToolbarBHO -> {86a3cdaa-9b25-480e-b73f-c2d359b87966} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-25] (Oracle Corporation) Toolbar: HKLM-x32 - Mimala Amazon Toolbar - {691ca8ec-7205-4aa9-bdd6-15493d16f835} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation) Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default FF DefaultSearchEngine: Yahoo Web FF SearchEngineOrder.1: FF Homepage: hxxps://de.yahoo.com/?type=orcl_hpset FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll [2015-08-08] () FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll [2015-08-08] () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-25] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-25] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation) FF Plugin-x32: @sony.com/ReaderDesktop -> C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll [2014-10-24] (Sony Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\8\NP_wtapp.dll [2014-05-03] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1418818919-2476079493-1430080804-1000: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll [2015-10-15] ( ) FF Plugin HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll [2015-10-15] ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\searchplugins\yahoo-ysp.xml [2015-11-25] FF Extension: Toolbar für amazon.de - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\0001.amztoolbar@minimalarts.de [2013-05-27] [ist nicht signiert] FF Extension: LyricXeeker - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\128 [2013-08-16] [ist nicht signiert] FF Extension: Avira Browser Safety - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\abs@avira.com [2015-12-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-06-19] [ist nicht signiert] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-06-19] [ist nicht signiert] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-01] [ist nicht signiert] Chrome: ======= CHR DefaultSearchURL: Default -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default CHR DefaultSearchKeyword: Default -> Yahoo CHR DefaultSuggestURL: Default -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10 CHR Profile: C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04] CHR Extension: (Google Docs) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04] CHR Extension: (Google Drive) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21] CHR Extension: (YouTube) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Google Tabellen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04] CHR Extension: (Avira Browserschutz) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-12-15] CHR Extension: (Google Docs Offline) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28] CHR Extension: (Yahoo Web) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\npdicihegicnhaangkdmcgbjceoemeoo [2015-12-25] CHR Extension: (Google Mail) - C:\Users\Martin Sudbrock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [npdicihegicnhaangkdmcgbjceoemeoo] - hxxps://clients2.google.com/service/update2/crx ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [948392 2015-12-03] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [466408 2015-12-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [466408 2015-12-03] (Avira Operations GmbH & Co. KG) R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [251160 2015-12-08] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [506288 2011-02-08] (REINER SCT) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) R2 GREGService; C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) R2 IBYKUS AG: ELSA-Suite update permissions manager. 32063.; C:\Windows\Installer\MSI2D4A.tmp [675840 2015-01-20] () [Datei ist nicht signiert] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2015-12-20] (Electronic Arts) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2014-04-25] (Sony Corporation) [Datei ist nicht signiert] R2 StarMoney 7.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [554160 2011-11-08] (Star Finanz - Software Entwicklung und Vertriebs GmbH) R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH) R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH) R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 acedrv10; C:\Windows\system32\drivers\acedrv10.sys [277904 2011-06-23] (Protect Software GmbH) R2 acehlp10; C:\Windows\system32\drivers\acehlp10.sys [228000 2011-06-23] (Protect Software GmbH) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2011-08-14] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162072 2015-12-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [140448 2015-12-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-12-03] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [75472 2015-12-03] (Avira Operations GmbH & Co. KG) R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2010-11-27] (REINER SCT) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-07-09] (DT Soft Ltd) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2011-08-14] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-27] (Malwarebytes) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation) S2 AVMPORT; \SystemRoot\System32\drivers\avmport.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-27 13:49 - 2015-12-23 21:11 - 02370560 _____ (Farbar) C:\Users\Martin Sudbrock\Desktop\FRST64.exe 2015-12-26 17:53 - 2015-12-26 23:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2015-12-25 18:21 - 2015-12-25 18:21 - 00001452 _____ C:\Users\Martin Sudbrock\Desktop\mbam.txt 2015-12-25 18:19 - 2015-12-25 18:19 - 00015820 _____ C:\Users\Martin Sudbrock\Desktop\AdwCleaner[C1].txt 2015-12-25 17:19 - 2015-12-25 17:24 - 00000000 ____D C:\AdwCleaner 2015-12-25 09:09 - 2015-12-25 09:40 - 00208206 _____ C:\TDSSKiller.3.1.0.9_25.12.2015_09.09.14_log.txt 2015-12-25 09:08 - 2015-12-25 09:08 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Martin Sudbrock\Desktop\tdsskiller.exe 2015-12-23 21:40 - 2015-12-23 21:40 - 00062391 _____ C:\Users\Martin Sudbrock\Desktop\Addition.txt 2015-12-23 21:39 - 2015-12-27 13:50 - 00029732 _____ C:\Users\Martin Sudbrock\Desktop\FRST.txt 2015-12-23 21:12 - 2015-12-27 13:50 - 00000000 ____D C:\FRST 2015-12-23 21:07 - 2015-12-23 21:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-12-23 21:04 - 2015-12-23 21:07 - 00000322 _____ C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000322 _____ C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock at logon.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000296 _____ C:\Windows\Tasks\Start WinZip Driver Updater for MartinSudbrock@Martin Sudbrock(logon).job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000286 _____ C:\Windows\Tasks\Start WinZip Driver Updater Update.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000280 _____ C:\Windows\Tasks\Start WinZip Driver Updater Schedule.job 2015-12-23 21:04 - 2015-12-23 21:07 - 00000000 ____D C:\ProgramData\WinZip 2015-12-23 16:19 - 2015-12-23 16:42 - 00000000 ____D C:\Users\Martin Sudbrock\Desktop\logfiles Virenscan 2015-12-22 22:52 - 2015-12-22 22:52 - 00000000 ____D C:\ubuntu 2015-12-22 16:58 - 2015-12-27 11:45 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-12-22 16:58 - 2015-12-22 21:33 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-12-22 16:58 - 2015-12-22 16:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-12-22 16:57 - 2015-12-22 16:58 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-12-22 16:57 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-12-22 16:57 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-12-22 16:57 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2015-12-21 19:38 - 2015-12-21 19:38 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Avira 2015-12-21 19:35 - 2015-12-03 15:24 - 00162072 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00140448 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00075472 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-12-21 19:35 - 2015-12-03 15:24 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-12-17 17:36 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2015-12-17 17:36 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2015-12-17 17:36 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll 2015-12-17 17:35 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll 2015-12-17 17:35 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll 2015-12-17 17:35 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll 2015-12-17 17:35 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll 2015-12-17 17:35 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll 2015-12-17 17:35 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll 2015-12-17 17:35 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll 2015-12-17 17:34 - 2015-12-17 17:36 - 00000000 ____D C:\Windows\SysWOW64\directx 2015-12-17 17:34 - 2015-12-17 17:35 - 00000000 ___HD C:\Windows\msdownld.tmp 2015-12-17 17:34 - 2015-12-17 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks 2015-12-17 17:34 - 2015-12-17 17:34 - 00000000 ____D C:\Games 2015-12-16 08:05 - 2015-12-16 08:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2015-12-11 21:17 - 2015-12-11 21:17 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-12-09 21:52 - 2015-12-09 21:52 - 00377817 _____ C:\Users\Martin Sudbrock\Documents\Scan0005.pdf 2015-12-08 22:20 - 2015-11-20 19:54 - 03170304 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00709632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-12-08 22:20 - 2015-11-20 19:54 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-12-08 22:20 - 2015-11-20 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-12-08 22:20 - 2015-11-20 19:54 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-12-08 22:20 - 2015-11-20 19:34 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-12-08 22:20 - 2015-11-20 19:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-12-08 22:20 - 2015-11-10 19:55 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-12-08 22:20 - 2015-11-10 19:55 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-12-08 22:20 - 2015-11-10 19:55 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll 2015-12-08 22:20 - 2015-11-10 19:39 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-12-08 22:20 - 2015-11-10 19:37 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll 2015-12-08 22:20 - 2015-11-10 18:47 - 03211264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-12-08 22:20 - 2015-11-05 20:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll 2015-12-08 22:20 - 2015-11-05 20:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshrm.dll 2015-12-08 22:20 - 2015-11-05 20:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2015-12-08 22:20 - 2015-11-05 20:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2015-12-08 22:20 - 2015-11-05 10:53 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys 2015-12-08 22:20 - 2015-11-03 20:04 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2015-12-08 22:20 - 2015-11-03 19:56 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2015-12-08 22:20 - 2015-10-09 00:22 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZE.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL 2015-12-08 22:20 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdgeoqw.dll 2015-12-08 22:20 - 2015-10-09 00:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDAZEL.DLL 2015-12-08 22:20 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll 2015-12-08 22:20 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\SysWOW64\locale.nls 2015-12-08 22:20 - 2015-10-08 19:52 - 00419928 _____ C:\Windows\system32\locale.nls 2015-12-08 22:19 - 2015-11-11 22:12 - 00387792 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-12-08 22:19 - 2015-11-11 21:52 - 00341192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-12-08 22:19 - 2015-11-11 19:53 - 01735680 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll 2015-12-08 22:19 - 2015-11-11 19:53 - 00525312 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll 2015-12-08 22:19 - 2015-11-11 19:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll 2015-12-08 22:19 - 2015-11-11 19:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll 2015-12-08 22:19 - 2015-11-11 17:21 - 25837568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-12-08 22:19 - 2015-11-11 17:00 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-12-08 22:19 - 2015-11-11 16:44 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-12-08 22:19 - 2015-11-11 16:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-12-08 22:19 - 2015-11-11 16:41 - 20366848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-12-08 22:19 - 2015-11-11 16:12 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-12-08 22:19 - 2015-11-11 15:57 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-12-08 22:19 - 2015-11-10 01:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-12-08 22:19 - 2015-11-10 01:13 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-12-08 22:19 - 2015-11-10 01:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-12-08 22:19 - 2015-11-10 01:12 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-12-08 22:19 - 2015-11-10 01:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-12-08 22:19 - 2015-11-10 01:11 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-12-08 22:19 - 2015-11-10 01:08 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-12-08 22:19 - 2015-11-10 01:06 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-12-08 22:19 - 2015-11-10 01:06 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-12-08 22:19 - 2015-11-10 01:04 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-12-08 22:19 - 2015-11-10 01:03 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-12-08 22:19 - 2015-11-10 01:02 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-12-08 22:19 - 2015-11-10 01:02 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-12-08 22:19 - 2015-11-10 00:50 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-12-08 22:19 - 2015-11-10 00:47 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-12-08 22:19 - 2015-11-10 00:46 - 04514816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-12-08 22:19 - 2015-11-10 00:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2015-12-08 22:19 - 2015-11-10 00:37 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-12-08 22:19 - 2015-11-10 00:36 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-12-08 22:19 - 2015-11-10 00:36 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-12-08 22:19 - 2015-11-10 00:35 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-12-08 22:19 - 2015-11-10 00:17 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-12-08 22:19 - 2015-11-10 00:14 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-12-08 22:19 - 2015-11-10 00:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-12-08 22:19 - 2015-11-08 23:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-12-08 22:19 - 2015-11-08 23:32 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-12-08 22:19 - 2015-11-08 23:16 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 02887168 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 00571392 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-12-08 22:19 - 2015-11-08 23:15 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-12-08 22:19 - 2015-11-08 23:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-12-08 22:19 - 2015-11-08 23:14 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-12-08 22:19 - 2015-11-08 23:07 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-12-08 22:19 - 2015-11-08 23:06 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-12-08 22:19 - 2015-11-08 23:04 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-12-08 22:19 - 2015-11-08 23:02 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-12-08 22:19 - 2015-11-08 23:01 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-12-08 22:19 - 2015-11-08 23:01 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-12-08 22:19 - 2015-11-08 22:52 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-12-08 22:19 - 2015-11-08 22:48 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-12-08 22:19 - 2015-11-08 22:40 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-12-08 22:19 - 2015-11-08 22:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-12-08 22:19 - 2015-11-08 22:32 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-12-08 22:19 - 2015-11-08 22:29 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2015-12-08 22:19 - 2015-11-08 22:18 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-12-08 22:19 - 2015-11-08 22:15 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-12-08 22:19 - 2015-11-08 22:15 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-12-08 22:19 - 2015-11-08 22:14 - 14456832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-12-08 22:19 - 2015-11-08 22:14 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-12-08 22:19 - 2015-11-08 22:13 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-12-08 22:19 - 2015-11-08 21:53 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-12-08 22:19 - 2015-11-08 21:41 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-12-08 22:19 - 2015-11-08 21:30 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-12-08 22:19 - 2015-11-03 20:04 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\els.dll 2015-12-08 22:19 - 2015-11-03 19:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\els.dll 2015-12-03 16:05 - 2015-12-03 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-12-02 08:29 - 2015-12-02 08:29 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12cd32399d857.job 2015-11-28 19:02 - 2015-11-28 19:02 - 00000000 ____D C:\Program Files (x86)\Origin Games 2015-11-28 18:49 - 2015-11-28 19:21 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Origin 2015-11-28 18:49 - 2015-11-28 19:02 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\Origin 2015-11-28 18:46 - 2015-12-27 12:27 - 00000000 ____D C:\ProgramData\Origin 2015-11-28 18:46 - 2015-11-28 18:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin 2015-11-28 18:44 - 2015-12-20 11:39 - 00000000 ____D C:\Program Files (x86)\Origin 2015-11-27 16:13 - 2015-11-27 16:13 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\FIFA 12 ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-12-27 11:52 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-12-27 11:52 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-12-27 11:44 - 2014-06-17 21:52 - 00000000 ___RD C:\Users\Martin Sudbrock\Dropbox 2015-12-27 11:44 - 2011-06-19 09:29 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox 2015-12-27 11:43 - 2011-09-03 16:58 - 00000000 ____D C:\Users\Martin Sudbrock\.rainlendar2 2015-12-27 11:42 - 2012-05-04 07:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-12-27 11:42 - 2010-10-14 06:50 - 00000000 ____D C:\ProgramData\NVIDIA 2015-12-25 18:16 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\security 2015-12-25 17:24 - 2011-02-05 17:11 - 00000000 ____D C:\Users\Martin Sudbrock 2015-12-24 14:57 - 2013-11-01 18:52 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0 2015-12-23 21:16 - 2007-07-12 02:48 - 00000000 ____D C:\Windows 2015-12-23 14:25 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Lebendiger Adventskalender 2015-12-22 21:33 - 2015-11-26 20:40 - 00002181 _____ C:\Users\Public\Desktop\UEFA EURO 2012.lnk 2015-12-22 21:33 - 2015-09-02 18:57 - 00001191 _____ C:\Users\Public\Desktop\Avira Launcher.lnk 2015-12-22 21:33 - 2015-08-10 18:35 - 00002153 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk 2015-12-22 21:33 - 2015-04-04 11:23 - 00001575 _____ C:\Users\Public\Desktop\Digitale Antragstellung 2015.lnk 2015-12-22 21:33 - 2014-11-17 21:32 - 00002178 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-12-22 21:33 - 2014-11-17 21:15 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-12-22 21:33 - 2014-11-17 20:46 - 00002022 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2015-12-22 21:33 - 2014-11-05 08:05 - 00001971 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2015-12-22 21:33 - 2014-03-23 13:41 - 00002176 _____ C:\Users\Public\Desktop\Meine Tierklinik.lnk 2015-12-22 21:33 - 2013-11-01 18:55 - 00002045 _____ C:\Users\Public\Desktop\StarMoney 9.0.lnk 2015-12-22 21:33 - 2013-03-07 17:37 - 00001038 _____ C:\Users\Public\Desktop\PDFCreator.lnk 2015-12-22 21:33 - 2013-03-06 18:52 - 00002068 _____ C:\Users\Public\Desktop\Reader for PC.lnk 2015-12-22 21:33 - 2012-10-14 13:09 - 00001230 _____ C:\Users\Public\Desktop\Rossmann Fotowelt Software.lnk 2015-12-22 21:33 - 2012-07-09 17:21 - 00001957 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk 2015-12-22 21:33 - 2012-04-29 16:52 - 00001073 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-12-22 21:33 - 2012-03-18 13:00 - 00002044 _____ C:\Users\Public\Desktop\Microsoft LifeCam.lnk 2015-12-22 21:33 - 2012-03-14 18:01 - 00002693 _____ C:\Users\Public\Desktop\Skype.lnk 2015-12-22 21:33 - 2011-11-19 18:58 - 00000960 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00002227 _____ C:\Users\Public\Desktop\HP Officejet Pro 8500 A910.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00001890 _____ C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet Pro 8500 A910.lnk 2015-12-22 21:33 - 2011-11-19 18:57 - 00001227 _____ C:\Users\Public\Desktop\HP Officejet Pro 8500 A910 Scan.lnk 2015-12-22 21:33 - 2011-09-03 16:58 - 00001940 _____ C:\Users\Public\Desktop\Rainlendar2.lnk 2015-12-22 21:33 - 2011-09-03 16:12 - 00001216 _____ C:\Users\Public\Desktop\ElsterFormular.lnk 2015-12-22 21:33 - 2011-07-26 18:40 - 00002099 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk 2015-12-22 21:33 - 2011-05-22 17:38 - 00001142 _____ C:\Users\Public\Desktop\cyberJack Gerätemanager, Funktionstest.lnk 2015-12-22 21:33 - 2011-05-14 17:25 - 00001840 _____ C:\Users\Public\Desktop\ELSA-agrar.lnk 2015-12-22 21:33 - 2011-04-10 13:33 - 00001147 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-12-22 21:33 - 2011-04-10 13:33 - 00001141 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-12-22 21:33 - 2010-09-10 12:23 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk 2015-12-22 21:33 - 2010-09-10 12:23 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk 2015-12-22 21:33 - 2009-07-14 05:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk 2015-12-22 21:33 - 2009-07-14 05:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk 2015-12-22 21:32 - 2014-06-17 21:52 - 00001049 _____ C:\Users\Martin Sudbrock\Desktop\Dropbox.lnk 2015-12-22 21:32 - 2013-08-02 12:56 - 00001161 _____ C:\Users\Martin Sudbrock\Desktop\Continue Zip Opener Installation.lnk 2015-12-22 21:32 - 2013-07-29 14:08 - 00001296 _____ C:\Users\Martin Sudbrock\Desktop\Landwirtschafts Simulator 2013.lnk 2015-12-22 21:32 - 2012-12-01 15:04 - 00001006 _____ C:\Users\Martin Sudbrock\Desktop\PDF Architect.lnk 2015-12-22 21:32 - 2012-11-16 18:35 - 00001081 _____ C:\Users\Martin Sudbrock\Desktop\phonostar-Player.lnk 2015-12-22 21:32 - 2012-03-15 19:20 - 00001142 _____ C:\Users\Martin Sudbrock\Desktop\Free Sound Recorder.lnk 2015-12-22 21:32 - 2012-02-12 20:33 - 00013017 _____ C:\Users\Martin Sudbrock\Desktop\Avira AntiVir Personal - Verknüpfung.lnk 2015-12-22 21:32 - 2011-08-14 11:55 - 00000640 _____ C:\Users\Martin Sudbrock\Desktop\Anno 1404 - Verknüpfung.lnk 2015-12-22 21:32 - 2011-05-02 10:43 - 00001908 _____ C:\Users\Martin Sudbrock\Desktop\Kamerabilder - Verknüpfung.lnk 2015-12-22 21:32 - 2011-04-21 16:35 - 00007271 _____ C:\Users\Martin Sudbrock\Desktop\Zählerstande_aktuell - Verknüpfung.lnk 2015-12-22 21:32 - 2011-02-05 17:13 - 00001434 _____ C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-12-22 21:32 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk 2015-12-22 21:32 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk 2015-12-22 21:27 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\addins 2015-12-22 19:32 - 2010-09-28 20:26 - 00699432 _____ C:\Windows\system32\perfh007.dat 2015-12-22 19:32 - 2010-09-28 20:26 - 00149572 _____ C:\Windows\system32\perfc007.dat 2015-12-22 19:32 - 2009-07-14 06:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI 2015-12-22 19:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2015-12-22 18:16 - 2012-07-31 18:32 - 00000000 ____D C:\Program Files (x86)\Electronic Arts 2015-12-22 18:05 - 2011-05-28 22:51 - 00000000 ____D C:\Tivola 2015-12-22 18:04 - 2015-11-22 19:07 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2015-12-22 18:03 - 2012-03-15 19:21 - 00000000 ____D C:\Program Files (x86)\FreeSoundRecorder 2015-12-22 16:57 - 2014-03-23 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-12-21 20:05 - 2013-03-16 14:18 - 00121856 ___SH C:\Users\Martin Sudbrock\Documents\Thumbs.db 2015-12-21 19:39 - 2013-02-23 10:31 - 00000000 ____D C:\Program Files (x86)\Avira 2015-12-21 19:37 - 2015-07-06 08:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-12-21 19:35 - 2012-11-03 08:44 - 00000000 ____D C:\ProgramData\Avira 2015-12-21 19:34 - 2014-08-07 13:19 - 00000000 ____D C:\ProgramData\Package Cache 2015-12-21 09:06 - 2012-04-29 16:52 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\vlc 2015-12-20 19:58 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Landwirtschaft 2015-12-20 15:53 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Photovoltaik_Alfred 2015-12-20 15:45 - 2015-04-04 11:23 - 00000000 ____D C:\DigitaleAntragstellung2015 2015-12-19 20:01 - 2011-04-10 20:45 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\CrashDumps 2015-12-19 01:15 - 2014-01-29 22:30 - 01594028 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2015-12-19 01:13 - 2015-04-04 20:10 - 00000000 ___SD C:\Windows\SysWOW64\GWX 2015-12-19 01:13 - 2015-04-04 20:10 - 00000000 ___SD C:\Windows\system32\GWX 2015-12-17 16:33 - 2011-04-07 20:23 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Bewerbung Sophia 2015-12-16 22:21 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Trachtenkapelle Großentaft 2015-12-16 16:27 - 2011-04-07 20:35 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\CDU-Ortsverband Großentaft 2015-12-16 08:05 - 2015-11-18 08:08 - 00000000 ____D C:\Program Files\McAfee Security Scan 2015-12-15 20:08 - 2013-02-18 14:41 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Josephine 2015-12-14 21:27 - 2015-08-07 10:14 - 00000298 ____H C:\Windows\Tasks\Microsoft_Hardware_Launch_IcePick_exe.job 2015-12-13 23:29 - 2012-03-14 18:01 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Roaming\Skype 2015-12-09 15:26 - 2009-07-14 05:45 - 00413464 _____ C:\Windows\system32\FNTCACHE.DAT 2015-12-08 22:59 - 2011-04-09 20:10 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-12-08 22:58 - 2012-05-18 18:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-12-08 22:57 - 2012-05-18 18:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2015-12-08 22:57 - 2012-05-18 18:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2015-12-08 22:55 - 2013-08-14 21:23 - 00000000 ____D C:\Windows\system32\MRT 2015-12-08 22:45 - 2011-04-13 13:36 - 140158008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-12-03 16:05 - 2012-03-14 18:01 - 00000000 ___RD C:\Program Files (x86)\Skype 2015-12-03 16:05 - 2012-03-14 18:01 - 00000000 ____D C:\ProgramData\Skype 2015-12-02 13:18 - 2011-04-09 17:50 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-12-02 08:29 - 2015-09-15 13:41 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0efb3d6202b56.job 2015-11-30 18:44 - 2012-03-12 17:17 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Michel 2015-11-29 11:04 - 2014-08-02 12:00 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\Sparkasse 2015-11-28 18:46 - 2011-06-25 07:22 - 00003702 _____ C:\Windows\wininit.ini 2015-11-28 15:12 - 2015-11-22 19:07 - 00000000 ____D C:\Users\Martin Sudbrock\Documents\GTA San Andreas User Files 2015-11-27 16:11 - 2011-02-05 17:11 - 00000000 ____D C:\Users\Martin Sudbrock\AppData\Local\VirtualStore ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-07-16 02:35 - 2015-07-16 02:35 - 6420480 _____ () C:\Program Files (x86)\GUTD7FE.tmp 2013-07-30 15:31 - 2013-09-05 14:19 - 0000077 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\WB.CFG 2013-07-30 15:31 - 2013-09-05 14:19 - 0000005 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\WBPU-TTL.DAT 2012-05-07 18:22 - 2012-05-07 18:22 - 0003584 _____ () C:\Users\Martin Sudbrock\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini Dateien, die verschoben oder gelöscht werden sollten: ==================== C:\Users\Public\AlexaNSISPlugin.852.dll Einige Dateien in TEMP: ==================== C:\Users\Martin Sudbrock\AppData\Local\Temp\AskSLib.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\AutoRunGUI.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\avgnt.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\drm_dialogs.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\drm_dyndata_7270006.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsdyf3x.dll C:\Users\Martin Sudbrock\AppData\Local\Temp\eauninstall.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\Need for Speed Most Wanted_uninst.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl2E31.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl3330.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl5994.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pyl9C0F.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pylBD17.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\pylD77A.tmp.exe C:\Users\Martin Sudbrock\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\Windows\system32\winlogon.exe => Datei ist digital signiert C:\Windows\system32\wininit.exe => Datei ist digital signiert C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert C:\Windows\explorer.exe => Datei ist digital signiert C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert C:\Windows\system32\svchost.exe => Datei ist digital signiert C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert C:\Windows\system32\services.exe => Datei ist digital signiert C:\Windows\system32\User32.dll => Datei ist digital signiert C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert C:\Windows\system32\userinit.exe => Datei ist digital signiert C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert C:\Windows\system32\rpcss.dll => Datei ist digital signiert C:\Windows\system32\dnsapi.dll => Datei ist digital signiert C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2013-09-02 15:55 ==================== Ende von FRST.txt ============================ |
|
27.12.2015, 13:56
| #13 |
| | Makrovirus in mail von "Berges Antriebstechnik"?Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-12-2015
durchgeführt von Martin Sudbrock (2015-12-27 13:51:09)
Gestartet von C:\Users\Martin Sudbrock\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-02-05 16:11:30)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1418818919-2476079493-1430080804-500 - Administrator - Disabled)
Gast (S-1-5-21-1418818919-2476079493-1430080804-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1418818919-2476079493-1430080804-1002 - Limited - Enabled)
Martin Sudbrock (S-1-5-21-1418818919-2476079493-1430080804-1000 - Administrator - Enabled) => C:\Users\Martin Sudbrock
UpdatusUser (S-1-5-21-1418818919-2476079493-1430080804-1003 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.117 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.95 - WildTangent) Hidden
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.02.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.15.129 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{eac7da46-2097-4dd4-80a6-8b67cbb2b23f}) (Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.53.13962 - Avira Operations GmbH & Co. KG) Hidden
AVM ISDN CAPI Port (HKLM-x32\...\AVM ISDN CAPI Port) (Version: - )
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.9.10 - REINER SCT)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0314 - DT Soft Ltd)
Die Siedler II - Die nächste Generation (HKLM-x32\...\S2TNG) (Version: - )
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dropbox (HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
ELSA-Suite (HKLM-x32\...\{5AD7FA06-9EF6-4373-957E-B2EA165B2EAA}) (Version: 10.0 - IBYKUS Software GmbH & Co. KG)
ElsterFormular-Upgrade (HKLM-x32\...\ElsterFormular für Unternehmer 12.3.2.6814u) (Version: 16.2.17437 - Landesfinanzdirektion Thüringen)
eMachines Games (HKLM-x32\...\WildTangent emachines Master Uninstall) (Version: 1.0.2.5 - WildTangent)
eMachines Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)
eMachines Registration (HKLM-x32\...\eMachines Registration) (Version: 1.03.3003 - Acer Incorporated)
eMachines ScreenSaver (HKLM-x32\...\eMachines Screensaver) (Version: 1.1.0825.2010 - Acer Incorporated)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
FreeSoundRecorder Toolbar (HKLM-x32\...\FreeSoundRecorder Toolbar) (Version: 6.8.5.1 - FreeSoundRecorder) <==== ACHTUNG
FRITZ! (HKLM-x32\...\FRITZ! 2.0) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 2.05.3009 - Acer Incorporated)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (HKLM\...\{E0FE1E14-3A7A-4DB0-9FFA-0DD945AE84DB}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (HKLM-x32\...\{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Madagascar (HKLM-x32\...\InstallShield_{0FB261F3-6F16-43FD-A404-F377C169B937}) (Version: 1.00.0000 - Activision)
Madagascar (TM) (x32 Version: 1.00.0000 - Activision) Hidden
Mah Jong Quest (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Marketsplash Schnellzugriffe (HKLM-x32\...\{7A108EBC-C9DF-4E14-93A8-42CF316F1ECF}) (Version: 1.0.1.7 - Hewlett-Packard)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.266.3 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
minimal arts - Toolbar für amazon.de (HKLM-x32\...\{37D290AF-6602-4C22-9AF8-66CB7231C729}) (Version: 1.0.0 - minimal arts UG (haftungsbeschränkt))
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 38.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.5.0 (x86 de)) (Version: 38.5.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{0d106b0b-aa4a-453d-88d8-312b4046b4d1}) (Version: - Nero AG)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9793 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.61.39 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}) (Version: 9.10.0223 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.10.2.4863 - Electronic Arts, Inc.)
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
ProtectDisc Helper Driver 10 (HKLM-x32\...\ProtectDisc Driver 10) (Version: 10.0.0.3 - )
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
Reader for PC (HKLM-x32\...\{D279DFB7-97A3-439D-8BE9-95D8AFA68562}) (Version: 2.4.01.10241 - Sony Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6101 - Realtek Semiconductor Corp.)
Rossmann Fotowelt Software 4.12.1 (HKLM-x32\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Secret of the Magic Crystals (x32 Version: 2.2.0.97 - WildTangent) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.15 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.15.103 - Skype Technologies S.A.)
Spielkanäle (x32 Version: 3.1.0.10 - WildTangent, Inc.) Hidden
StarMoney (x32 Version: 2.0 - StarFinanz) Hidden
StarMoney (x32 Version: 3.0.0.124 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 7.0 (HKLM-x32\...\{31777559-E7A1-461D-A9A1-B98C5226F0D3}) (Version: 7.0 - Star Finanz GmbH)
StarMoney 8.0 S-Edition (HKLM-x32\...\{F94EB2F5-7D75-4D0D-8B3A-B13140B5E978}) (Version: 8.0 - Star Finanz GmbH)
StarMoney 9.0 (HKLM-x32\...\{982F7E88-DDDF-46E2-B8D6-74AB86362F32}) (Version: 9.0 - Star Finanz GmbH)
Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (HKLM\...\{D7B11BA7-15D3-4E84-8974-20258D4A1701}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
Ubuntu (HKLM-x32\...\Wubi) (Version: 12.04-rev272 - Ubuntu)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
VLC media player 2.0.1 (HKLM-x32\...\VLC media player) (Version: 2.0.1 - VideoLAN)
Welcome Center (HKLM-x32\...\eMachines Welcome Center) (Version: 1.02.3004 - Acer Incorporated)
WildTangent Games App (x32 Version: 4.0.11.9 - WildTangent) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinZip Driver Updater (HKLM\...\WinZip Driver Updater) (Version: 5.3.2.54 - VAPC (Lux) S.a.r.L)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
08-12-2015 22:42:25 Windows Update
15-12-2015 14:02:09 Windows Update
17-12-2015 17:35:06 DirectX wurde installiert
19-12-2015 01:13:01 Windows Update
22-12-2015 18:06:23 Lauras Tierklinik wird entfernt
22-12-2015 18:09:55 Removed Need for Speed(TM) Hot Pursuit
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 03:34 - 2015-12-16 08:05 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0CE02750-DB6D-49CB-A0A6-0E76B5EB1281} - System32\Tasks\{6FD87C20-28D1-4D30-9625-3E509A4F460B} => pcalua.exe -a D:\WINPORT\CAPIPORT.W98\Setup.exe -d D:\WINPORT\CAPIPORT.W98
Task: {1008115E-E228-4F39-98FC-EFE17C1DC80F} - \DigitalSite -> Keine Datei <==== ACHTUNG
Task: {1AE5A96D-79E8-4928-9AF0-159D3433C141} - System32\Tasks\{0D3BA2E3-2451-429F-9D48-9E859DD9535F} => Iexplore.exe hxxp://ui.skype.com/ui/0/4.1.0.179.369/de/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
Task: {327210B9-1643-476A-AD12-42E339925E29} - System32\Tasks\{804D6923-B4D4-4161-A92E-00915238FC4C} => pcalua.exe -a "C:\Users\Martin Sudbrock\AppData\Local\Temp\Temp1_Fendt_300Vario_1280.zip\Fendt_300Vario_1280.exe"
Task: {3C12560D-A745-4F4A-8F58-1BA50EC9AB30} - \DealPly -> Keine Datei <==== ACHTUNG
Task: {4714A1B3-DF4D-40C2-8F67-D00BCD2005FB} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {56CF5C37-32B1-4D29-AF7F-3A9724CA5A1B} - System32\Tasks\{FD60EF79-67B5-4A0B-A4B0-07EC6033D438} => pcalua.exe -a "C:\Users\Martin Sudbrock\AppData\Local\Temp\Temp1_Black_Beauty_Screensaver.zip\Black_Beauty_Screensaver.exe"
Task: {5F4C5A0D-8344-4FE9-9552-7DD06F4BE1E5} - System32\Tasks\{43BA10D0-9901-4A9B-B718-06268C855DB5} => pcalua.exe -a D:\autorun.exe -d D:\
Task: {6D6A4307-307D-42D4-A5D2-5452003B16FA} - System32\Tasks\{D84A1803-73B1-43EB-B491-19DA0CD30C4C} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=4.1.0.179.369&LastError=404
Task: {70AA49E9-EB76-4A2A-AD0B-399F44776F28} - System32\Tasks\{94770038-F4A2-459E-8124-85D38055BD39} => pcalua.exe -a C:\Tivola\Lillifee2\setup.exe -d D:
Task: {81B519DC-C5C8-43C3-A9DD-2123EF1F460E} - \EPUpdater -> Keine Datei <==== ACHTUNG
Task: {AAEC0B80-5AEF-489A-962C-9EF9A242C3EF} - \DealPlyUpdate -> Keine Datei <==== ACHTUNG
Task: {AFEBBF9E-F4DD-4AF1-9FA6-4B2FF6FABF98} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-08] (Adobe Systems Incorporated)
Task: {B8E6C28F-B868-478D-BA7B-1EC8A8AB5C6C} - System32\Tasks\{404F0ECF-F736-4F46-AAD4-BA3B329490D5} => pcalua.exe -a "C:\Users\Martin Sudbrock\Documents\Downloads\rescue2usb.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Acrobat Update Task.job => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1418818919-2476079493-1430080804-1000Core1d0c21a25a75a3c.job => C:\Users\Martin Sudbrock\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8ab695139e13.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfe9eb531c6b9e.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfffd4879e665b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d03ff56b5e0de0.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d08f99e3bd4e3c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0bfc04b095aff.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e15b9fba2c4b.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0efb3d6202b56.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12cd32399d857.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Microsoft_Hardware_Launch_IcePick_exe.job => C:\Program Files (x86)\Microsoft LifeCam\IcePick.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater for MartinSudbrock@Martin Sudbrock(logon).job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater Schedule.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater Update.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock at logon.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe-runExecutable SRTray.exe
Task: C:\Windows\Tasks\Start WinZip Driver Updater( SR ) for MartinSudbrock@Martin Sudbrock.job => C:\Program Files\WinZip Driver Updater\DriverUpdater.exe-runExecutable SRTray.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2012-11-18 22:28 - 2013-01-18 16:00 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-20 16:22 - 2015-01-20 16:22 - 00675840 _____ () C:\Windows\Installer\MSI2D4A.tmp
2011-08-12 06:45 - 2011-08-12 06:45 - 02433024 _____ () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
2012-11-16 18:35 - 2015-10-15 15:21 - 00043008 _____ () C:\Program Files (x86)\phonostar-Player\phonostarTimer.exe
2010-08-04 13:40 - 2010-08-04 13:40 - 00611872 _____ () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe
2011-05-22 17:38 - 2007-05-31 06:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2011-11-10 19:31 - 2009-10-06 13:36 - 00205312 _____ () C:\Program Files (x86)\StarMoney 7.0\ouservice\PATCHW32.dll
2013-02-07 18:19 - 2011-01-13 09:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\PATCHW32.dll
2014-07-30 12:48 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2010-05-23 19:20 - 2010-05-23 19:20 - 00126976 _____ () C:\Program Files (x86)\Rainlendar2\lua51.dll
2011-08-12 06:45 - 2011-08-12 06:45 - 00198144 _____ () C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll
2010-05-23 19:20 - 2010-05-23 19:20 - 00012288 _____ () C:\Program Files (x86)\Rainlendar2\lfs.dll
2014-10-24 21:34 - 2014-10-24 21:34 - 00880640 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\fsk.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00040264 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00239944 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\Fskin.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00026952 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2014-04-25 21:46 - 2014-04-25 21:46 - 00798720 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00125256 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00016200 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskPower.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00024904 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00017224 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00015176 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00034632 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ticket.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00018760 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00092488 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00149832 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2014-10-24 21:35 - 2014-10-24 21:35 - 00178504 _____ () C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\USBDetector.dll
2015-12-11 21:17 - 2015-10-31 01:59 - 00034768 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00022848 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Random.OSRNG.winrandom.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00023352 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Util._counter.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00042296 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Cipher._AES.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00116688 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-11 21:17 - 2015-10-31 01:59 - 00093640 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00018376 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00019760 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00105928 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32api.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00392144 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-11 21:17 - 2015-12-08 22:36 - 00381752 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00692688 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020816 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00109520 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 01737032 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020808 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020800 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_python_x66cf7a7cx17a72769.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021840 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00038696 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\fastpath.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00024528 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00020936 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00114640 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021320 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00124880 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32file.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00030160 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00043472 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00175560 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00028616 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32ts.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00048592 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32service.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00024392 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00036296 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\librsync.dll
2015-12-11 21:17 - 2015-10-31 02:00 - 00024016 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\win32profile.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00117056 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00023376 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00134608 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2015-12-11 21:17 - 2015-10-31 01:59 - 00134088 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00240584 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00020280 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00052024 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00021304 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Crypto.Util.strxor.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00350152 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00084792 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2015-12-11 21:17 - 2015-12-08 22:36 - 01826608 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-11 21:17 - 2015-10-31 02:00 - 00083912 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\sip.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 03891504 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 01950000 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00519984 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00133936 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00225080 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00207672 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00024904 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00486704 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-12-11 21:17 - 2015-12-08 22:36 - 00357680 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-03-04 22:45 - 2015-10-31 02:01 - 00019920 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00786904 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 11:47 - 2015-10-31 02:00 - 00063448 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 22:45 - 2015-10-31 02:00 - 00019408 _____ () C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-12-26 17:53 - 2015-12-26 17:53 - 00153768 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-12-26 17:53 - 2015-12-26 17:53 - 00023208 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-12-17 07:48 - 2015-12-11 04:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-17 07:48 - 2015-12-11 04:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Martin Sudbrock\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{DE107992-F302-4891-B71F-C308FC9E1079}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{267C2801-50A1-4F35-A180-55488BBA95EA}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1CDFF5E1-0664-4322-81FE-F9D94D53990A}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\app\StarMoney.exe
FirewallRules: [{A8EB0599-26F1-4DA7-847A-4EAA305A3980}] => (Allow) C:\Program Files (x86)\StarMoney 7.0\app\StarMoney.exe
FirewallRules: [TCP Query User{E033FD6B-D66F-4963-A1FE-36438F47A9E0}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe] => (Block) C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe
FirewallRules: [UDP Query User{6AAA94D8-9504-4F40-A3BA-6655995F06F3}C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe] => (Block) C:\program files (x86)\ubisoft\funatics\die siedler ii - die nächste generation\bin\s2dng.exe
FirewallRules: [{4D25E564-2466-46B4-A5C7-1EC605B0887A}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{D91CA12A-330E-45B4-972E-1FFEB153E902}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{B85E700A-FD0B-4009-8829-BC4824F738B9}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\app\StarMoney.exe
FirewallRules: [{D7A3CC9E-776B-48A7-9ECB-E5366B8044EF}] => (Allow) C:\Program Files (x86)\StarMoney 8.0 S-Edition\app\StarMoney.exe
FirewallRules: [{F7A05EE7-189E-41F7-99CD-C0CBCF6E142E}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\Anno4.exe
FirewallRules: [{07DDA04D-C180-42D8-95F2-905FC6CF6CDE}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\Anno4.exe
FirewallRules: [{2E4E1259-2C85-49F1-A429-983B43FC6045}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe
FirewallRules: [{49C9A1B3-F9CF-49C3-946A-DA4D1AE44916}] => (Allow) C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 1404\tools\Anno4Web.exe
FirewallRules: [{E55E0F43-11B1-4B97-98D4-D0439A95F275}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe
FirewallRules: [{79C10299-F2E6-4230-9B50-B17BC0D0DCB8}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe
FirewallRules: [{F4CA6433-EBB0-40B3-963A-99275FA5EE81}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe
FirewallRules: [{AD544139-16EC-4A2F-B4AE-68BF34BCB5DD}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe
FirewallRules: [TCP Query User{70A6B330-F05F-4797-94B0-3EF879F8DE69}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Block) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe
FirewallRules: [UDP Query User{FE6D2BD2-5E73-449E-81FC-4607C49CF4B6}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe] => (Block) C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe
FirewallRules: [{A0BB04EA-EA61-4CD3-8EDC-AC352CEB04B5}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{B75746B7-0408-4379-A477-0AEBACFBA1E5}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{30E44D41-4302-4A8B-A0F0-D544612BC7D7}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{A9DF5F13-2632-4218-A37E-D788C46D5302}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{973C73B0-4D17-44E8-86CD-FA28021F18F6}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{9DD1171C-37AC-478D-B913-A39647CA9EBA}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{9F9466C0-D7E9-4B8E-8132-326874E1A80A}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{E9B26C3F-F8A9-4E35-A635-0254806493CB}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{C52A35AC-DEE8-49FE-A465-1AC7913A50E3}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [TCP Query User{EBEA0B78-E8E9-467E-AA80-2F2C813DB43B}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{BCC78221-4057-4C34-A401-9CB9D232EB5C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{3CA882F2-06E4-46FC-8A70-C4503D7908C1}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{E12B600B-A8D6-46B2-AB6B-8FB15D3417C5}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{C9223E5D-1E65-4525-95EE-3302924F2496}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Allow) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [UDP Query User{E4153112-9F05-4936-9FBA-91C171761882}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Allow) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [TCP Query User{6922D609-3884-4550-9813-DA48F03DA7D7}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Block) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [UDP Query User{E9C404A8-4E08-4003-B2D3-5F32B1792F10}C:\program files (x86)\ea sports\fifa 11\game\fifa.exe] => (Block) C:\program files (x86)\ea sports\fifa 11\game\fifa.exe
FirewallRules: [{4EE53FFC-C748-4FBA-9BFA-403CF154D57A}] => (Allow) C:\Program Files (x86)\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe
FirewallRules: [{A71A495D-29F5-457A-A8B7-9C2AB3D3EAA8}] => (Allow) C:\Program Files (x86)\Electronic Arts\Need for Speed(TM) Hot Pursuit\Launcher.exe
FirewallRules: [TCP Query User{21BCAF4E-EFDB-4E33-9696-1FD7BB629DA9}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{9753DB88-8A97-43A3-A1B0-EC3CE0BB46BD}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{0780D13F-4F87-4A46-A43B-944193852643}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{AA9F5BB0-AB7A-4165-9559-3B4F35797459}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{C9116AE2-25EE-41B5-8FA6-BDB6B0C5460C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{0BA837AF-FA85-453F-B32F-B87C199B0180}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{5260A5B8-838A-4351-8220-FC04C35D504A}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe
FirewallRules: [{0B52A01C-A471-4EE8-BCDC-E55B0A2475AD}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013.exe
FirewallRules: [{E7D96B2D-AB8F-4A45-A87F-6B01E5337E72}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe
FirewallRules: [{23B725D5-8E9B-4301-8C6F-E4B948470767}] => (Allow) C:\Program Files (x86)\Landwirtschafts Simulator 2013\FarmingSimulator2013Game.exe
FirewallRules: [TCP Query User{F31C2034-70C4-4D88-B53B-B32172CA2243}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{806A698B-BDD2-4C5C-92C4-5E0F63ACABA6}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{9C01397E-8F41-48D8-8715-1370EFC6139A}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{65E8BCBC-C47F-4B1A-83DA-1167140FCEC6}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{ED1A510E-63B3-46D4-9587-EFABA9E086D3}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{3C37365D-1A53-497C-B8E9-F7AE265BA206}] => (Allow) C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{246C558F-F294-4E61-8505-1F7279B96026}] => (Allow) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{516C893B-E8E8-44CB-B650-A199E85618A7}] => (Allow) C:\Users\Martin Sudbrock\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9500ABC5-DCEA-4BEE-9148-1616F58BE819}C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{DF030DE1-4C46-4EA3-A0D3-4930AB588CFE}C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\martin sudbrock\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{DA4F56D6-5743-4F71-BBB5-ECA7371F9C3E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{354F183C-0F8D-432D-8549-22A3AE79FB47}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{D89421EC-5F41-405E-B11C-B75ED4D183C0}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{2BD9D150-6CFC-483B-9AB4-335E4738F004}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{2F0076DD-60AB-44D6-9426-74FDD3194817}] => (Allow) D:\fsetup.exe
FirewallRules: [{7FAFE1BD-BA61-43CE-8960-CA45194CAB32}] => (Allow) D:\fsetup.exe
FirewallRules: [TCP Query User{534B8A1C-AECB-4ECE-A50E-D885F5B67050}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{B6230257-EBCE-4DB7-8AC9-19188272CAF7}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{DC10FFAB-5B5E-4CFA-8AFD-77EF0A811AE1}E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe] => (Block) E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{45CD4ACC-4398-4D47-8F93-7DCE0FC5CAF3}E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe] => (Block) E:\florian\spiele\world of tanks\world_of_tanks\wotlauncher.exe
FirewallRules: [TCP Query User{94CD5501-6031-45C7-8D46-F5F8D6344C38}E:\florian\spiele\world of tanks\worldoftanks.exe] => (Block) E:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [UDP Query User{E7CEFF36-8246-4CC8-B80F-EDE1C58E4F30}E:\florian\spiele\world of tanks\worldoftanks.exe] => (Block) E:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [TCP Query User{1EF7FA65-A312-42FB-A5EA-5BF2D72EB5E0}M:\florian\spiele\world of tanks\worldoftanks.exe] => (Allow) M:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [UDP Query User{97A9EB05-B817-4929-8CF3-587B93922B9B}M:\florian\spiele\world of tanks\worldoftanks.exe] => (Allow) M:\florian\spiele\world of tanks\worldoftanks.exe
FirewallRules: [{98DBE797-7714-449A-92F0-40108F0DAA37}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{F3CCF7F0-4F7E-4B47-8825-7741CBB6C2F4}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{7182A828-B155-4087-AE94-4753964411EF}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{D639FC5E-B046-448D-B6A8-06DED4A6A18E}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{83ED619C-925C-4CC8-B459-3961F49BE7D0}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (12/27/2015 01:48:50 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (12/25/2015 09:18:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (12/25/2015 06:25:47 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (12/23/2015 02:21:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 14.0.7164.5001, Zeitstempel: 0x564cb687
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56258e62
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003d968
ID des fehlerhaften Prozesses: 0x384
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3
Error: (12/22/2015 06:01:08 PM) (Source: VSS) (EventID: 12298) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (12/22/2015 06:01:08 PM) (Source: VSS) (EventID: 12310) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{ffab797e-d755-11df-acfe-806e6f6e6963} - 0000000000000130,0x0053c010,000000000021E560,0,00000000003BFFD0,4096,[0]).
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (12/21/2015 07:39:15 PM) (Source: MsiInstaller) (EventID: 11722) (User: NT-AUTORITÄT)
Description: Product: Avira Browser Safety -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action CreateScheduledTask, location: C:\, command: "C:\Windows\SysWOW64\SCHTASKS.EXE" /CREATE /SC HOURLY /MO 6 /TN "Avira Browser Safety Updater Task" /TR "'C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe'" /RU "NT Authority\System" /RP /RL HIGHEST
Error: (12/19/2015 08:00:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Name des fehlerhaften Moduls: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00346979
ID des fehlerhaften Prozesses: 0x1174
Startzeit der fehlerhaften Anwendung: 0xgta_sa.exe0
Pfad der fehlerhaften Anwendung: gta_sa.exe1
Pfad des fehlerhaften Moduls: gta_sa.exe2
Berichtskennung: gta_sa.exe3
Error: (12/19/2015 08:00:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: HotkeyUtility.exe, Version: 2.5.3009.0, Zeitstempel: 0x4c595f20
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.19045, Zeitstempel: 0x56258e62
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032e65
ID des fehlerhaften Prozesses: 0xa74
Startzeit der fehlerhaften Anwendung: 0xHotkeyUtility.exe0
Pfad der fehlerhaften Anwendung: HotkeyUtility.exe1
Pfad des fehlerhaften Moduls: HotkeyUtility.exe2
Berichtskennung: HotkeyUtility.exe3
Error: (12/17/2015 02:29:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Name des fehlerhaften Moduls: gta_sa.exe, Version: 0.0.0.0, Zeitstempel: 0x4270f18a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003f0618
ID des fehlerhaften Prozesses: 0x63c
Startzeit der fehlerhaften Anwendung: 0xgta_sa.exe0
Pfad der fehlerhaften Anwendung: gta_sa.exe1
Pfad des fehlerhaften Moduls: gta_sa.exe2
Berichtskennung: gta_sa.exe3
Systemfehler:
=============
Error: (12/27/2015 11:46:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (12/27/2015 11:46:02 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (12/27/2015 11:43:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/27/2015 11:43:04 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (12/26/2015 11:45:09 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (12/26/2015 11:45:09 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (12/26/2015 11:43:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/26/2015 11:41:18 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\avmport.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (12/25/2015 06:28:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (12/25/2015 06:28:27 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\MARTIN~1\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
==================== Speicherinformationen ===========================
Prozessor: Pentium(R) Dual-Core CPU E5700 @ 3.00GHz
Prozentuale Nutzung des RAM: 60%
Installierter physikalischer RAM: 3071.24 MB
Verfügbarer physikalischer RAM: 1204.18 MB
Summe virtueller Speicher: 6140.69 MB
Verfügbarer virtueller Speicher: 3597.74 MB
==================== Laufwerke ================================
Drive c: (eMachines) (Fixed) (Total:453.66 GB) (Free:273.95 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 572EBBD4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=453.7 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
|
|
27.12.2015, 14:35
| #14 |
| /// TB-Ausbilder /// Anleitungs-Guru | Makrovirus in mail von "Berges Antriebstechnik"? Schritt 1  Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument: Code:
ATTFilter CloseProcesses:
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
BHO-x32: MimalaAmazonToolbar.ShowToolbarBHO -> {86a3cdaa-9b25-480e-b73f-c2d359b87966} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKLM-x32 - Mimala Amazon Toolbar - {691ca8ec-7205-4aa9-bdd6-15493d16f835} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
FF Extension: Toolbar für amazon.de - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\0001.amztoolbar@minimalarts.de [2013-05-27] [ist nicht signiert]
Task: {1008115E-E228-4F39-98FC-EFE17C1DC80F} - \DigitalSite -> Keine Datei
Task: {3C12560D-A745-4F4A-8F58-1BA50EC9AB30} - \DealPly -> Keine Datei
Task: {81B519DC-C5C8-43C3-A9DD-2123EF1F460E} - \EPUpdater -> Keine Datei
Task: {AAEC0B80-5AEF-489A-962C-9EF9A242C3EF} - \DealPlyUpdate -> Keine Datei
C:\Program Files (x86)\FreeSoundRecorder
C:\ProgramData\InstallMate\{62A7DAF2-DA4C-8E1D-6CF6-926EB944F804}\
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVPN7OBT\
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXLBZVXX\
C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\
C:\Users\Martin Sudbrock\Documents\Downloads\wzmp_8.exe
C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
Adobe Flashplayer updaten!  Wir haben es geschafft! Die Logs sehen für mich im Moment sauber aus. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.  Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.   Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken (z.B. hier) in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Kauf-Empfehlung:  ESET Smart Security Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
27.12.2015, 17:16
| #15 |
| | Makrovirus in mail von "Berges Antriebstechnik"? Hallo, anbei der Inhalt der Fixlog.txt-Datei: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-12-2015
durchgeführt von Martin Sudbrock (2015-12-27 17:03:14) Run:1
Gestartet von C:\Users\Martin Sudbrock\Desktop
Geladene Profile: Martin Sudbrock & (Verfügbare Profile: Martin Sudbrock & UpdatusUser)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {63E8895D-BE74-49D3-824C-14FFD580752B} URL =
SearchScopes: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
BHO-x32: MimalaAmazonToolbar.ShowToolbarBHO -> {86a3cdaa-9b25-480e-b73f-c2d359b87966} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKLM-x32 - Mimala Amazon Toolbar - {691ca8ec-7205-4aa9-bdd6-15493d16f835} - C:\Windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
FF Extension: Toolbar für amazon.de - C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\0001.amztoolbar@minimalarts.de [2013-05-27] [ist nicht signiert]
Task: {1008115E-E228-4F39-98FC-EFE17C1DC80F} - \DigitalSite -> Keine Datei
Task: {3C12560D-A745-4F4A-8F58-1BA50EC9AB30} - \DealPly -> Keine Datei
Task: {81B519DC-C5C8-43C3-A9DD-2123EF1F460E} - \EPUpdater -> Keine Datei
Task: {AAEC0B80-5AEF-489A-962C-9EF9A242C3EF} - \DealPlyUpdate -> Keine Datei
C:\Program Files (x86)\FreeSoundRecorder
C:\ProgramData\InstallMate\{62A7DAF2-DA4C-8E1D-6CF6-926EB944F804}\
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVPN7OBT\
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXLBZVXX\
C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder\
C:\Users\Martin Sudbrock\Documents\Downloads\wzmp_8.exe
C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
*****************
Prozess erfolgreich geschlossen.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Wert erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich wiederhergestellt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich wiederhergestellt
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
"HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} => Schlüssel nicht gefunden.
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
"HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{86a3cdaa-9b25-480e-b73f-c2d359b87966}" => Schlüssel erfolgreich entfernt
"HKCR\Wow6432Node\CLSID\{86a3cdaa-9b25-480e-b73f-c2d359b87966}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{691ca8ec-7205-4aa9-bdd6-15493d16f835} => Wert erfolgreich entfernt
"HKCR\Wow6432Node\CLSID\{691ca8ec-7205-4aa9-bdd6-15493d16f835}" => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Wert erfolgreich entfernt
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Schlüssel nicht gefunden.
HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Wert nicht gefunden.
HKCR\CLSID\Toolbar: HKU\S-1-5-21-1418818919-2476079493-1430080804-1000-{{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Schlüssel nicht gefunden.
C:\Users\Martin Sudbrock\AppData\Roaming\Mozilla\Firefox\Profiles\fuovl5m2.default\Extensions\0001.amztoolbar@minimalarts.de => erfolgreich verschoben
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1008115E-E228-4F39-98FC-EFE17C1DC80F}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1008115E-E228-4F39-98FC-EFE17C1DC80F}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DigitalSite => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3C12560D-A745-4F4A-8F58-1BA50EC9AB30}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3C12560D-A745-4F4A-8F58-1BA50EC9AB30}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPly => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{81B519DC-C5C8-43C3-A9DD-2123EF1F460E}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81B519DC-C5C8-43C3-A9DD-2123EF1F460E}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater => Schlüssel nicht gefunden.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AAEC0B80-5AEF-489A-962C-9EF9A242C3EF}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AAEC0B80-5AEF-489A-962C-9EF9A242C3EF}" => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate => Schlüssel nicht gefunden.
C:\Program Files (x86)\FreeSoundRecorder => erfolgreich verschoben
C:\ProgramData\InstallMate\{62A7DAF2-DA4C-8E1D-6CF6-926EB944F804} => erfolgreich verschoben
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QVPN7OBT => erfolgreich verschoben
C:\Users\Martin Sudbrock\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXLBZVXX => erfolgreich verschoben
C:\Users\Martin Sudbrock\AppData\LocalLow\FreeSoundRecorder => erfolgreich verschoben
C:\Users\Martin Sudbrock\Documents\Downloads\wzmp_8.exe => erfolgreich verschoben
C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll => erfolgreich verschoben
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll => erfolgreich verschoben
Das System musste neu gestartet werden.
==== Ende von Fixlog 17:04:00 ====
Gruß Martin |
|
| Themen zu Makrovirus in mail von "Berges Antriebstechnik"? |
| anhang, antivirus, avira, berges antriebstechnik; makrovirus, diverse, eingefangen, erhalte, firma, free, gefährlich, gen, inhalt, mail, malwarebytes, online-banking, scan, scanner, schadsoftware eingefangen, schließe, sperre, sperren, trojaner, version, virenscan, virenscanner, zugang, zusätzlich |
Linear-Darstellung
