| cecile_dnb | 03.02.2015 21:47 |
Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen...
Hallo,
mein Laptop ist seit einigen Wochen langsamer (nicht immer). Er bleibt ständig hängen, wenn ich im Internet surfe. Runterfahren funktioniert auch oft nicht. Beim Hochfahren führt er manchmal eine Systemprüfung durch. Der Avira Internet-Security-Suite bleibt beim Scan immer hängen, nach der Neuinstallierung meldet er etwas von Speicherort, was wie ich auf der Hilfeseite von Avira gelesen habe, wohl ein momentanter Programmfehler ist. Ich habe verschiedene kostenlose Virenscanner (Bitdefender, Norton) ausprobiert, aber sie finden nichts. Zuletzt Sophos, aber auch der bleibt hängen.
Ich kenne mich leider garnicht aus und hoffe auf eure Unterstützung!
Ebenso hoffe ich, dass ich die ersten Schritte richtig ausgeführt habe.
Hier die Dateien: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by cécile (administrator) on CÉCILE-HP on 03-02-2015 21:14:11
Running from C:\Users\cécile\Downloads
Loaded Profiles: cécile (Available profiles: cécile)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
( ) C:\Windows\System32\lxctcoms.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [184704 2012-03-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-04-03] (DivX, LLC)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\Run: [FreeAC] => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1553688 2014-02-20] (Comfort Software Group)
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\MountPoints2: {55d13acb-b40e-11e3-bb60-b4b52f926e81} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\MountPoints2: {b7d788ce-0fe2-11e3-a71a-b4b52f926e81} - D:\LaunchU3.exe -a
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe"
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=59520f42-dec0-4f91-f401-f5d9b7b29a92&searchtype=ds&q={searchTerms}&installDate=01/11/2013
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKU\.DEFAULT -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-19 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-20 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> 858C55D7AAA74067BE954B0C50E1AE46 URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0ByE0ByDtB0FzytByC0EzztC0CyDtCtCtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyBtAzytDtAzytCtDtG0D0Fzz0AtG0D0ByBtBtGtC0CzytDtGyDyCyBzzyE0E0C0EyE0E0Ezz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEyD0B0FyE0CtAzytGyCtA0ByEtG0AyE0F0AtG0FyDzztAtGtAtDtBtDyCyD0EyBtBzz0D0B2Q&cr=325223239&ir=
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
BHO: SmartSaver+ 15 -> {11111111-1111-1111-1111-110611171196} -> C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-bho64.dll No File
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ZenSearch -> {EC740D8D-BAA6-4BAF-9183-2406AB943D3A} -> C:\Program Files (x86)\ZenSearch\IeZenSearch_x64.dll (ZenSearch ApS)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Lexmark Symbolleiste -> {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -> C:\Program Files\Lexmark Toolbar\toolband.dll ()
BHO-x32: SmartSaver+ 15 -> {11111111-1111-1111-1111-110611171196} -> C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-bho.dll No File
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ZenSearch -> {EC740D8D-BAA6-4BAF-9183-2406AB943D3A} -> C:\Program Files (x86)\ZenSearch\IeZenSearch.dll (ZenSearch ApS)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DA2EA1BF-8971-4A13-9141-7EF004B55DED}: [NameServer] 212.23.115.148 212.23.115.132
FireFox:
========
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-527591061-3285833073-1316261535-1001: @jazz-soft.com/JazzPlugin -> C:\Program Files (x86)\Jazz-Soft\Jazz-Plugin\npJazz.dll (Jazz-Soft)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2013-04-21]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.search.ask.com/?p2=%5EB7J%5EYYYYYY%5EYY%5EDE&gct=hp&o=APN11289&apn_ptnrs=%5EB7J&apn_dtid=%5EYYYYYY%5EYY%5EDE&tpid=CME-V7&apn_dbr=cr_30.0.1599.69&trgb=CR&apn_uid=F9AFB407-2CBD-4E23-B9C4-A300DD6133DC&itbv=12.5.1.1394&doi=2013-10-11&psv=barid%253D201184952758440889612466654719012094104%2526cargo%253DCME%252DV7%2526spr%253Da%2526did%253D10717%2526ppd%253D
CHR StartupUrls: Default -> "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=249C1C3E8429C096&affID=120698&tt=02102013_mx15rbra&tsp=5033", "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-31]
CHR Extension: (Google Docs) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-30]
CHR Extension: (Google Drive) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-29]
CHR Extension: (YouTube) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-29]
CHR Extension: (Google-Suche) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-29]
CHR Extension: (Google Tabellen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-31]
CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl [2015-02-03]
CHR Extension: (Google Wallet) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2015-01-01]
CHR Extension: (Google Mail) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-29]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-09-30]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1044784 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [807672 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1578496 2012-08-14] (IVT Corporation) [File not signed]
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2012-08-14] (IVT Corporation) [File not signed]
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [493904 2012-03-15] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [477056 2012-11-19] (Hewlett-Packard Company)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [365440 2012-03-14] (Hewlett-Packard Company)
R2 lxct_device; C:\windows\system32\lxctcoms.exe [546304 2006-07-13] ( )
R2 lxct_device; C:\windows\SysWOW64\lxctcoms.exe [537520 2006-11-22] ( )
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1327104 2012-03-21] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-03-07] (PDF Complete Inc)
S3 SophosVirusRemovalTool; C:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [153384 2014-11-26] (Sophos Limited)
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [498352 2012-04-05] (ArcSoft, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc [X]
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-01-31] (Advanced Micro Devices, Inc.)
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [42816 2012-02-03] (ArcSoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2014-11-24] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2014-11-24] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-11-24] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23104 2011-08-13] (Ralink Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [51776 2012-04-03] (Ralink Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48320 2012-03-05] (Ralink Corporation)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64832 2012-11-09] (Hewlett-Packard Company)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-02] (Malwarebytes Corporation)
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [93640 2012-03-22] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158792 2012-03-22] (McAfee, Inc.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [685152 2012-06-14] (Ralink Technology, Corp.)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1064184 2012-09-22] (Sunplus)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.)
S1 ttnfd; system32\drivers\ttnfd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 21:14 - 2015-02-03 21:14 - 00024343 _____ () C:\Users\cécile\Downloads\FRST.txt
2015-02-03 21:13 - 2015-02-03 21:14 - 00000000 ____D () C:\FRST
2015-02-03 21:13 - 2015-02-03 21:13 - 02131456 _____ (Farbar) C:\Users\cécile\Downloads\FRST64.exe
2015-02-03 21:07 - 2015-02-03 21:09 - 00000474 _____ () C:\Users\cécile\Downloads\defogger_disable.log
2015-02-03 21:07 - 2015-02-03 21:07 - 00000000 _____ () C:\Users\cécile\defogger_reenable
2015-02-03 21:06 - 2015-02-03 21:06 - 00050477 _____ () C:\Users\cécile\Downloads\Defogger.exe
2015-02-03 15:07 - 2015-02-03 15:07 - 00000000 ____D () C:\ProgramData\Sophos
2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\ProgramData\Desktop\Sophos Virus Removal Tool.lnk
2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\Program Files (x86)\Sophos
2015-02-03 15:03 - 2015-02-03 15:04 - 109810016 _____ (Sophos Limited) C:\Users\cécile\Downloads\Sophos Virus Removal Tool.exe
2015-02-03 14:53 - 2015-02-03 14:53 - 00000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp
2015-02-03 07:50 - 2015-02-03 07:50 - 00000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E}
2015-01-31 18:36 - 2015-01-31 18:36 - 03077776 ____N (Symantec Corporation) C:\Users\cécile\Downloads\NPE.exe
2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\ProgramData\Desktop\Avira Control Center.lnk
2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\Users\cécile\AppData\Roaming\Avira
2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-01-25 16:56 - 2015-01-25 16:56 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-25 16:56 - 2014-11-24 10:31 - 00141376 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwot.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00114608 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwim.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2015-01-25 16:49 - 2015-01-25 16:51 - 180282552 _____ () C:\Users\cécile\Downloads\avira_internet_security_de.exe
2015-01-23 20:57 - 2015-01-23 20:57 - 00000000 __SHD () C:\found.002
2015-01-14 16:11 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 16:11 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 16:11 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 16:11 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-14 16:11 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-14 16:11 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-14 16:11 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-14 16:11 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-14 16:11 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-14 16:11 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 16:11 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 16:11 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-14 16:11 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-08 23:56 - 2015-01-08 23:56 - 00000000 ____D () C:\windows\SysWOW64\N360_BACKUP
2015-01-07 23:17 - 2015-01-07 23:17 - 00266586 _____ () C:\ProgramData\1420668987.bdinstall.bin
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Users\cécile\AppData\Roaming\Opera Software
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Users\cécile\AppData\Local\Opera Software
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-06 16:23 - 2015-01-06 16:23 - 00000000 ____D () C:\Users\cécile\AppData\Local\CrashDumps
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 21:11 - 2014-09-30 22:11 - 00003458 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6.job
2015-02-03 21:11 - 2013-07-23 14:54 - 00087008 _____ () C:\Users\cécile\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-03 21:07 - 2013-07-23 14:49 - 00000000 ____D () C:\Users\cécile
2015-02-03 21:06 - 2014-04-29 17:12 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-03 20:59 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 20:59 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 20:55 - 2014-09-30 22:11 - 00003802 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00003122 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002760 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002434 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002098 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2.job
2015-02-03 20:55 - 2014-09-30 22:10 - 00004484 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11.job
2015-02-03 20:55 - 2014-09-30 22:10 - 00003122 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3.job
2015-02-03 20:55 - 2014-04-29 17:12 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-03 20:51 - 2014-04-28 22:28 - 00029761 _____ () C:\windows\setupact.log
2015-02-03 20:51 - 2012-08-16 01:46 - 00000787 _____ () C:\windows\SysWOW64\bscs.ini
2015-02-03 20:51 - 2012-04-21 06:43 - 00000000 ____D () C:\ProgramData\PDFC
2015-02-03 20:51 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-03 20:39 - 2012-04-21 06:44 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-03 20:23 - 2014-04-27 03:23 - 00000298 _____ () C:\windows\Tasks\Price Meter Updater.job
2015-02-03 20:21 - 2013-04-21 06:30 - 02044385 _____ () C:\windows\WindowsUpdate.log
2015-02-03 15:01 - 2013-07-23 14:54 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{2CA201FC-5302-4E57-B7B5-319AB671A227}
2015-01-31 19:05 - 2013-09-14 15:26 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-31 18:52 - 2013-09-14 15:25 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-31 18:51 - 2014-10-18 09:52 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-31 18:51 - 2014-10-18 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-31 18:42 - 2014-12-31 13:40 - 00000000 ____D () C:\Users\cécile\AppData\Local\NPE
2015-01-31 18:38 - 2014-12-31 13:42 - 00000000 ____D () C:\NPE
2015-01-29 20:05 - 2014-09-30 19:56 - 00000000 ____D () C:\Users\cécile\Desktop\Eulen
2015-01-26 21:45 - 2013-11-25 16:48 - 00000000 ____D () C:\Users\cécile\Bewerbung
2015-01-25 17:01 - 2010-11-21 04:47 - 01125082 _____ () C:\windows\PFRO.log
2015-01-25 16:56 - 2013-07-23 18:57 - 00000000 ____D () C:\ProgramData\Avira
2015-01-25 16:43 - 2009-07-14 05:45 - 00344088 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-25 16:42 - 2014-12-31 13:40 - 00000000 ____D () C:\ProgramData\Norton
2015-01-25 16:29 - 2012-04-21 06:47 - 00049402 _____ () C:\windows\DPINST.LOG
2015-01-25 16:07 - 2012-04-21 06:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 16:07 - 2012-04-21 06:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 16:07 - 2012-04-21 06:44 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-24 11:04 - 2013-04-21 06:38 - 00000000 ____D () C:\windows\SysWOW64\ArcVCapRender
2015-01-22 21:39 - 2013-09-18 14:29 - 00000000 ____D () C:\Users\cécile\Documents\voba
2015-01-17 18:27 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2015-01-17 03:56 - 2012-04-21 06:24 - 01676126 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-01-17 03:56 - 2012-04-21 04:11 - 00734482 _____ () C:\windows\system32\perfh007.dat
2015-01-17 03:56 - 2012-04-21 04:11 - 00159048 _____ () C:\windows\system32\perfc007.dat
2015-01-17 03:55 - 2009-07-14 06:13 - 01676126 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-15 15:39 - 2012-04-21 06:43 - 00000000 ____D () C:\Program Files (x86)\PDF Complete
2015-01-15 15:31 - 2013-08-11 12:49 - 00000000 ____D () C:\windows\system32\MRT
2015-01-15 15:14 - 2013-08-06 00:42 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-07 23:42 - 2014-05-06 01:54 - 00000000 ____D () C:\Program Files (x86)\FreeAlarmClock
2015-01-07 23:34 - 2014-07-17 09:45 - 00000000 ____D () C:\Program Files\Bitdefender
2015-01-07 23:17 - 2014-05-01 19:58 - 00000000 ____D () C:\ProgramData\Bitdefender
2015-01-07 23:17 - 2014-05-01 19:42 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-01-06 21:14 - 2014-06-19 00:01 - 00000000 ____D () C:\windows\Minidump
2015-01-06 18:18 - 2014-05-01 11:25 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2015-01-06 18:18 - 2013-11-01 10:27 - 00000000 ____D () C:\ProgramData\TEMP
2015-01-06 18:16 - 2013-07-23 14:54 - 00001421 _____ () C:\Users\cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-05 01:32 - 2013-07-23 23:17 - 00000000 ____D () C:\Users\cécile\Desktop\Umschulung
2015-01-04 05:25 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\Offline Web Pages
==================== Files in the root of some directories =======
2014-09-01 09:18 - 2014-09-01 09:18 - 0002086 _____ () C:\Users\cécile\AppData\Roaming\AAJJPL
2013-12-21 08:44 - 2013-12-21 08:44 - 0000207 _____ () C:\Users\cécile\AppData\Roaming\removeWinNetData.bat
2014-04-27 21:58 - 2014-04-27 21:58 - 0000046 _____ () C:\Users\cécile\AppData\Roaming\WB.CFG
2015-02-03 14:53 - 2015-02-03 14:53 - 0000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp
2013-12-20 20:08 - 2013-12-20 20:08 - 0010752 _____ () C:\Users\cécile\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-03 20:46 - 2013-11-03 20:46 - 0010653 _____ () C:\Users\cécile\AppData\Local\recently-used.xbel
2015-02-03 07:50 - 2015-02-03 07:50 - 0000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E}
2015-01-07 23:17 - 2015-01-07 23:17 - 0266586 _____ () C:\ProgramData\1420668987.bdinstall.bin
Some content of TEMP:
====================
C:\Users\cécile\AppData\Local\Temp\avgnt.exe
C:\Users\cécile\AppData\Local\Temp\jre-8u31-windows-au.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 11:34
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by cécile at 2015-02-03 21:15:06
Running from C:\Users\cécile\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: FireWall (Enabled) {753F9273-B322-2907-AC37-03D0F1702F22}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
123 Free Solitaire v9.0 (HKLM-x32\...\123 Free Solitaire_is1) (Version: - TreeCardGames)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{95AC3836-C8D1-6BE1-C4F0-101061A445E7}) (Version: 8.0.871.0 - Advanced Micro Devices, Inc.)
ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 2.0.39.42 - ArcSoft)
ArcSoft TotalMedia (x32 Version: 1.0.61.25 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 2.0.0.39 - ArcSoft)
Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
capella 1200 (HKLM-x32\...\{CD5EF311-02B4-4DC1-82D0-4CDC38132F88}) (Version: 6.00.9210 - capella-software)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 7.1.2.0 - Hewlett-Packard Company)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)
Drive Encryption For HP ProtectTools (HKLM\...\{27F1E086-5691-4EB8-8BA1-5CBA87D67EB5}) (Version: 7.0.28.30376 - Hewlett-Packard Company)
Dropbox (HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ePub Converter (HKLM-x32\...\ePubConverter) (Version: 1.2.1 - eBook Converter)
Evernote v. 4.5.4 (HKLM-x32\...\{550BFF6E-7376-11E1-99EA-984BE15F174E}) (Version: 4.5.4.6487 - Evernote Corp.)
Face Recognition for HP ProtectTools (HKLM\...\Face Recognition for HP ProtectTools) (Version: 7.01.4525 - Hewlett-Packard Company)
Face Recognition for HP ProtectTools (Version: 7.01.4525 - Hewlett-Packard Company) Hidden
File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 7.0.0.5 - Hewlett-Packard Company)
FLV Player 2.0 (build 25) (HKLM-x32\...\FLV Player) (Version: 2.0 (build 25) - Martijn de Visser)
Free Alarm Clock 3.1.0 (HKLM-x32\...\{8ED5A2F1-338F-4608-8AF7-BCD1ADC1E1F7}_is1) (Version: 3.1 - Comfort Software Group)
Free Video Cutter Joiner 10.0 (HKLM-x32\...\{8C5A4758-C782-4200-B337-DB3466D33ADD}}_is1) (Version: 10.0 - DVDVideoMedia, Inc.)
Free YouTube to MP3 Converter version 3.12.46.923 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.923 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP 3D DriveGuard (HKLM\...\{5B4F3B85-83F0-4BBF-9052-7A38B6B09634}) (Version: 5.0.8.0 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{22706ADC-74A1-43A0-ABAE-47F84966B909}) (Version: 4.2.50.1 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{6357258D-2BF9-49E7-A9EF-0C609D52C46D}) (Version: 2.0.6.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.4.8.16 - SunplusIT)
HP Hotkey Support (HKLM-x32\...\{C97CC14E-4789-4FC5-BC75-79191F7CE009}) (Version: 4.5.9.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\...\{84642787-58C0-44AE-8B26-E2F544E380A1}) (Version: 2.5.0.16 - Hewlett-Packard Company)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 7.0.0.1177 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{223AE3E8-4445-410F-8EDA-13EC137E3BDB}) (Version: 3.4.3.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{962CB079-85E6-405F-8704-1C62365AE46F}) (Version: 4.5.10.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{658A8756-7B1E-44FD-A434-D777DD906232}) (Version: 8.5.2.1 - Hewlett-Packard Company)
HP System Default Settings (HKLM-x32\...\{C4E9E8A4-EEC4-4F9E-B140-520A8B75F430}) (Version: 2.4.1.2 - Hewlett-Packard Company)
HP Wallpaper (HKLM-x32\...\{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}) (Version: 3.0.0.1 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6392.0 - IDT)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jazz-Plugin (HKLM-x32\...\{1C92BD87-DC1B-4C4E-BFB4-2C79E88FA752}) (Version: 1.1.0 - Jazz-Soft)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.68.0 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version: - )
Lexmark 5400 Series (HKLM\...\Lexmark 5400 Series) (Version: - Lexmark International, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.93 - PDF Complete, Inc)
PDF Editor 4 (HKLM-x32\...\PDF Editor 4) (Version: - )
Privacy Manager for HP ProtectTools (HKLM\...\{CA2F6FAD-D8CD-42C1-B04D-6E5B1B1CFDCC}) (Version: 7.0.0.865 - Hewlett-Packard Company)
Ralink Bluetooth Stack64 (HKLM\...\{ED818A3C-3DF5-CDCF-3DB2-A646D7B31A16}) (Version: 9.0.717.0 - Ralink Corporation)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.2.0 - Ralink)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.50.1123.2011 - Realtek)
SDK (x32 Version: 2.30.042 - Portrait Displays, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.4 - Sophos Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.3.0 - Synaptics Incorporated)
Theft Recovery for HP ProtectTools (HKLM-x32\...\InstallShield_{10F5A72A-1E07-4FAE-A7E7-14B10CC66B17}) (Version: 7.0.0.10 - Hewlett-Packard Company)
Theft Recovery for HP ProtectTools (x32 Version: 7.0.0.10 - Hewlett-Packard Company) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{93581599-ECF1-4DCD-BE36-BD969A6C8DB5}) (Version: 4.4.213.0 - Validity Sensors, Inc.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VideoPad Video-Editor (HKLM-x32\...\VideoPad) (Version: 3.33 - NCH Software)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WindowsMangerProtect20.0.0.722 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.722 - WindowsProtect LIMITED) <==== ATTENTION
WinZip 15.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CF}) (Version: 15.0.10039 - WinZip Computing, S.L. )
ZenSearch (HKLM-x32\...\ZenSearch) (Version: - ZenSearch) <==== ATTENTION!
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
==================== Restore Points =========================
03-02-2015 15:05:03 Installed Sophos Virus Removal Tool.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {02549185-4C13-4229-863B-49F93066A7FE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {12D5C190-37A7-436A-B0C8-E3BD4BF25D9B} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-3.exe <==== ATTENTION
Task: {1F17C60A-B66E-4E2A-B6EA-80680939FCD2} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-2.exe <==== ATTENTION
Task: {2BA31416-3167-4D18-96B1-CC7ECA8933EA} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe <==== ATTENTION
Task: {361FA930-CA20-4CF8-879A-FC7FEBE13C48} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
Task: {39324CDA-731A-4F37-9B23-73987483E0C9} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-7.exe <==== ATTENTION
Task: {3DF0B5A4-1938-4E6C-8B2C-9E232DD51711} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {664B3282-928A-4C1F-A5C7-BBCA26767195} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {68E15A2E-616B-42C9-A5C8-0FEC34A65CEE} - \Optimizer Pro Schedule No Task File <==== ATTENTION
Task: {6D3CDF8D-EDDE-4469-B25A-80C130BBE46F} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-4.exe <==== ATTENTION
Task: {6D623734-B9A7-4777-809B-B55EF108696F} - System32\Tasks\GoforFilesUpdate => C:\Program Files (x86)\GoforFiles\GFFUpdater.exe <==== ATTENTION
Task: {725DA060-3353-48BB-A0B4-631E1856A468} - System32\Tasks\Price Meter Updater => C:\Users\CCILE~1\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7679DC9F-C53B-43FA-A6A0-359A2F92C313} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {809D4051-8DB7-4F00-AD92-28BAF4B9CFD0} - System32\Tasks\BrowserSafeguard Update Task => C:\Program Files (x86)\Browsersafeguard\uninstall.BrowserSafeguard.exe <==== ATTENTION
Task: {91DC5397-E205-4AFB-9E8E-CAC4B2BCC595} - System32\Tasks\ASP => C:\Program Files (x86)\RCP\systweakasp.exe
Task: {A8FBC4ED-65D3-43BF-A035-FE94CFCC6C3A} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-6.exe <==== ATTENTION
Task: {B1AA7059-5317-4287-A673-F675E3A4420A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {B2018CEE-9032-4821-877D-82FB2B153C16} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {BBC1E5A5-B799-4A6A-8711-21C857F5C982} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1 => C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-codedownloader.exe <==== ATTENTION
Task: {BE22D775-4AC3-4C68-AAC1-3005E4B33664} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {BEA1D2FF-B0D0-457B-99E4-E601803E383D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe
Task: {C7202DA1-EC28-4029-8C4E-20BCEAEB5ED0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
Task: {CC42E0FA-9677-41E4-82D6-0708A964A230} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-11.exe <==== ATTENTION
Task: {D110F954-6E59-4124-80E0-4B3F85CC7B54} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {D9F4FD33-567F-4516-918C-4BD4611951EE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {DC082767-C927-42A0-88B2-4F3C43960BBE} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {E06DDA72-15DD-4579-AF27-84410246BE6D} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\Dependencies\RemEngine.exe
Task: {E3708286-3862-41C7-A609-1715A2BC0D8E} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: {FB02DA82-2E2B-4824-A05F-14D369A3792A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {FDF51F03-B602-4C93-92A8-D83CAD7035D6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1.job => C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-codedownloader.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-11.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-2.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-3.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-4.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5_user.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-6.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-7.exe <==== ATTENTION
Task: C:\windows\Tasks\AAJJPL.job => C:\Users\cýÿcile\AppData\Roaming\AAJJPL.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Price Meter Updater.job => C:\Users\CCILE~1\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-01-18 00:57 - 2012-01-18 00:57 - 00298368 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2012-03-22 00:14 - 2012-03-22 00:14 - 03346432 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpFve64.dll
2011-10-12 10:03 - 2011-10-12 10:03 - 00213328 _____ () C:\windows\system32\PassThroughOTP.dll
2010-09-06 21:18 - 2010-09-06 21:18 - 01412608 _____ () C:\windows\system32\LIBEAY32.dll
2013-08-07 20:10 - 2006-07-11 00:54 - 00039424 _____ () C:\windows\System32\lxctpmon.dll
2013-08-07 20:10 - 2006-10-18 04:32 - 00081408 _____ () C:\Program Files (x86)\Lexmark 5400 Series\ipcmt64.dll
2013-08-07 20:10 - 2006-07-11 00:50 - 00004096 _____ () C:\windows\System32\lxctpmrc.dll
2013-08-07 20:12 - 2006-06-21 04:47 - 00142848 _____ () C:\windows\system32\spool\PRTPROCS\x64\lxctdrpp.dll
2012-03-21 23:36 - 2012-03-21 23:36 - 01327104 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
2012-08-14 22:13 - 2012-08-14 22:13 - 00009728 _____ () C:\windows\system32\BsHelpCSps.dll
2012-02-10 22:26 - 2012-02-10 22:26 - 01083392 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\System.Data.SQLite.dll
2012-08-14 22:11 - 2012-08-14 22:11 - 00022528 _____ () C:\windows\system32\BsTrace.dll
2012-03-22 00:00 - 2012-03-22 00:00 - 02846720 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcEncryptionProviderPlugin.dll
2012-03-21 23:34 - 2012-03-21 23:34 - 00126976 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHostInterface.dll
2012-03-21 23:59 - 2012-03-21 23:59 - 03002368 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalEncryptionProviderPlugin.dll
2012-03-22 00:04 - 2012-03-22 00:04 - 02850816 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpDpHostPlugin.dll
2012-03-22 00:02 - 2012-03-22 00:02 - 00053248 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalATASec4SATA.dll
2012-03-21 23:38 - 2012-03-21 23:38 - 02043904 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeCoreEncryptionPlugin.dll
2012-03-21 23:39 - 2012-03-21 23:39 - 01949696 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeProductDetectionPlugin.dll
2012-08-14 22:02 - 2012-08-14 22:02 - 00019456 _____ () C:\windows\SysWOW64\BsTrace.dll
2015-01-27 07:51 - 2015-01-25 07:08 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll
2015-01-27 07:51 - 2015-01-25 07:08 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll
2015-01-27 07:52 - 2015-01-25 07:08 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SophosVirusRemovalTool => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SophosVirusRemovalTool => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RealPlayer Cloud Service UI.lnk => C:\windows\pss\RealPlayer Cloud Service UI.lnk.CommonStartup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: AMD AVT => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
MSCONFIG\startupreg: BtTray => "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Download Protect =>
MSCONFIG\startupreg: DTRun => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe
MSCONFIG\startupreg: EzPrint => "C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe"
MSCONFIG\startupreg: File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
MSCONFIG\startupreg: HPPowerAssistant => C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden
MSCONFIG\startupreg: Lexmark 5400 Series => "C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe" /s
MSCONFIG\startupreg: LXCTCATS => rundll32 C:\windows\system32\spool\DRIVERS\x64\3\LXCTtime.dll,RunDLLEntry
MSCONFIG\startupreg: lxctmon.exe => "C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe"
MSCONFIG\startupreg: MfeEpePcMonitor =>
MSCONFIG\startupreg: NUSB3MON => "C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe"
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: QLBController => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
MSCONFIG\startupreg: TkBellExe =>
========================= Accounts: ==========================
Administrator (S-1-5-21-527591061-3285833073-1316261535-500 - Administrator - Disabled)
cécile (S-1-5-21-527591061-3285833073-1316261535-1001 - Administrator - Enabled) => C:\Users\cécile
Gast (S-1-5-21-527591061-3285833073-1316261535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-527591061-3285833073-1316261535-1005 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: ttnfd
Description: ttnfd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ttnfd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/03/2015 08:51:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/03/2015 08:51:40 PM) (Source: Microsoft Fax) (EventID: 32112) (User: )
Description: Es können keine Faxe archiviert und keine eingehenden Faxe weitergeleitet werden, da im Faxdienst Probleme mit dem Archivspeicherort aufgetreten sind. Der Dienst kann auf den Ordner "C:\ProgramData\Microsoft\Windows NT\MSFax" oder einige darin enthaltene Unterordner nicht zugreifen.
Sie können den Speicherort des Archivordners auf der Eigenschaftenseite des Faxdruckers oder im Faxdienst-Manager ändern. Weitere Informationen erhalten Sie unter Problembandlung in der Hilfe zum Faxdienst.
Win32-Fehlercode: 5
Dieser Fehlercode gibt die Ursache des Fehlers an.
Ein detaillierter Windows-Fehlerbericht bezüglich des Problems wurde generiert.
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 180056
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 180056
System errors:
=============
Error: (02/03/2015 08:53:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/03/2015 08:51:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ttnfd
Error: (02/03/2015 08:51:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Offlinedateien" wurde mit folgendem Fehler beendet:
%%3
Error: (02/03/2015 08:51:01 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.02.2015 um 20:48:49 unerwartet heruntergefahren.
Error: (02/03/2015 08:47:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 08:47:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 08:46:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 06:39:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Adobe Flash Player Update Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/03/2015 06:39:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Adobe Flash Player Update Service erreicht.
Error: (02/03/2015 05:11:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst hpHotkeyMonitor erreicht.
Microsoft Office Sessions:
=========================
Error: (02/03/2015 08:51:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/03/2015 08:51:40 PM) (Source: Microsoft Fax) (EventID: 32112) (User: )
Description: C:\ProgramData\Microsoft\Windows NT\MSFax5
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 180056
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 180056
==================== Memory info ===========================
Processor: AMD A4-4300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 48%
Total physical RAM: 3532.11 MB
Available physical RAM: 1830.03 MB
Total Pagefile: 7062.41 MB
Available Pagefile: 4869.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:442.86 GB) (Free:365.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.97 GB) FAT32
Drive g: (HP_RECOVERY) (Fixed) (Total:20.61 GB) (Free:3.14 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: A6451A16)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=442.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-03 21:27:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000065 HGST_HTS rev.GG2O 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\CCILE~1\AppData\Local\Temp\pwdcapod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80003205070 25 bytes [C4, 08, 4C, 89, 64, 24, 50, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 586 fffff8000320508a 6 bytes [00, 00, 00, 80, 05, 00]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 0000000070ec11a8 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 248 0000000070ec127d 2 bytes CALL 759914b9 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 395 0000000070ec1310 2 bytes CALL 759914b9 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 0000000070ec13a8 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000070ec1422 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000070ec1498 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextCreate + 4 0000000070ce1825 2 bytes JMP 77336125 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroy + 4 0000000070ce1830 2 bytes JMP 77336145 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroyAll + 4 0000000070ce183b 2 bytes JMP 77336165 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dDrawPrimitives2 + 4 0000000070ce1846 2 bytes JMP 77335a05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dValidateTextureStageState + 4 0000000070ce1851 2 bytes JMP 77336185 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAddAttachedSurface + 4 0000000070ce185c 2 bytes JMP 77336265 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAlphaBlt + 4 0000000070ce1867 2 bytes JMP 77336285 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAttachSurface + 4 0000000070ce1872 2 bytes JMP 773362a5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBeginMoCompFrame + 4 0000000070ce187d 2 bytes JMP 773362c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBlt + 4 0000000070ce1888 2 bytes JMP 77335a25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateD3DBuffer + 4 0000000070ce1893 2 bytes JMP 773362e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateSurface + 4 0000000070ce189e 2 bytes JMP 77335aa5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdColorControl + 4 0000000070ce18a9 2 bytes JMP 77336305 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateD3DBuffer + 4 0000000070ce18b4 2 bytes JMP 77336325 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateDirectDrawObject + 4 0000000070ce18bf 2 bytes JMP 77301fcb C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateMoComp + 4 0000000070ce18ca 2 bytes JMP 77336365 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurface + 4 0000000070ce18d5 2 bytes JMP 77335ac5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceEx + 4 0000000070ce18e0 2 bytes JMP 77335b45 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceObject + 4 0000000070ce18eb 2 bytes JMP 77335b65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteDirectDrawObject + 4 0000000070ce18f6 2 bytes JMP 773368c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteSurfaceObject + 4 0000000070ce1901 2 bytes JMP 77335a85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyD3DBuffer + 4 0000000070ce190c 2 bytes JMP 773368e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyMoComp + 4 0000000070ce1917 2 bytes JMP 77336925 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroySurface + 4 0000000070ce1922 2 bytes JMP 77335ae5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdEndMoCompFrame + 4 0000000070ce192d 2 bytes JMP 77336945 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlip + 4 0000000070ce1938 2 bytes JMP 77336965 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlipToGDISurface + 4 0000000070ce1943 2 bytes JMP 77336985 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetAvailDriverMemory + 4 0000000070ce194e 2 bytes JMP 773369a5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetBltStatus + 4 0000000070ce1959 2 bytes JMP 773369c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDC + 4 0000000070ce1964 2 bytes JMP 773369e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverInfo + 4 0000000070ce196f 2 bytes JMP 77336a05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverState + 4 0000000070ce197a 2 bytes JMP 77336a25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDxHandle + 4 0000000070ce1985 2 bytes JMP 77336a45 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetFlipStatus + 4 0000000070ce1990 2 bytes JMP 77336a65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetInternalMoCompInfo + 4 0000000070ce199b 2 bytes JMP 77336a85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompBuffInfo + 4 0000000070ce19a6 2 bytes JMP 77336aa5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompFormats + 4 0000000070ce19b1 2 bytes JMP 77336ac5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompGuids + 4 0000000070ce19bc 2 bytes JMP 77336ae5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetScanLine + 4 0000000070ce19c7 2 bytes JMP 77336b05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLock + 4 0000000070ce19d2 2 bytes JMP 77336b25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLockD3D + 4 0000000070ce19dd 2 bytes JMP 77335b85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryDirectDrawObject + 4 0000000070ce19e8 2 bytes JMP 77336b65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryMoCompStatus + 4 0000000070ce19f3 2 bytes JMP 77336b85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReenableDirectDrawObject + 4 0000000070ce19fe 2 bytes JMP 77336bc3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReleaseDC + 4 0000000070ce1a09 2 bytes JMP 77336be3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdRenderMoComp + 4 0000000070ce1a14 2 bytes JMP 77336c03 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdResetVisrgn + 4 0000000070ce1a1f 2 bytes JMP 77335b05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetColorKey + 4 0000000070ce1a2a 2 bytes JMP 77336c23 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetExclusiveMode + 4 0000000070ce1a35 2 bytes JMP 77336c43 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetGammaRamp + 4 0000000070ce1a40 2 bytes JMP 77336c63 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetOverlayPosition + 4 0000000070ce1a4b 2 bytes JMP 77336c83 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnattachSurface + 4 0000000070ce1a56 2 bytes JMP 77336ca3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlock + 4 0000000070ce1a61 2 bytes JMP 77336cc3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlockD3D + 4 0000000070ce1a6c 2 bytes JMP 77335ba5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUpdateOverlay + 4 0000000070ce1a77 2 bytes JMP 77336ce3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 4 0000000070ce1a82 2 bytes JMP 77336d03 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 52 0000000070ce1ab2 2 bytes JMP 758fdc75 C:\windows\syswow64\msvcrt.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c3e8429c098
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c3e8429c098@f85f2af15c6a 0x06 0xC3 0xEA 0xF1 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c3e8429c098 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c3e8429c098@f85f2af15c6a 0x06 0xC3 0xEA 0xF1 ...
---- EOF - GMER 2.1 ----
|
Hinweis: 
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
SecurityCheck und:
Emsisoft Emergency Kit herunter.
