| Secretly | 22.12.2015 11:20 |
Windows 7: Computer fährt nach 5-10 Minuten automatisch runter
Hallo liebes Trojaner-Board-Team,
mein Dad hat seit zwei Wochen Probleme mit seinem PC.
Sein Rechner fährt nach ca. 5-10 Minuten automatisch runter. Ich habe mir mal in der Computerverwaltung die Meldungen des Systems angeschaut konnte aber nichts genaues herauslesen. Wie immer ist da natürlich schnell die Vermutung dass sich Viren und Trojaner auf dem Rechner befinden. Seitdem lässt sich auch der lizenzierte Anti-Vir nicht mehr updaten.
Achja, nicht wundern dass der AntiVir beim Lauf deaktiviert ist. Habe da etwas ausprobiert...
Anbei mal meine Logs mit der Bitte um Hilfe: Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version:20-12-2015
durchgeführt von Albert T (Administrator) auf ALBERTT (21-12-2015 17:44:25)
Gestartet von C:\Users\Albert T\Desktop
Geladene Profile: Albert T (Verfügbare Profile: Albert T)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
(Activeris) C:\Program Files\Activeris AntiMalware\ActiverisAntiMalware.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(DivX, LLC) C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
() C:\Program Files\Unlocker\UnlockerAssistant.exe
(ACD Systems) C:\Program Files\ACD Systems\ACDSee\16.0\acdIDInTouch2.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Rainlendar2\Rainlendar2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
(TomTom) C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
() C:\Program Files\Andy\HandyAndy.exe
(Repkasoft) C:\Program Files\YoWindow\yowindow.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(VMware, Inc.) C:\Windows\System32\vmnat.exe
(VMware, Inc.) C:\Windows\System32\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Player\vmware-authd.exe
() C:\Program Files\Andy\AndyPriorityMgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\mmc.exe
(ACD Systems International Inc.) C:\Program Files\ACD Systems\ACDSee\16.0\ACDSee16.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976832 2009-12-17] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-02-14] (DivX, LLC)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [fst_de_55] => [X]
HKLM\...\Run: [t4pc_en_6] => [X]
HKLM\...\Run: [UnlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()
HKLM\...\Run: [ACSW16DE] => C:\Program Files\ACD Systems\ACDSee\16.0\acdIDInTouch2.exe [1336136 2013-05-15] (ACD Systems)
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2015-06-16] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157992 2015-06-29] (Apple Inc.)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [2202176 2015-07-29] (1und1 Mail und Media GmbH)
HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-09-10] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [2611808 2014-01-20] ()
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\Run: [MyDriveConnect.exe] => C:\Program Files\MyDrive Connect\TomTom MyDrive Connect.exe [1917832 2015-06-04] (TomTom)
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3638768 2015-12-02] (Electronic Arts)
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\MountPoints2: {874eb90e-a84b-11e3-85ad-806e6f6e6963} - E:\zdata\cobi.exe
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\yowindow.scr [859456 2014-12-21] (repkasoft)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-03-11] (Microsoft Corporation)
Startup: C:\Users\Albert T\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YoWindow.lnk [2015-03-08]
ShortcutTarget: YoWindow.lnk -> C:\Program Files\YoWindow\yowindow.exe (Repkasoft)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk [2014-03-26]
ShortcutTarget: Event Reminder.lnk -> C:\Program Files\Broderbund\PrintMaster\PMremind.exe (TLC Multimedia Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HandyAndy.lnk [2015-10-16]
ShortcutTarget: HandyAndy.lnk -> C:\Program Files\Andy\HandyAndy.exe ()
GroupPolicy: Beschränkung - Chrome <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{4E569D0D-060F-4999-B593-3F54F58C0CE9}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130858272569163203&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53WhnB7ewdSgSxYO0m6tOwac6Xdte_wV7iBdk-i1I9jdfHZVYovo3Nzj--WFTvII4sivtoXEr-lz1TZm59lDLFgP-r86_PeL2fXX_jpHCkBJKbYrUVSCVa2ho2NitwpJCAITCbDyToui4_i1yAYMr9jxzXnPJHj41Jklw,,&q={searchTerms}
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://safesearch.avira.com/#web/result?source=art&q=
SearchScopes: HKLM -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2498} URL = hxxp://www.default-search.net/search?sid=498&aid=103&itype=n&ver=12386&tm=387&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> DefaultScope {9D1B7C04-4B57-49C2-80CA-665129C70848} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3326313&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPAA8B45AF-7B9D-4658-BBFE-A73F5942296A&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {0120198F-0467-45FA-B144-75554C6C248D} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {7D18D2DE-1954-45BC-BCBD-5FAFA7A02EE7} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2498} URL = hxxp://www.default-search.net/search?sid=498&aid=103&itype=n&ver=12386&tm=387&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {9D1B7C04-4B57-49C2-80CA-665129C70848} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {F696AFAC-5218-4873-BFEC-866097B83BA1} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> {F6CFCEAA-E78B-4CF8-8566-5BA4C5CC6AA3} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-07-29] (1und1 Mail und Media GmbH)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-03-27] (DVDVideoSoft Ltd.)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-07-29] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> Kein Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Keine Datei
Toolbar: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001 -> WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-07-29] (1und1 Mail und Media GmbH)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-07-29] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default
FF DefaultSearchEngine: webssearches
FF SearchEngineOrder.1: default-search.net
FF SelectedSearchEngine: webssearches
FF Homepage: hxxp://istart.webssearches.com/?type=hppp&ts=1414683279&from=tugs&uid=WDCXWD2500JB-00GVC0_WD-WCAL7906278062780X
FF Session Restore: -> ist aktiviert.
FF Keyword.URL: hxxp://www.default-search.net/search?sid=498&aid=103&itype=n&ver=12386&tm=387&src=ds&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1215155.dll [2014-12-02] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2013-09-17] (DivX, LLC.)
FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2014-02-18] (DivX, LLC)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2012-08-02] (Nero AG)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-03-19] (SaveSense)
FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll [2014-03-19] (SaveSense)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4255749936-1666323006-1217971285-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Albert T\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-08-18] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\user.js [2014-06-22]
FF SearchPlugin: C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\searchplugins\Web Search.xml [2014-06-22]
FF Extension: Kein Name - C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\extensions\JVLZDBPL59336341@US28589925.com [2015-09-04] [ist nicht signiert]
FF Extension: Kein Name - C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\extensions\0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com [2015-09-04] [ist nicht signiert]
FF Extension: Kein Name - C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\extensions\randlphtim@hotmail.com [2015-09-04] [ist nicht signiert]
FF Extension: Adblock Plus - C:\Users\Albert T\AppData\Roaming\Mozilla\Firefox\Profiles\1m18xkk8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-29] [ist nicht signiert]
FF HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff [2014-04-18] [ist nicht signiert]
Chrome:
=======
CHR HomePage: Default -> hxxp://istart.webssearches.com/?type=hppp&ts=1407922429&from=tugs&uid=WDCXWD2500JB-00GVC0_WD-WCAL7906278062780X
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hppp&ts=1407922429&from=tugs&uid=WDCXWD2500JB-00GVC0_WD-WCAL7906278062780X"
CHR DefaultSearchURL: Default -> hxxp://istart.webssearches.com/web/?type=dspp&ts=1407480205&from=tugs&uid=WDCXWD2500JB-00GVC0_WD-WCAL7906278062780X&q={searchTerms}
CHR DefaultSearchKeyword: Default -> webssearches
CHR Profile: C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-08]
CHR Extension: (Google Drive) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-08]
CHR Extension: (YouTube) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-08]
CHR Extension: (HD-Total-1.1) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbeihidkikgdcoogkeoeconphggdhop [2014-08-08]
CHR Extension: (Google-Suche) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-29]
CHR Extension: (Adobe Acrobat – PDF-Datei erstellen) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2015-03-19]
CHR Extension: (free ven) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcjbopemebdnolilndkpjfmhakccapkh [2014-08-07]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-23]
CHR Extension: (media enhance) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\lekgiimbfodefdaoofhlckefjbgpeilo [2014-03-17]
CHR Extension: (Skype Click to Call) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-05-16]
CHR Extension: (Google Wallet) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-16]
CHR Extension: (Google Mail) - C:\Users\Albert T\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]
CHR HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-03-20]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [948392 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1418560 2015-12-01] (Avira Operations GmbH & Co. KG)
S2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [240872 2015-09-10] (Avira Operations GmbH & Co. KG)
S2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [36392 2014-02-18] (Just Develop It) [Datei ist nicht signiert] <==== ACHTUNG
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [2104840 2015-12-02] (Electronic Arts)
S2 savesenselive; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-03-19] (SaveSense)
S3 savesenselivem; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-03-19] (SaveSense)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 VMAuthdService; C:\Program Files\VMware\VMware Player\vmware-authd.exe [87256 2015-06-24] (VMware, Inc.)
R2 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [359128 2015-06-24] (VMware, Inc.)
R2 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [722624 2014-08-21] (VMware, Inc.)
R2 VMware NAT Service; C:\Windows\system32\vmnat.exe [437976 2015-06-24] (VMware, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 Util Fortunitas; "C:\Program Files\Fortunitas\bin\utilFortunitas.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 0090F1FA4B7E6C64AAC7FE944BB62C3D; C:\Users\Albert T\AppData\Local\Temp\{D92941E5-A73C-4C6B-958A-812488224708}\0090F1FA4B7E6C64AAC7FE944BB62C3D.sys [152224 2015-12-04] (AO Kaspersky Lab)
S3 5FE1C85ADEC80F942A9A3764B861D774; C:\Users\Albert T\AppData\Local\Temp\{9EDAF249-D889-4FD8-939C-4EAD75D7D228}\5FE1C85ADEC80F942A9A3764B861D774.sys [152224 2015-12-04] (AO Kaspersky Lab)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106968 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136272 2015-12-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [55456 2015-12-01] (Avira Operations GmbH & Co. KG)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd6.sys [44032 2009-07-13] (VIA Technologies, Inc. )
R2 hcmon; C:\Windows\system32\drivers\hcmon.sys [43968 2014-08-21] (VMware, Inc.)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [136888 2015-06-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [44728 2015-07-04] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [773304 2015-06-30] (Kaspersky Lab ZAO)
S3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH) [Datei ist nicht signiert]
S3 Ser2plx86; C:\Windows\System32\DRIVERS\ser2pl.sys [139776 2013-10-25] (Prolific Technology Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-11] (Avira Operations GmbH & Co. KG)
R3 vmkbd; C:\Windows\system32\drivers\VMkbd.sys [26456 2015-06-24] (VMware, Inc.)
S3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [17104 2015-06-24] (VMware, Inc.)
R2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [37456 2015-06-24] (VMware, Inc.)
R2 VMnetuserif; C:\Windows\system32\drivers\vmnetuserif.sys [26968 2015-06-24] (VMware, Inc.)
R2 vmx86; C:\Windows\system32\Drivers\vmx86.sys [66136 2015-06-24] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [63824 2013-10-08] (VMware, Inc.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [Datei ist nicht signiert]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-21 17:44 - 2015-12-21 17:46 - 00025680 _____ C:\Users\Albert T\Desktop\FRST.txt
2015-12-21 17:43 - 2015-12-21 17:44 - 00000000 ____D C:\FRST
2015-12-21 17:43 - 2015-12-21 16:41 - 01721344 _____ (Farbar) C:\Users\Albert T\Desktop\FRST.exe
2015-12-20 16:37 - 2015-12-20 16:37 - 00142936 _____ C:\Windows\Minidump\122015-30046-01.dmp
2015-12-20 16:21 - 2015-12-20 16:22 - 00142936 _____ C:\Windows\Minidump\122015-23765-01.dmp
2015-12-18 14:26 - 2015-12-18 14:26 - 00142936 _____ C:\Windows\Minidump\121815-26062-01.dmp
2015-12-16 18:47 - 2015-12-16 18:47 - 00142936 _____ C:\Windows\Minidump\121615-27875-01.dmp
2015-12-10 16:06 - 2015-11-11 21:52 - 00341192 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-12-10 16:06 - 2015-11-11 19:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-10 16:06 - 2015-11-11 19:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-10 16:06 - 2015-11-11 17:00 - 12856832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-10 16:06 - 2015-11-11 16:44 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-12-10 16:06 - 2015-11-11 16:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-12-10 16:06 - 2015-11-11 16:41 - 20366848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-10 16:06 - 2015-11-11 15:57 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-12-10 16:06 - 2015-11-10 19:39 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-12-10 16:06 - 2015-11-10 19:39 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-12-10 16:06 - 2015-11-10 19:39 - 00811520 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-10 16:06 - 2015-11-10 18:40 - 02386944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-10 16:06 - 2015-11-10 01:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-10 16:06 - 2015-11-10 01:24 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-12-10 16:06 - 2015-11-10 01:13 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-10 16:06 - 2015-11-10 01:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-12-10 16:06 - 2015-11-10 01:12 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-12-10 16:06 - 2015-11-10 01:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-12-10 16:06 - 2015-11-10 01:11 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-12-10 16:06 - 2015-11-10 01:08 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-10 16:06 - 2015-11-10 01:06 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-10 16:06 - 2015-11-10 01:06 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-12-10 16:06 - 2015-11-10 01:04 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-12-10 16:06 - 2015-11-10 01:03 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-12-10 16:06 - 2015-11-10 01:03 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-12-10 16:06 - 2015-11-10 01:02 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-10 16:06 - 2015-11-10 01:02 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-12-10 16:06 - 2015-11-10 00:57 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-12-10 16:06 - 2015-11-10 00:50 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-12-10 16:06 - 2015-11-10 00:47 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-12-10 16:06 - 2015-11-10 00:46 - 04514816 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-12-10 16:06 - 2015-11-10 00:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-12-10 16:06 - 2015-11-10 00:37 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-12-10 16:06 - 2015-11-10 00:36 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-10 16:06 - 2015-11-10 00:36 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-10 16:06 - 2015-11-10 00:36 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-12-10 16:06 - 2015-11-10 00:35 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-12-10 16:06 - 2015-11-10 00:17 - 02011136 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-10 16:06 - 2015-11-10 00:14 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-10 16:06 - 2015-11-10 00:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 02956800 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-12-10 16:05 - 2015-11-20 19:34 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-12-10 16:05 - 2015-11-20 19:33 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-12-10 16:05 - 2015-11-20 19:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-12-10 16:05 - 2015-11-20 19:33 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-12-10 16:05 - 2015-11-05 20:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2015-12-10 16:05 - 2015-11-05 20:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-12-10 16:05 - 2015-11-05 10:48 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-10 16:05 - 2015-11-03 19:56 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2015-12-10 16:05 - 2015-11-03 19:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2015-12-10 16:05 - 2015-10-09 00:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2015-12-10 16:05 - 2015-10-09 00:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2015-12-10 16:05 - 2015-10-09 00:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2015-12-10 16:05 - 2015-10-09 00:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2015-12-10 16:05 - 2015-10-08 20:13 - 00419928 _____ C:\Windows\system32\locale.nls
2015-12-10 15:54 - 2015-12-10 15:54 - 00142936 _____ C:\Windows\Minidump\121015-25140-01.dmp
2015-12-10 15:04 - 2015-12-10 15:04 - 00142936 _____ C:\Windows\Minidump\121015-32000-01.dmp
2015-12-08 18:17 - 2015-12-08 18:17 - 00142936 _____ C:\Windows\Minidump\120815-27437-01.dmp
2015-12-08 18:01 - 2015-12-08 18:01 - 00142936 _____ C:\Windows\Minidump\120815-32546-01.dmp
2015-12-08 17:14 - 2015-12-08 17:14 - 00142936 _____ C:\Windows\Minidump\120815-34453-01.dmp
2015-12-08 17:00 - 2015-12-08 17:00 - 00142936 _____ C:\Windows\Minidump\120815-34796-01.dmp
2015-12-07 17:36 - 2015-12-07 17:36 - 00142936 _____ C:\Windows\Minidump\120715-32375-01.dmp
2015-12-06 19:16 - 2015-12-06 19:17 - 00142936 _____ C:\Windows\Minidump\120615-23218-01.dmp
2015-12-06 19:12 - 2015-12-06 19:12 - 00142936 _____ C:\Windows\Minidump\120615-28281-01.dmp
2015-12-05 15:54 - 2015-12-05 15:54 - 00142936 _____ C:\Windows\Minidump\120515-23562-01.dmp
2015-12-05 14:14 - 2015-12-05 14:14 - 00142936 _____ C:\Windows\Minidump\120515-33781-01.dmp
2015-12-05 14:04 - 2015-12-05 14:04 - 00142936 _____ C:\Windows\Minidump\120515-27640-01.dmp
2015-12-04 18:40 - 2015-12-04 18:40 - 00142936 _____ C:\Windows\Minidump\120415-24687-01.dmp
2015-12-04 18:33 - 2015-12-04 18:33 - 00142936 _____ C:\Windows\Minidump\120415-25593-01.dmp
2015-12-04 18:30 - 2015-12-04 18:30 - 00142936 _____ C:\Windows\Minidump\120415-24640-01.dmp
2015-12-04 17:50 - 2015-12-04 17:50 - 00142936 _____ C:\Windows\Minidump\120415-22609-01.dmp
2015-12-04 17:37 - 2015-12-04 17:37 - 00142936 _____ C:\Windows\Minidump\120415-29015-01.dmp
2015-12-04 14:18 - 2015-12-04 14:18 - 00142936 _____ C:\Windows\Minidump\120415-23343-01.dmp
2015-12-04 14:10 - 2015-12-04 14:10 - 00147064 _____ C:\Windows\Minidump\120415-30109-01.dmp
2015-12-04 14:08 - 2015-06-30 01:05 - 00773304 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-12-04 14:08 - 2015-06-30 01:05 - 00136888 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2015-12-04 13:57 - 2015-12-04 13:57 - 00142936 _____ C:\Windows\Minidump\120415-27343-01.dmp
2015-12-04 13:50 - 2015-12-04 13:50 - 00142936 _____ C:\Windows\Minidump\120415-30328-01.dmp
2015-12-04 13:34 - 2015-12-04 13:34 - 00142936 _____ C:\Windows\Minidump\120415-23109-01.dmp
2015-12-04 13:25 - 2015-12-04 13:25 - 00142936 _____ C:\Windows\Minidump\120415-30953-01.dmp
2015-12-04 13:20 - 2015-12-04 13:20 - 00142936 _____ C:\Windows\Minidump\120415-35812-01.dmp
2015-12-04 13:17 - 2015-12-04 13:17 - 00000000 ____D C:\Windows\ELAMBKUP
2015-12-04 13:17 - 2015-12-04 13:17 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-12-04 13:17 - 2015-12-04 13:17 - 00000000 ____D C:\Program Files\Kaspersky Lab
2015-12-04 13:16 - 2015-07-04 02:18 - 00044728 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys
2015-12-04 13:14 - 2015-12-04 13:14 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2015-12-04 13:11 - 2015-12-04 13:11 - 00142936 _____ C:\Windows\Minidump\120415-29828-01.dmp
2015-12-04 13:05 - 2015-12-04 13:05 - 00142936 _____ C:\Windows\Minidump\120415-33578-01.dmp
2015-12-04 12:56 - 2015-12-04 12:56 - 00142936 _____ C:\Windows\Minidump\120415-33296-01.dmp
2015-12-04 12:39 - 2015-12-04 12:39 - 00142936 _____ C:\Windows\Minidump\120415-30515-01.dmp
2015-12-04 12:25 - 2015-12-04 12:25 - 00142936 _____ C:\Windows\Minidump\120415-27875-01.dmp
2015-12-04 12:21 - 2015-12-04 12:21 - 00142936 _____ C:\Windows\Minidump\120415-27828-01.dmp
2015-12-04 12:14 - 2015-12-04 12:14 - 00142936 _____ C:\Windows\Minidump\120415-21156-01.dmp
2015-12-04 11:57 - 2015-12-04 11:57 - 00142936 _____ C:\Windows\Minidump\120415-30343-01.dmp
2015-12-04 11:08 - 2015-12-04 11:08 - 00142936 _____ C:\Windows\Minidump\120415-26046-01.dmp
2015-12-04 10:44 - 2015-12-04 10:44 - 00142936 _____ C:\Windows\Minidump\120415-22578-01.dmp
2015-12-04 10:28 - 2015-12-04 10:28 - 00142936 _____ C:\Windows\Minidump\120415-31765-01.dmp
2015-12-04 10:12 - 2015-12-04 10:12 - 00142936 _____ C:\Windows\Minidump\120415-22890-01.dmp
2015-12-04 09:41 - 2015-12-04 09:41 - 00142936 _____ C:\Windows\Minidump\120415-29671-01.dmp
2015-12-02 18:38 - 2015-12-02 18:38 - 00142936 _____ C:\Windows\Minidump\120215-24750-01.dmp
2015-12-02 18:34 - 2015-12-02 18:34 - 00142936 _____ C:\Windows\Minidump\120215-22250-01.dmp
2015-12-02 18:29 - 2015-12-02 18:29 - 00142936 _____ C:\Windows\Minidump\120215-21515-01.dmp
2015-12-01 19:25 - 2015-12-01 19:25 - 00142936 _____ C:\Windows\Minidump\120115-27312-01.dmp
2015-12-01 19:20 - 2015-12-01 19:20 - 00142936 _____ C:\Windows\Minidump\120115-33812-01.dmp
2015-12-01 19:10 - 2015-12-01 19:12 - 00002562 _____ C:\Windows\diagwrn.xml
2015-12-01 19:10 - 2015-12-01 19:12 - 00001908 _____ C:\Windows\diagerr.xml
2015-12-01 19:06 - 2015-12-01 19:06 - 00142936 _____ C:\Windows\Minidump\120115-22437-01.dmp
2015-12-01 19:01 - 2015-12-01 19:01 - 00142936 _____ C:\Windows\Minidump\120115-24375-01.dmp
2015-12-01 18:56 - 2015-12-01 18:56 - 00142984 _____ C:\Windows\Minidump\120115-31203-01.dmp
2015-12-01 18:50 - 2015-12-01 18:50 - 00142984 _____ C:\Windows\Minidump\120115-21296-01.dmp
2015-12-01 18:17 - 2015-12-01 18:17 - 00000000 _____ C:\Users\Albert T\AppData\Local\{F11019A9-BB1D-4259-BA52-552202302FB4}
2015-11-21 13:31 - 2015-11-21 13:31 - 00000000 __HDC C:\ProgramData\{35A3E0D9-E4D3-4361-8860-17C7CD7F5C3C}
2015-11-21 13:30 - 2015-12-04 17:44 - 00000000 ____D C:\Program Files\WinSysClean X6
2015-11-21 13:30 - 2015-11-21 13:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ultimate Systems
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-21 17:46 - 2014-03-10 13:19 - 01636002 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-21 17:46 - 2009-07-14 09:47 - 00705286 _____ C:\Windows\system32\perfh007.dat
2015-12-21 17:46 - 2009-07-14 09:47 - 00151452 _____ C:\Windows\system32\perfc007.dat
2015-12-21 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\inf
2015-12-21 17:44 - 2009-07-14 03:37 - 00000000 ____D C:\Windows
2015-12-21 17:39 - 2014-03-10 17:36 - 00000000 ____D C:\Users\Albert T\.rainlendar2
2015-12-21 17:38 - 2015-10-16 17:07 - 00000000 ____D C:\ProgramData\VMware
2015-12-21 17:38 - 2015-02-28 11:44 - 00000272 _____ C:\Windows\Tasks\AbelssoftPreloader.job
2015-12-21 17:38 - 2014-08-07 17:44 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-21 17:38 - 2014-03-19 17:53 - 00000920 _____ C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2015-12-21 17:38 - 2014-03-16 09:42 - 00001570 _____ C:\Windows\Tasks\media enhance-updater.job
2015-12-21 17:38 - 2014-03-16 09:42 - 00001490 _____ C:\Windows\Tasks\free ven-updater.job
2015-12-21 17:38 - 2014-03-16 09:42 - 00001424 _____ C:\Windows\Tasks\media enhance-enabler.job
2015-12-21 17:38 - 2014-03-16 09:42 - 00001344 _____ C:\Windows\Tasks\free ven-enabler.job
2015-12-21 17:38 - 2014-03-16 09:41 - 00001524 _____ C:\Windows\Tasks\media enhance-codedownloader.job
2015-12-21 17:38 - 2014-03-16 09:41 - 00001444 _____ C:\Windows\Tasks\free ven-codedownloader.job
2015-12-21 17:38 - 2014-03-16 09:40 - 00003094 _____ C:\Windows\Tasks\media enhance-chromeinstaller.job
2015-12-21 17:38 - 2014-03-16 09:40 - 00002340 _____ C:\Windows\Tasks\media enhance-firefoxinstaller.job
2015-12-21 17:38 - 2014-03-16 09:40 - 00002236 _____ C:\Windows\Tasks\free ven-firefoxinstaller.job
2015-12-21 17:38 - 2014-03-16 09:39 - 00003078 _____ C:\Windows\Tasks\free ven-chromeinstaller.job
2015-12-21 17:38 - 2014-03-13 18:11 - 00001496 _____ C:\Windows\Tasks\hdtotal1.1-updater.job
2015-12-21 17:38 - 2014-03-13 18:11 - 00001450 _____ C:\Windows\Tasks\hdtotal1.1-codedownloader.job
2015-12-21 17:38 - 2014-03-13 18:11 - 00001350 _____ C:\Windows\Tasks\hdtotal1.1-enabler.job
2015-12-21 17:38 - 2014-03-13 18:10 - 00003082 _____ C:\Windows\Tasks\hdtotal1.1-chromeinstaller.job
2015-12-21 17:38 - 2014-03-13 18:10 - 00002508 _____ C:\Windows\Tasks\hdtotal1.1-firefoxinstaller.job
2015-12-21 17:38 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-20 23:02 - 2014-03-14 21:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-20 22:58 - 2014-03-19 17:53 - 00000924 _____ C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2015-12-20 22:54 - 2014-03-19 17:53 - 00000304 _____ C:\Windows\Tasks\SaveSense.job
2015-12-20 22:52 - 2014-08-07 17:44 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-20 22:47 - 2009-07-14 05:34 - 00024976 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-20 22:47 - 2009-07-14 05:34 - 00024976 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-20 16:37 - 2014-07-03 18:13 - 00000000 ____D C:\Windows\Minidump
2015-12-20 16:36 - 2015-11-20 20:08 - 337910491 _____ C:\Windows\MEMORY.DMP
2015-12-20 14:34 - 2014-03-16 09:39 - 00000000 ____D C:\Program Files\free ven
2015-12-20 14:34 - 2014-03-13 18:10 - 00000000 ____D C:\Program Files\hdtotal1.1
2015-12-18 17:48 - 2015-04-04 20:58 - 00000000 ____D C:\Windows\system32\GWX
2015-12-11 10:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2015-12-11 10:04 - 2015-10-26 23:47 - 00533568 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-10 16:36 - 2014-03-10 17:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-12-10 16:35 - 2014-03-14 21:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-10 16:35 - 2014-03-14 21:24 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-10 16:30 - 2014-03-10 19:01 - 00000000 ____D C:\Windows\system32\MRT
2015-12-10 16:24 - 2014-03-10 19:01 - 137798368 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-12-10 15:02 - 2014-03-14 21:00 - 00796864 _____ C:\Windows\system32\FlashPlayerApp.exe
2015-12-10 15:02 - 2014-03-10 18:26 - 00142528 _____ C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-08 17:57 - 2014-03-10 13:15 - 00000000 ____D C:\Users\Albert T
2015-12-07 17:30 - 2015-10-25 09:48 - 00000256 _____ C:\Windows\Tasks\WashAndGoNGOwnSchedule.job
2015-12-06 19:07 - 2015-04-26 14:32 - 00000000 ____D C:\ProgramData\Origin
2015-12-05 13:53 - 2014-03-10 13:35 - 00000000 ___RD C:\Users\Albert T\Desktop\Arbeitsdesktop
2015-12-02 18:14 - 2015-04-26 14:32 - 00000000 ____D C:\Program Files\Origin
2015-12-02 13:25 - 2014-03-10 13:40 - 00247976 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-01 18:38 - 2014-03-10 18:04 - 00000000 ____D C:\Users\Albert T\Documents\Bogenschießen
2015-12-01 18:00 - 2014-03-10 14:23 - 00000000 ____D C:\Users\Albert T\AppData\Local\ElevatedDiagnostics
2015-12-01 18:00 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2015-12-01 17:34 - 2015-10-20 17:30 - 00000000 ____D C:\Program Files\Zviewer
2015-12-01 17:21 - 2015-06-27 17:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-12-01 16:50 - 2014-03-10 14:11 - 00136272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-12-01 16:50 - 2014-03-10 14:11 - 00106968 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-12-01 16:50 - 2014-03-10 14:11 - 00055456 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-11-29 12:26 - 2014-03-10 18:11 - 00036574 _____ C:\Users\Albert T\Documents\Gas,Strom,Wasser.xlsx
2015-11-29 12:15 - 2014-04-21 09:56 - 00526336 ___SH C:\Users\Albert T\Documents\Thumbs.db
2015-11-29 11:48 - 2015-01-09 17:02 - 02331648 ___SH C:\Users\Albert T\Downloads\Thumbs.db
2015-11-27 11:33 - 2015-10-20 17:30 - 00000000 ____D C:\Users\Albert T\AppData\Roaming\Zviewer
2015-11-27 10:16 - 2014-03-10 18:05 - 00000000 ____D C:\Users\Albert T\Documents\1. Arbeitsstelle BBZ
2015-11-25 18:11 - 2015-11-03 11:05 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-03-16 14:35 - 2014-03-16 14:35 - 0000592 _____ () C:\Users\Albert T\AppData\Roaming\aps.scan.quick.results
2014-03-14 21:01 - 2014-03-16 14:35 - 0000159 _____ () C:\Users\Albert T\AppData\Roaming\aps.uninstall.scan.results
2014-03-16 11:06 - 2014-03-19 11:00 - 0005265 _____ () C:\Users\Albert T\AppData\Roaming\callbanner.png
2014-07-13 11:51 - 2014-07-13 11:56 - 0000008 _____ () C:\Users\Albert T\AppData\Roaming\pdfdrawcodec.dll
2014-03-14 21:53 - 2014-10-15 10:59 - 0000168 _____ () C:\Users\Albert T\AppData\Roaming\WB.CFG
2014-03-14 21:51 - 2014-03-13 16:24 - 0954784 _____ (AnyProtect.com) C:\Users\Albert T\AppData\Local\AnyProtectScannerSetup.exe
2015-12-01 18:17 - 2015-12-01 18:17 - 0000000 _____ () C:\Users\Albert T\AppData\Local\{F11019A9-BB1D-4259-BA52-552202302FB4}
Einige Dateien in TEMP:
====================
C:\Users\Albert T\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-12-20 11:48
==================== Ende vom FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x86) Version:20-12-2015
durchgeführt von Albert T (2015-12-21 17:48:19)
Gestartet von C:\Users\Albert T\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) (2014-03-10 12:15:05)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-4255749936-1666323006-1217971285-500 - Administrator - Disabled)
Albert T (S-1-5-21-4255749936-1666323006-1217971285-1001 - Administrator - Enabled) => C:\Users\Albert T
Gast (S-1-5-21-4255749936-1666323006-1217971285-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4255749936-1666323006-1217971285-1002 - Limited - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Disabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
AC3Filter 2.6.0b (HKLM\...\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)
ACDSee 16 (HKLM\...\{F2B13D5D-B847-48E4-B038-0B42E6EBFEE4}) (Version: 16.0.76 - ACD Systems International Inc.)
Adobe Acrobat Reader DC - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.9 - Adobe Systems Incorporated)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.5.155 - Adobe Systems, Inc.)
Andy OS (HKLM\...\Andy OS) (Version: 0.45.0.0 - Andy OS, Inc)
Any Video Converter 5.7.9 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
Apple Application Support (32-Bit) (HKLM\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{538227C6-C74B-4A74-99E1-2C0B4F9DA5E1}) (Version: 8.2.1.3 - Apple Inc.)
ArcSoft MediaImpression 2 (HKLM\...\{3DABE68E-FD6C-46FC-9045-AD1E3A09D106}) (Version: 2.0.27.843 - ArcSoft)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
Avira Antivirus (HKLM\...\Avira Antivirus) (Version: 15.0.14.259 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM\...\{5dfbeba9-9f22-463d-8c95-c861911810a2}) (Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG)
Avira Launcher (Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG) Hidden
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Color Initialen (HKLM\...\Color Initialen) (Version: - )
Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (HKLM\...\{35A2FE53-CC80-4D17-941F-3A7C82824FC7}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™ Renegade (HKLM\...\{24DFBE4C-FD7F-48F2-A7D9-D1A0929B2113}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™: Generals and Zero Hour (HKLM\...\{8F0F5689-6900-425B-A8C2-0DBD10DAB694}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
DMUninstaller (HKLM\...\DMUninstaller) (Version: - ) <==== ACHTUNG
Easy Poster Printer (HKLM\...\{1B5979B5-FE79-405A-A023-592DCE48C522}) (Version: 6.0.0 - GD Software)
Fonti - Schriftenmanager 1.02 (HKLM\...\{734EDA55-45A8-47D6-84F3-0095DC8E30F2}_is1) (Version: - WUeTo Entertainment GmbH)
Fonti - Schriftenmanager 1.02 (HKLM\...\{7E45C331-7B44-4BEF-87DD-24DFCBB7FD56}_is1) (Version: - WUeTo Entertainment GmbH)
Free Video to DVD Converter version 5.0.32.1230 (HKLM\...\Free Video to DVD Converter_is1) (Version: 5.0.32.1230 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.32.327 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.32.327 - DVDVideoSoft Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: - )
Google Update Helper (Version: 1.3.29.1 - Google Inc.) Hidden
Instagiffer version 1.54 (HKLM\...\{13DEF8F8-5280-4555-95A4-E815C3F9540F}_is1) (Version: 1.54 - Justin Todd)
IPCSearch version 1.0.15 (HKLM\...\{082304E1-3A6E-4027-AABC-22BE6852AD74}_is1) (Version: 1.0.15 - )
iTunes (HKLM\...\{A3875CED-8B9B-47F5-9AB9-0C36DD2D8D18}) (Version: 12.2.0.145 - Apple Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Web Publishing Wizard 1.52 (HKLM\...\WebPost) (Version: - )
MusicBee 2.3 (HKLM\...\MusicBee) (Version: 2.3 - Steven Mayall)
MyDriveConnect 4.0.3.2180 (HKLM\...\MyDriveConnect) (Version: 4.0.3.2180 - TomTom)
Nero Update (HKLM\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: - )
Oracle VM VirtualBox 4.3.30 (HKLM\...\{BA912F8C-A60A-4535-B2EF-7327FEE2B206}) (Version: 4.3.30 - Oracle Corporation)
Origin (HKLM\...\Origin) (Version: 9.5.12.2862 - Electronic Arts, Inc.)
PC-Putzer 2015 (HKLM\...\PC-Putzer 2015_is1) (Version: 19.3 - Abelssoft)
PosteRazor (HKLM\...\PosteRazor_is1) (Version: 1.5.2 - Alessandro Portale)
PrintMaster (HKLM\...\{2A304FDE-F4E3-446D-AA0D-31425C897B71}) (Version: - )
QuickTime 7 (HKLM\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.55.0 - Samsung Electronics Co., Ltd.)
Shockwave (HKLM\...\Shockwave) (Version: - )
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SuperEasy Video Converter 3 v.3.0.5019 (HKLM\...\{039BC111-1514-CA51-10AA-5A3FFD6FC015}_is1) (Version: 3.0.5019 - SuperEasy Software GmbH & Co. KG)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME (HKLM\...\{0E09BE17-EDEA-42CA-8974-42A587F51510}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME (HKLM\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: - )
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.51a - Ghisler Software GmbH)
Unity Web Player (HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\...\UnityWebPlayer) (Version: 5.1.3f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VMware Player (Version: 6.0.7 - VMware, Inc.) Hidden
VMware VIX (HKLM\...\{F99FC179-EA67-4BBC-8955-BDDA0CB94B88}) (Version: 1.13.7.62285 - VMware, Inc.)
WEB.DE MailCheck für Internet Explorer (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.4.0 - 1&1 Mail & Media GmbH)
WEB.DE Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
WestwoodOnline (HKLM\...\{BBCD6D56-8A26-4DDE-9482-DBC9C7B7341D}) (Version: 1.0.0.0 - WestwoodOnline)
WinPDFEditor V2.0.2 (HKLM\...\WinPDFEditor_is1) (Version: - hxxp://www.WinPDFEditor.com)
WinSysClean X6 (HKLM\...\WinSysClean X6) (Version: 16.10 - Ultimate Systems, Inc.)
WinSysClean X6 (Version: 16.10 - Ultimate Systems, Inc.) Hidden
YoWindow (HKLM\...\yowindow) (Version: 3 - RepkaSoft)
Zviewer version 2.0.0.10 (HKLM\...\{1B00336F-393F-4DC7-9956-42C69ED6565E}_is1) (Version: 2.0.0.10 - )
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001_Classes\CLSID\{3A999A50-AB25-4A20-90A9-08F71FCE320F}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\HPCDMC32.DLL (HP)
CustomCLSID: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Albert T\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001_Classes\CLSID\{98087D89-B93F-4BCF-A998-AE4D9F607C14}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\HPCDMC32.DLL (HP)
CustomCLSID: HKU\S-1-5-21-4255749936-1666323006-1217971285-1001_Classes\CLSID\{B286F068-5B17-4AE8-989B-8F9A199C47BA}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\HPCDMC32.DLL (HP)
==================== Wiederherstellungspunkte =========================
08-12-2015 17:06:37 Windows Update
08-12-2015 17:12:07 Windows-Sicherung
10-12-2015 16:23:39 Windows Update
16-12-2015 15:13:29 Windows Update
18-12-2015 17:47:34 Windows Update
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0343E8A1-B4A6-4B1A-B892-C7DEBFEE5952} - System32\Tasks\{6CC55069-1671-4AB7-A231-DBF99EC2CFD4} => pcalua.exe -a "C:\Users\Albert T\Desktop\funpix_maker_24mb_d_en.exe" -d "C:\Users\Albert T\Desktop"
Task: {047AA902-7FD9-4D15-8CE7-85EC8580B42D} - System32\Tasks\hdtotal1.1-codedownloader => C:\Program Files\hdtotal1.1\hdtotal1.1-codedownloader.exe <==== ACHTUNG
Task: {056460D2-DAA4-48EE-8F31-72561382B078} - System32\Tasks\{84590D93-D1CC-4A41-9A81-50F61D64DD3A} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.18.0.105/de/go/help.faq.installer?source=lightinstaller&LastError=1638
Task: {068FB51C-FDA8-425C-B0DD-3297C70F86D7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {0864AF73-AF1F-4FB9-98B5-14127555CD5E} - System32\Tasks\free ven-enabler => C:\Program Files\free ven\free ven-enabler.exe
Task: {094D4960-ED06-44FF-9015-F6B15B729EF3} - System32\Tasks\{78BBD6F5-9A96-4164-8BD1-F3ED163790FB} => pcalua.exe -a E:\34856.exe -d E:\
Task: {0994DF5C-04B8-45F6-84E6-DB5A958003C5} - System32\Tasks\hdtotal1.1-updater => C:\Program Files\hdtotal1.1\hdtotal1.1-updater.exe <==== ACHTUNG
Task: {18146AE7-767C-4E57-AB4C-5AF93E2686D7} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [2014-03-19] (SaveSense) <==== ACHTUNG
Task: {19509362-E565-4798-8EB8-E7B7CECCAD7C} - System32\Tasks\free ven-chromeinstaller => C:\Program Files\free ven\free ven-chromeinstaller.exe
Task: {28CABBED-158A-44DD-9CC6-B29DADF1BABA} - System32\Tasks\{2482B005-C749-4F03-8EFE-30A31D52C76D} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.18.73.105.456/de/go/help.faq.installer?LastError=1638
Task: {350FFF23-0F06-4E52-BBBE-6FC25496B3C8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-10] (Adobe Systems Incorporated)
Task: {35A88612-C7B4-4CC3-93B1-532C0743939A} - System32\Tasks\{EC16020F-F6D1-4695-BBB7-63BD2B8182A9} => pcalua.exe -a "C:\Users\Albert T\AppData\Roaming\webssearches\UninstallManager.exe" -c -ptid=tugs <==== ACHTUNG
Task: {3B2F53F6-D9AB-48ED-9BC6-2DC4DAA4545F} - System32\Tasks\APSnotifierPP2 => C:\Program Files\AnyProtectEx\AnyProtect.exe [2014-03-16] (AnyProtect by CMI) <==== ACHTUNG
Task: {49315689-A243-4F87-BCA7-3BE619961474} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {4A5B38FE-5321-464F-8260-DABD96F182E4} - System32\Tasks\free ven-updater => C:\Program Files\free ven\free ven-updater.exe
Task: {5820ADDC-0FEC-45AD-A011-EA7147007693} - System32\Tasks\media enhance-firefoxinstaller => C:\Program Files\media enhance\media enhance-firefoxinstaller.exe <==== ACHTUNG
Task: {588001EE-1B3F-4E10-AC5B-F9C053F927D2} - System32\Tasks\media enhance-updater => C:\Program Files\media enhance\media enhance-updater.exe <==== ACHTUNG
Task: {63D89EA3-3227-4F48-9EE2-61AA28047248} - System32\Tasks\APSnotifierPP3 => C:\Program Files\AnyProtectEx\AnyProtect.exe [2014-03-16] (AnyProtect by CMI) <==== ACHTUNG
Task: {6674904E-40D2-4884-B80F-6A3B3A289E0D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {6D0C1B9E-5E11-420A-B0E0-AF51614EA32A} - System32\Tasks\hdtotal1.1-firefoxinstaller => C:\Program Files\hdtotal1.1\hdtotal1.1-firefoxinstaller.exe <==== ACHTUNG
Task: {6D483484-F779-4A34-B467-56475E9AF9CB} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [2014-03-19] (SaveSense) <==== ACHTUNG
Task: {6F03B3CA-4260-4F4E-A3E8-9852EDED4267} - System32\Tasks\media enhance-enabler => C:\Program Files\media enhance\media enhance-enabler.exe <==== ACHTUNG
Task: {707D7D9F-4787-4232-9213-45F3FE0680DB} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2015-01-12] (1&1 Mail & Media GmbH)
Task: {7C12854C-82F4-4CD8-ACA4-067F33BB7139} - System32\Tasks\free ven-codedownloader => C:\Program Files\free ven\free ven-codedownloader.exe
Task: {8F1D28FF-9EC3-44D0-93E3-38E773882512} - System32\Tasks\{A353CFB0-1686-40BE-BE76-AE157B728498} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.18.73.105.456/de/go/help.faq.installer?LastError=1638
Task: {9369F887-DA1C-4C55-85C7-28A38059010E} - System32\Tasks\{03B54FB3-21DB-4978-AC80-E77CA25386CC} => C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe
Task: {9C2FE121-1258-4EA5-89D8-084FF404FEEA} - System32\Tasks\hdtotal1.1-chromeinstaller => C:\Program Files\hdtotal1.1\hdtotal1.1-chromeinstaller.exe <==== ACHTUNG
Task: {AC261202-1B4F-4E50-8F8E-64E76F2F0ECF} - System32\Tasks\free ven-firefoxinstaller => C:\Program Files\free ven\free ven-firefoxinstaller.exe
Task: {ACF25157-1A8C-4C94-AA6C-8086F1E719BE} - System32\Tasks\Activeris AntiMalware_startup => C:\Program Files\Activeris AntiMalware\ActiverisAntiMalware.exe [2014-01-23] (Activeris) <==== ACHTUNG
Task: {B60BCC4A-916E-47D1-9418-CBE249D947F1} - System32\Tasks\SaveSense => C:\Users\ALBERT~1\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ACHTUNG
Task: {BA0754E1-446E-4A5D-A0C8-E0F81DFB1AC9} - System32\Tasks\{23FF532D-753C-449C-ADBD-3C128C58BE4B} => pcalua.exe -a E:\MediaImpression\setup.exe -d E:\MediaImpression
Task: {BB98CDE0-C257-4F25-81D4-147F7722712E} - System32\Tasks\WashAndGoNGOwnSchedule => C:\Program Files\WashAndGo\WashAndGo.exe [2015-03-18] (Microsoft)
Task: {BCCE838F-2DBF-43DD-A607-A0AB4FD751E0} - System32\Tasks\hdtotal1.1-enabler => C:\Program Files\hdtotal1.1\hdtotal1.1-enabler.exe <==== ACHTUNG
Task: {C2E9FCA6-A6B4-401B-8302-E8644843F44D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {CD0496A0-6A60-49BB-9440-B8879F6E7C5D} - System32\Tasks\{5CFE2475-BE76-4519-9CE0-274073EB3CE0} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.18.73.105.456/de/go/help.faq.installer?LastError=1638
Task: {D0795F20-2FD7-423F-B590-40EEF09E62A8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {E1C41432-8CAD-4986-92C3-28EB69F1F2BE} - System32\Tasks\media enhance-chromeinstaller => C:\Program Files\media enhance\media enhance-chromeinstaller.exe <==== ACHTUNG
Task: {E719D388-9D5F-4EAE-9280-3561D6DFC40D} - System32\Tasks\DivX-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2014-01-10] ()
Task: {E864A062-4A87-4272-85DC-F43CC2804FBF} - System32\Tasks\APSnotifierPP1 => C:\Program Files\AnyProtectEx\AnyProtect.exe [2014-03-16] (AnyProtect by CMI) <==== ACHTUNG
Task: {ED648264-02A4-4014-BF9D-02CFB8767A7B} - System32\Tasks\media enhance-codedownloader => C:\Program Files\media enhance\media enhance-codedownloader.exe <==== ACHTUNG
Task: {F1A2F14F-1960-4828-93FD-FD2134BD3549} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)
Task: {F40CB9E2-2326-4C69-9EE0-1D09256441D0} - System32\Tasks\{758C65C2-C8E7-4888-B3B2-0F8390EE9F1E} => pcalua.exe -a "C:\Users\Albert T\AppData\Roaming\webssearches\UninstallManager.exe" -c -ptid=tugs <==== ACHTUNG
Task: {F4331848-7C61-401D-BE1E-296B49AC3111} - System32\Tasks\AbelssoftPreloader => C:\Program Files\WashAndGo\AbelssoftPreloader.exe [2015-03-18] (Microsoft)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\AbelssoftPreloader.job => C:\Program Files\WashAndGo\AbelssoftPreloader.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ACHTUNG
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ACHTUNG
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ACHTUNG
Task: C:\Windows\Tasks\free ven-chromeinstaller.job => C:\Program Files\free ven\free ven-chromeinstaller.exe <==== ACHTUNG
Task: C:\Windows\Tasks\free ven-codedownloader.job => C:\Program Files\free ven\free ven-codedownloader.exeȲ/reinstallapp /runfrom=task /agentregpath='free ven' /appid=51682 /srcid='001082' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394959155 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /codedownloaddomain=hxxp:/app-static.crossrider.com /defbro=ch /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_code_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\free ven-enabler.job => C:\Program Files\free ven\free ven-enabler.exeȇ/enablebho /agentregpath='free ven' /appid=51682 /srcid='001082' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394959155 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110511161182 /defbro=ch /useiepol /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_enable_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\free ven-firefoxinstaller.job => C:\Program Files\free ven\free ven-firefoxinstaller.exeμ/installxpi /agentregpath='free ven' /extensionfilepath C:\Program Files\free ven\51682.xpi' /appid=51682 /srcid='001082' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394959155 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=e49d3f99-7c89-4eb4-99f3-ff903e2189b2@5288754a-7a48-41a0-a10f-e98c9ac12040.com /extensionversion=0.94 /prefsbranch=ae49d3f997c894eb499f3ff903e2189b25288754a7a4841a0a10fe98c9ac12040com51682 /updateurl=hxxps:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/51682.rdf /extensionname='free ven' /extensiondesc='Feven Shopping Companion' /publishername='freeven' /defbro=ch /allusers /allprofiles /checkfflist /autoupdateulr='hxxp:/update.srvstatsdata.com/ff_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\free ven-updater.job => C:\Program Files\free ven\free ven-updater.exeɐ/runupdater /agentregpath='free ven' /appid=51682 /srcid='001082' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394959155 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /geoserviceurl=hxxp:/ipgeoapi.com/ /updatejsondomain=hxxp:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=hxxp:/stats.mstatsserv.com /autoupdateulr='hxxp:/update.srvstatsdata.com/updater_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\hdtotal1.1-chromeinstaller.job => C:\Program Files\hdtotal1.1\hdtotal1.1-chromeinstaller.exe <==== ACHTUNG
Task: C:\Windows\Tasks\hdtotal1.1-codedownloader.job => C:\Program Files\hdtotal1.1\hdtotal1.1-codedownloader.exeȳ/reinstallapp /runfrom=task /agentregpath='hdtotal1.1' /appid=53360 /srcid='001278' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394730644 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /codedownloaddomain=hxxp:/app-static.crossrider.com /defbro=ch /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_code_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\hdtotal1.1-enabler.job => C:\Program Files\hdtotal1.1\hdtotal1.1-enabler.exeȈ/enablebho /agentregpath='hdtotal1.1' /appid=53360 /srcid='001278' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394730644 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110511331160 /defbro=ch /useiepol /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_enable_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\hdtotal1.1-firefoxinstaller.job => C:\Program Files\hdtotal1.1\hdtotal1.1-firefoxinstaller.exeт/installxpi /agentregpath='hdtotal1.1' /extensionfilepath C:\Program Files\hdtotal1.1\53360.xpi' /appid=53360 /srcid='001278' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394730644 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=9ee595b4-f5ec-4afb-bea5-3c873daf5e4a@9725de39-97db-467b-bf84-04c276190009.com /extensionversion=0.94 /prefsbranch=a9ee595b4f5ec4afbbea53c873daf5e4a9725de3997db467bbf8404c276190009com53360 /updateurl=hxxps:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/53360.rdf /extensionname='hdtotal1.1' /extensiondesc='HD-Total is an add-on for your Internet browser that enhances your online experience by displaying online videos in their highest quality format available.' /publishername='hdtotal' /defbro=ch /allusers /allprofiles /checkfflist /autoupdateulr='hxxp:/update.srvstatsdata.com/ff_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\hdtotal1.1-updater.job => C:\Program Files\hdtotal1.1\hdtotal1.1-updater.exeɑ/runupdater /agentregpath='hdtotal1.1' /appid=53360 /srcid='001278' /subid='0' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394730644 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /geoserviceurl=hxxp:/ipgeoapi.com/ /updatejsondomain=hxxp:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=hxxp:/stats.mstatsserv.com /autoupdateulr='hxxp:/update.srvstatsdata.com/updater_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\media enhance-chromeinstaller.job => C:\Program Files\media enhance\media enhance-chromeinstaller.exe <==== ACHTUNG
Task: C:\Windows\Tasks\media enhance-codedownloader.job => C:\Program Files\media enhance\media enhance-codedownloader.exeɒ/reinstallapp /runfrom=task /agentregpath='media enhance' /appid=44150 /srcid='000555' /subid='verticals-ads,shopping,intext' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394959200 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /codedownloaddomain=hxxp:/app-static.crossrider.com /defbro=ch /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_code_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\media enhance-enabler.job => C:\Program Files\media enhance\media enhance-enabler.exeȧ/enablebho /agentregpath='media enhance' /appid=44150 /srcid='000555' /subid='verticals-ads,shopping,intext' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394959200 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110411411150 /defbro=ch /useiepol /allusers /autoupdateulr='hxxp:/update.srvstatsdata.com/ie_enable_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\media enhance-firefoxinstaller.job => C:\Program Files\media enhance\media enhance-firefoxinstaller.exeϨ/installxpi /agentregpath='media enhance' /extensionfilepath C:\Program Files\media enhance\44150.xpi' /appid=44150 /srcid='000555' /subid='verticals-ads,shopping,intext' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installerfullversion=1.34.3.6 /installationtime=1394959200 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=0c822a17-a68f-4066-9257-d229458d21ca@9c178d17-dc61-4aaf-b2da-1425ac7300ac.com /extensionversion=0.94 /prefsbranch=a0c822a17a68f40669257d229458d21ca9c178d17dc614aafb2da1425ac7300accom44150 /updateurl=hxxps:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/44150.rdf /extensionname='media enhance' /extensiondesc='MediaPlayerEnhance Extension' /publishername='freeven' /defbro=ch /allusers /allprofiles /checkfflist /autoupdateulr='hxxp:/update.srvstatsdata.com/ff_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\media enhance-updater.job => C:\Program Files\media enhance\media enhance-updater.exeɰ/runupdater /agentregpath='media enhance' /appid=44150 /srcid='000555' /subid='verticals-ads,shopping,intext' /zdata='0/' /bic=E50080EF1E494B6693FF112E0556279BIE /verifier=864137a0cae646af864b4d9a7963178e /installerversion=1_34_3_6 /installationtime=1394959200 /statsdomain=hxxp:/stats.srvstatsdata.com /errorsdomain=hxxp:/errors.srvstatsdata.com /geoserviceurl=hxxp:/ipgeoapi.com/ /updatejsondomain=hxxp:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=hxxp:/stats.mstatsserv.com /autoupdateulr='hxxp:/update.srvstatsdata.com/updater_agent_updates/{CAMP_ID}/update.jso <==== ACHTUNG
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\ALBERT~1\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ACHTUNG
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ACHTUNG
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe <==== ACHTUNG
Task: C:\Windows\Tasks\WashAndGoNGOwnSchedule.job => C:\Program Files\WashAndGo\WashAndGo.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-02-13 03:20 - 2015-02-13 03:20 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 15:27 - 2015-05-15 15:27 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2010-07-04 22:32 - 2010-07-04 22:32 - 00004608 _____ () C:\Program Files\Unlocker\UnlockerHook.dll
2010-07-04 22:32 - 2010-07-04 22:32 - 00010752 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-03-16 09:39 - 2012-09-26 15:31 - 00886272 _____ () C:\Program Files\Activeris AntiMalware\System.Data.SQLite.dll
2014-03-16 09:39 - 2014-01-23 19:04 - 01718264 _____ () C:\Program Files\Activeris AntiMalware\acrissys.dll
2014-03-16 09:39 - 2012-09-26 15:31 - 00168448 _____ () C:\Program Files\Activeris AntiMalware\UNRAR.DLL
2014-02-14 06:17 - 2014-02-14 06:17 - 01392640 _____ () C:\Program Files\DivX\DivX Media Server\DivXDLNATranscoder.dll
2010-07-04 20:51 - 2010-07-04 20:51 - 00017408 _____ () C:\Program Files\Unlocker\UnlockerAssistant.exe
2014-01-20 08:48 - 2014-01-20 08:48 - 02611808 _____ () C:\Program Files\Rainlendar2\Rainlendar2.exe
2012-05-16 20:01 - 2012-05-16 20:01 - 00140800 _____ () C:\Program Files\Rainlendar2\lua52.dll
2014-01-04 18:20 - 2014-01-04 18:20 - 00249344 _____ () C:\Program Files\Rainlendar2\libical.dll
2014-01-20 08:48 - 2014-01-20 08:48 - 00060512 _____ () C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
2014-01-04 18:00 - 2014-01-04 18:00 - 00065024 _____ () C:\Program Files\Rainlendar2\libicalss.dll
2012-06-17 14:22 - 2012-06-17 14:22 - 00012800 _____ () C:\Program Files\Rainlendar2\lfs.dll
2015-06-04 12:19 - 2015-06-04 12:19 - 00140288 _____ () C:\Program Files\MyDrive Connect\quazip.dll
2014-09-11 16:06 - 2014-09-11 16:06 - 00878592 _____ () C:\Program Files\MyDrive Connect\Plugins\platforms\qwindows.dll
2014-09-11 16:05 - 2014-09-11 16:05 - 00036352 _____ () C:\Program Files\MyDrive Connect\Plugins\bearer\qgenericbearer.dll
2014-09-11 16:06 - 2014-09-11 16:06 - 00038912 _____ () C:\Program Files\MyDrive Connect\Plugins\bearer\qnativerwifibearer.dll
2014-09-11 16:14 - 2014-09-11 16:14 - 00032256 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qdds.dll
2014-09-11 16:05 - 2014-09-11 16:05 - 00021504 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qgif.dll
2014-09-11 16:14 - 2014-09-11 16:14 - 00027648 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qicns.dll
2014-09-11 16:05 - 2014-09-11 16:05 - 00021504 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qico.dll
2014-09-11 16:14 - 2014-09-11 16:14 - 00381952 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qjp2.dll
2014-09-11 16:05 - 2014-09-11 16:05 - 00204800 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qjpeg.dll
2014-09-11 16:14 - 2014-09-11 16:14 - 00218112 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qmng.dll
2014-09-11 16:08 - 2014-09-11 16:08 - 00015872 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qsvg.dll
2014-09-11 16:14 - 2014-09-11 16:14 - 00015360 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qtga.dll
2014-09-11 16:15 - 2014-09-11 16:15 - 00307712 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qtiff.dll
2014-09-11 16:15 - 2014-09-11 16:15 - 00014848 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qwbmp.dll
2014-09-11 16:15 - 2014-09-11 16:15 - 00252928 _____ () C:\Program Files\MyDrive Connect\Plugins\imageformats\qwebp.dll
2015-10-16 17:39 - 2015-10-08 15:32 - 00954592 _____ () C:\Program Files\Andy\HandyAndy.exe
2015-06-24 13:28 - 2015-06-24 13:28 - 01301720 _____ () C:\Program Files\VMware\VMware Player\libxml2.dll
2015-10-16 17:39 - 2015-09-09 23:12 - 00869600 _____ () C:\Program Files\Andy\AndyPriorityMgr.exe
2012-05-10 12:28 - 2012-05-10 12:28 - 00033392 _____ () C:\Program Files\ACD Systems\ACDSee\16.0\XalanMessages_1_10.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-4255749936-1666323006-1217971285-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Albert T\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist deaktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== FirewallRules (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{E414EA2A-C45D-427D-87CD-906AE4AA8B72}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{3C5C8F0C-31D1-4F13-B5AF-702765363514}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{84D66737-A33F-4A01-9899-0AC3D7BE6E66}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{AE9778E8-B573-48F7-9EFC-225538901A71}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{C178702B-6B84-4732-9F8F-4AEA0D1B3556}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{BD6561D9-84B7-4B2A-8DE0-9ED5A8088423}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{447CFB50-85A0-4100-BFBA-8ED4BFA9FFC0}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{8831296C-4BC2-45A2-8091-54A9B9794545}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{2745DB2C-477D-4C85-81A5-3AC2025AAE3E}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{21C51713-CD1E-4646-9037-DF4C46AB7EE0}] => (Allow) C:\Program Files\Winamp\winamp.exe
FirewallRules: [{BEBD8AEE-3F73-4FA4-A1B4-7EE969B2C448}] => (Allow) C:\Program Files\Winamp\winamp.exe
FirewallRules: [{1A98A936-C003-4DDE-A5DA-931B673C85B5}] => (Allow) C:\Program Files\Nero\KM\KwikMedia.exe
FirewallRules: [{9390D785-6FBC-461A-8508-C980E655DD30}] => (Allow) C:\Program Files\Nero\KM\KwikMedia.exe
FirewallRules: [TCP Query User{260F4554-9B7D-4B4B-B493-B467DA70AF64}C:\program files\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{95AEBA1B-6F0D-4C5D-B7A0-AFF3BFB4EE49}C:\program files\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [TCP Query User{BF5E5333-970A-46BE-A249-5D3E377F0ECA}C:\program files\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{BCDADDBA-4109-4933-B3AB-8480410CA4D0}C:\program files\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [{9C16571C-A000-4831-BE6C-0AD1E26B000D}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{C6152A9C-7169-45C7-B10B-6B4DD1CD58AA}C:\program files\divx\divx media server\divxmediaserver.exe] => (Allow) C:\program files\divx\divx media server\divxmediaserver.exe
FirewallRules: [UDP Query User{3E453494-294F-4B97-AB12-ADB12436BDFB}C:\program files\divx\divx media server\divxmediaserver.exe] => (Allow) C:\program files\divx\divx media server\divxmediaserver.exe
FirewallRules: [TCP Query User{9AE518B1-2D20-4CAC-80C8-27695C09297D}C:\program files\divx\divx media server\divxmediaserver.exe] => (Allow) C:\program files\divx\divx media server\divxmediaserver.exe
FirewallRules: [UDP Query User{87AD559E-890B-4B14-825D-65118AA58FB3}C:\program files\divx\divx media server\divxmediaserver.exe] => (Allow) C:\program files\divx\divx media server\divxmediaserver.exe
FirewallRules: [{6B08F12A-C922-4B5D-A3D0-8B9263C6E205}] => (Allow) C:\Program Files\Origin Games\Command and Conquer Generals Zero Hour\Generals.exe
FirewallRules: [{0074EE32-8E61-47F6-BDC5-61F471D1D894}] => (Allow) C:\Program Files\Origin Games\Command and Conquer Generals Zero Hour\Generals.exe
FirewallRules: [{E93E6AE2-99EA-4804-898B-4DDD67FE1522}] => (Allow) C:\Program Files\Origin Games\Renegade\RenegadeLauncher.exe
FirewallRules: [{CA6097C1-4F05-492A-8CD4-BF01DBA8E3BD}] => (Allow) C:\Program Files\Origin Games\Renegade\RenegadeLauncher.exe
FirewallRules: [TCP Query User{4D38775B-2A06-4121-9B93-826F9B2B7D49}C:\program files\ipcsearch\ipcsearch.exe] => (Allow) C:\program files\ipcsearch\ipcsearch.exe
FirewallRules: [UDP Query User{4AC48D5B-384B-451E-A48E-7705AE3A0D81}C:\program files\ipcsearch\ipcsearch.exe] => (Allow) C:\program files\ipcsearch\ipcsearch.exe
FirewallRules: [{A8A2B79C-A34B-4381-9195-6A0324CEFD25}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{21EB3EE4-FB30-401D-A12F-25466C7ADE4F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FCC9E9EB-2BEA-429F-B128-21A6A28F36FB}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{4AF503A5-83DB-43BA-9F1E-58BA30D16B59}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{EECD4B6E-722E-414A-805A-3CA30E3ABC72}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe
FirewallRules: [{2E537DE0-1A68-4570-A1EB-E904A387C0A3}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe
FirewallRules: [{08B642C4-F089-4C51-88A9-4BA4B7CD12A9}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe
FirewallRules: [{146AF659-2ED2-48F4-9BB0-434F0CEC92B4}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe
FirewallRules: [{FBB4D50C-6F46-4CBA-BC11-484CE0D26B2C}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe
FirewallRules: [{6A63F980-2124-4708-B814-17B8AF9092B4}] => (Allow) C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe
FirewallRules: [{5F2A42A6-846A-4F05-BF95-565C15BE21F6}] => (Allow) C:\Program Files\Origin Games\Command and Conquer 3\CNC3Launcher.exe
FirewallRules: [{F5FC28CB-DC20-4EB1-8ACB-FC2C9798BF04}] => (Allow) C:\Program Files\Origin Games\Command and Conquer 3\CNC3Launcher.exe
FirewallRules: [{EA4423AB-A1CA-440A-9464-0E35004BECB8}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{9AE380B0-77C7-4524-A2AC-9A41CD15994F}] => (Allow) C:\WarThunder\bpreport.exe
FirewallRules: [{D8812325-4A81-44A8-9A5E-C4AFE0328331}] => (Allow) C:\WarThunder\bpreport.exe
FirewallRules: [{CF1A38C7-0482-43FF-B978-9F526127E07F}] => (Allow) C:\Program Files\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{D1335D2B-E871-48B2-BB96-CE11E80954D8}] => (Allow) C:\Program Files\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{2DC3DE3E-261D-40B8-BF62-16F8DD840E3D}] => (Allow) C:\Users\Albert T\AppData\Roaming\Andy_45_Online\Setup.exe
FirewallRules: [{C5AEB860-E550-4291-A4D8-F661EDFFB38C}] => (Allow) C:\Users\Albert T\AppData\Roaming\Andy_45_Online\Setup.exe
FirewallRules: [{61D501F4-E14B-4823-9E26-27D5613914D0}] => (Allow) C:\Program Files\Andy\Andy.exe
FirewallRules: [{92D9F5E7-04BD-4016-A0B0-FEFB30232AAF}] => (Allow) C:\Program Files\Andy\Andy.exe
FirewallRules: [{01960008-5807-4F55-B03A-EE20E2D9570A}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [{16547808-EB7E-4AFF-95AC-6506A1B94388}] => (Allow) C:\Program Files\Andy\HandyAndy.exe
FirewallRules: [TCP Query User{A36BA822-85D0-4D98-8C09-6F5BD7284516}C:\program files\zviewer\zviewer.exe] => (Allow) C:\program files\zviewer\zviewer.exe
FirewallRules: [UDP Query User{DD3EF7CE-BD4E-4B29-9C70-F64044CC5DC3}C:\program files\zviewer\zviewer.exe] => (Allow) C:\program files\zviewer\zviewer.exe
FirewallRules: [{20938243-3F4E-42A1-AE93-7D581811607B}] => (Block) C:\program files\zviewer\zviewer.exe
FirewallRules: [{2E0CEB0B-0859-4DDF-9367-0FE7859BB703}] => (Block) C:\program files\zviewer\zviewer.exe
FirewallRules: [{FE9A46EF-E9CA-40A5-8BF8-BB6F9B7C287D}] => (Allow) LPort=80
FirewallRules: [{2696A5BC-3A90-42A1-91ED-D8B534DA859C}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
Name: VMware Virtual Ethernet Adapter for VMnet1
Description: VMware Virtual Ethernet Adapter for VMnet1
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: VMware Virtual Ethernet Adapter for VMnet8
Description: VMware Virtual Ethernet Adapter for VMnet8
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: cyberJack RFID standard
Description: cyberJack RFID standard
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (12/21/2015 05:40:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18847, Zeitstempel: 0x554d7b00
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x15e0
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Error: (12/21/2015 05:40:35 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.MissingMethodException
Stack:
at Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
at Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
at System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
at Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/21/2015 05:40:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18847, Zeitstempel: 0x554d7b00
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x788
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Error: (12/21/2015 05:40:21 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.MissingMethodException
Stack:
at Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
at Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
at System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
at Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/21/2015 05:40:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18847, Zeitstempel: 0x554d7b00
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xf78
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Error: (12/21/2015 05:39:47 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.MissingMethodException
Stack:
at Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
at Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
at System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
at Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/20/2015 10:41:56 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "R:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
Error: (12/20/2015 10:33:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18847, Zeitstempel: 0x554d7b00
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xf14
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Error: (12/20/2015 10:33:01 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.MissingMethodException
Stack:
at Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
at Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
at Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
at System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
at Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/20/2015 10:32:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18847, Zeitstempel: 0x554d7b00
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xdf8
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Systemfehler:
=============
Error: (12/21/2015 05:40:35 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (12/21/2015 05:40:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/21/2015 05:40:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/21/2015 05:38:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Fortunitas" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/21/2015 05:38:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (12/21/2015 05:38:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Computer Backup (MyPC Backup) erreicht.
Error: (12/20/2015 10:33:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (12/20/2015 10:32:48 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/20/2015 10:32:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/20/2015 10:32:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Fortunitas" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz
Prozentuale Nutzung des RAM: 80%
Installierter physikalischer RAM: 2046.49 MB
Verfügbarer physikalischer RAM: 396.35 MB
Summe virtueller Speicher: 4092.98 MB
Verfügbarer virtueller Speicher: 1860.71 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:232.88 GB) (Free:45.96 GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive d: (DATEN) (Fixed) (Total:232.88 GB) (Free:66.78 GB) NTFS
Drive g: () (Removable) (Total:7.5 GB) (Free:5.63 GB) FAT32
Drive r: (Musik) (Fixed) (Total:1863.01 GB) (Free:216.4 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: 28A728A6)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: B841690F)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
========================================================
Disk: 11 (Size: 1863 GB) (Disk ID: 0A684606)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
========================================================
Disk: 13 (Size: 7.5 GB) (Disk ID: 04DD5721)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)
==================== Ende vom Addition.txt ============================
|
Hinweis: 
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
SecurityCheck und:
dann auf 
und dann auf 
. 
