search

dragokas / hijackthis

A free utility that finds malware, adware and other security threats
http://hjt.sf.net
GNU General Public License v2.0
681 stars 107 forks source link

HijackThis Log: Bitte helft mir es zu prüfen #77

Closed ghost closed 4 years ago

ghost commented 4 years ago

Logfile of HiJackThis Fork (Beta) by Alex Dragokas v.2.8.0.4

Platform: x64 Windows 10 (Pro), 10.0.17134.950 (ReleaseId: 1803), Service Pack: 0 Time: 16.08.2019 - 11:14 (UTC+02:00) Language: OS: German (0x407). Display: German (0x407). Non-Unicode: German (0x407) Elevated: Yes Ran by: Pastor (group: Administrator) on MICHL-THINKPAD, FirstRun: yes

Firefox: 68.0.1.7137 Edge: 11.0.17134.915 Internet Explorer: 11.0.17134.1 Default: "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Firefox)

Boot mode: Normal

Running processes: Number | Path 1 C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe 1 C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe 1 C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE 1 C:\Program Files\CONEXANT\SAII\SmartAudio.exe 1 C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe 2 C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 1 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 1 C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe 1 C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe 1 C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe 7 C:\Program Files\Mozilla Firefox\firefox.exe 1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.50.38.0_x64kzf8qxf38zg5c\SkypeApp.exe 1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.50.38.0_x64kzf8qxf38zg5c\SkypeBackgroundHost.exe 1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.50.38.0_x64kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 1 C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19031.11411.0_x648wekyb3d8bbwe\Video.UI.exe 1 C:\Program Files\rempl\sedlauncher.exe 1 C:\Program Files\rempl\sedsvc.exe 1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MpCmdRun.exe 1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\MsMpEng.exe 1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1907.4-0\NisSrv.exe 1 C:\Users\Pastor\Desktop\HiJackThis\HiJackThis_v2.8.0.4.exe 1 C:\Users\Pastor\Desktop\HiJackThis\MemCompression 1 C:\Users\Pastor\Desktop\HiJackThis\Registry 1 C:\Windows\RtsCM64.exe 1 C:\Windows\SysWOW64\Lenovo\PowerMgr\PowerMgr.exe 1 C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 5 C:\Windows\System32\RuntimeBroker.exe 1 C:\Windows\System32\SearchFilterHost.exe 1 C:\Windows\System32\SearchIndexer.exe 1 C:\Windows\System32\SearchProtocolHost.exe 1 C:\Windows\System32\SecurityHealthService.exe 1 C:\Windows\System32\SettingSyncHost.exe 1 C:\Windows\System32\SgrmBroker.exe 4 C:\Windows\System32\WUDFHost.exe 1 C:\Windows\System32\audiodg.exe 2 C:\Windows\System32\conhost.exe 2 C:\Windows\System32\csrss.exe 1 C:\Windows\System32\ctfmon.exe 1 C:\Windows\System32\dasHost.exe 2 C:\Windows\System32\dllhost.exe 1 C:\Windows\System32\dwm.exe 2 C:\Windows\System32\fontdrvhost.exe 1 C:\Windows\System32\lsass.exe 1 C:\Windows\System32\services.exe 1 C:\Windows\System32\sihost.exe 1 C:\Windows\System32\smartscreen.exe 1 C:\Windows\System32\smss.exe 1 C:\Windows\System32\spoolsv.exe 78 C:\Windows\System32\svchost.exe 1 C:\Windows\System32\taskhostw.exe 2 C:\Windows\System32\wbem\WmiPrvSE.exe 1 C:\Windows\System32\wininit.exe 1 C:\Windows\System32\winlogon.exe 1 C:\Windows\System32\wlanext.exe 1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 1 C:\Windows\explorer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main: [Default_Page_URL] = http://lenovo15.msn.com/?pc=LCTE R0 - HKCU\Software\Microsoft\Internet Explorer\Main: [Start Page] = http://lenovo15.msn.com/?pc=LCTE R4 - SearchScopes: HKLM\Software\Microsoft\Internet Explorer\SearchScopes{CCDBF480-D4F7-4246-9350-8E38D60A0FCB} [URL] = http://www.bing.com/search?q={SearchTerms}&form=PRLNC1&src=IE11TR&pc=LCTE - Bing O2-32 - HKLM..\BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll O4 - HKCU..\StartupApproved\Run: [Amazon Music Helper] (2019/06/27) = C:\Users\Pastor\AppData\Local\Amazon Music\Amazon Music Helper.exe O4 - HKCU..\StartupApproved\Run: [Amazon Music] (2019/06/27) = C:\Users\Pastor\AppData\Local\Amazon Music\Amazon Music.exe O4 - HKCU..\StartupApproved\Run: [OneDrive] (2017/11/06) = C:\Users\Pastor\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background O4 - HKCU..\StartupApproved\StartupFolder: C:\Users\Pastor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr (2019/08/16) O4 - HKCU..\StartupApproved\StartupFolder: C:\Users\Pastor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagentaCLOUD.lnk -> C:\Program Files (x86)\Telekom\MagentaCloud\MagentaCloud.App.exe /hideexp (2017/11/07) O4 - HKLM..\StartupApproved\Run32: [CaptureOnTouch] (2017/11/14) = C:\Program Files (x86)\Canon Electronics\CaptureOnTouch\TouchDR.exe LOGON O4 - HKLM..\StartupApproved\Run32: [PDFPrint] (2018/02/17) = C:\Program Files (x86)\PDF24\pdf24.exe O4 - HKLM..\StartupApproved\Run32: [Wondershare Helper Compact.exe] (2018/02/17) = C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (file missing) O4 - HKLM..\StartupApproved\Run: [CDAServer] (2019/08/16) = C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe O4 - HKLM..\StartupApproved\Run: [Canon DR-F120 SVC] (2017/11/14) = C:\WINDOWS\system32\rundll32.exe DRF120Svc.dll, EntryPointUserMessage O4 - HKLM..\StartupApproved\Run: [DAX2_APP] (2019/08/16) = C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe -Hide O4 - HKLM..\StartupApproved\Run: [IAStorIcon] (2019/08/16) = C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60 O4 - HKLM..\StartupApproved\Run: [Intel(R) WiDi Receiver Updater] (2019/08/16) = C:\Program Files\Intel Corporation\Intel WiDi\WRU.exe O4 - HKLM..\StartupApproved\Run: [SecurityHealth] (1601/01/01) = C:\Program Files\Windows Defender\MSASCuiL.exe O4 - HKU\S-1-5-19..\RunOnce: [WAB Migrate] = C:\Program Files\Windows Mail\wab.exe /Upgrade O4 - HKU\S-1-5-20..\RunOnce: [WAB Migrate] = C:\Program Files\Windows Mail\wab.exe /Upgrade O4 - Startup other users: C:\Users\micha.MICHL-THINKPAD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe O4 - Startup other users: C:\Users\micha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe O4 - User Startup: C:\Users\Pastor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe O4-32 - HKLM..\Run: [Dropbox] = C:\Program Files (x86)\Dropbox\Client\Dropbox.exe /systemstartup O4-32 - HKLM..\Run: [OneLinkManager] = C:\Program Files (x86)\Lenovo\OneLink Plus Dock\onelinkpromgn.exe 1.10.11 O8 - Context menu item: HKCU..\Internet Explorer\MenuExt: Auswahl speichern - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html O8 - Context menu item: HKCU..\Internet Explorer\MenuExt: Bild ausschneiden - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html O8 - Context menu item: HKCU..\Internet Explorer\MenuExt: Diese Seite ausschneiden - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html O8 - Context menu item: HKCU..\Internet Explorer\MenuExt: Lesezeichen ausschneiden - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html O8 - Context menu item: HKCU..\Internet Explorer\MenuExt: Neue Notiz - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html O9 - Button: HKLM..{A95fe080-8f5d-11d2-a20b-00aa003c157a} - Zu Evernote 5 hinzufügen - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html O9 - Tools menu item: HKLM..{A95fe080-8f5d-11d2-a20b-00aa003c157a} - Zu Evernote 5 hinzufügen - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html O9-32 - Button: HKLM..{A95fe080-8f5d-11d2-a20b-00aa003c157a} - Zu Evernote 5 hinzufügen - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html O9-32 - Tools menu item: HKLM..{A95fe080-8f5d-11d2-a20b-00aa003c157a} - Zu Evernote 5 hinzufügen - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html O17 - DHCP DNS 1: 192.168.178.1 O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt1 Class - {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt10 Class - {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt2 Class - {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt3 Class - {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt4 Class - {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt5 Class - {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt6 Class - {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt7 Class - {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt8 Class - {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt9 Class - {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.0.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconCheck - {b7b0d424-a770-3aa5-bc41-7b22630baf90} - C:\WINDOWS\system32\mscoree.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconCheckCrypt - {ab58f8ac-bdc5-3302-833b-2514ed63c02f} - C:\WINDOWS\system32\mscoree.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconError - {96f27ec5-eacf-3396-aebb-cce5d548de0b} - C:\WINDOWS\system32\mscoree.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconErrorCrypt - {af4c81f3-7135-330a-8bc4-b60cf09eb2d5} - C:\WINDOWS\system32\mscoree.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconSync - {22c54ed0-276d-3eb1-b4b4-b8a856a3b282} - C:\WINDOWS\system32\mscoree.dll O21 - HKLM..\ShellIconOverlayIdentifiers: MagentaOverlayIconSyncCrypt - {e7809f7e-3be0-37da-8846-f96e172e2711} - C:\WINDOWS\system32\mscoree.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt1 Class - {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt10 Class - {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt2 Class - {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt3 Class - {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt4 Class - {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt5 Class - {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt6 Class - {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt7 Class - {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt8 Class - {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O21-32 - HKLM..\ShellIconOverlayIdentifiers: DropboxExt9 Class - {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} - C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.0.dll O22 - Task (Job): (Not scheduled) DropboxUpdateTaskMachineCore.job - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /c O22 - Task (Job): (Not scheduled) DropboxUpdateTaskMachineUA.job - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /ua /installsource scheduler O22 - Task (Job): (disabled) (Not scheduled) CreateExplorerShellUnelevatedTask.job - C:\WINDOWS\explorer.exe /NOUACCHECK O22 - Task: (disabled) USER_ESRV_SVC_QUEENCREEK - C:\WINDOWS\System32\Wscript.exe //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs" O22 - Task: (disabled) \Microsoft\Windows\HelloFace\FODCleanupTask - C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe (Microsoft) O22 - Task: (disabled) \Microsoft\Windows\InstallService\WakeUpAndContinueUpdates - {0DC331EE-8438-49D5-A721-E10B937CE459} - C:\Windows\System32\InstallServiceTasks.dll (Microsoft) O22 - Task: (disabled) \Microsoft\Windows\InstallService\WakeUpAndScanForUpdates - {D5A04D91-6FE6-4FE4-A98A-FEB4500C5AF7} - C:\Windows\System32\InstallServiceTasks.dll (Microsoft) O22 - Task: (telemetry) \Intel\Intel Telemetry 2 - C:\Program Files\Intel\Telemetry 2.0\lrio.exe O22 - Task: (telemetry) \Microsoft\Office\Office Subscription Maintenance - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe (Microsoft) O22 - Task: Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe O22 - Task: Adobe Flash Player NPAPI Notifier - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_192_Plugin.exe -check plugin O22 - Task: DropboxUpdateTaskMachineCore - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /c O22 - Task: DropboxUpdateTaskMachineUA - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /ua /installsource scheduler O22 - Task: IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 - C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (file missing) O22 - Task: IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe --automatic O22 - Task: IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe --automatic O22 - Task: IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec - C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe --automatic O22 - Task: IntelWiDi-Upgrade-91ba0caa-28a7-4f47-8d08-f71b4b10fbec-Logon - C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe --automatic O22 - Task: Lenovo Power Management Driver PnP Task - C:\WINDOWS\System32\ibmpmsvc.exe -PnPTask O22 - Task: RtsCM - C:\WINDOWS\RtsCM64.exe O22 - Task: \Lenovo\DisableAndStopOSK - C:\Program Files (x86)\Lenovo\WRITEit\DisableOSKCommand.exe O22 - Task: \Lenovo\EnableAndStartOSK - C:\Program Files (x86)\Lenovo\WRITEit\EnableOSKCommand.exe O22 - Task: \Lenovo\ImController\Lenovo iM Controller Monitor - C:\WINDOWS\system32\ImController.InfInstaller.exe -checkremoval O22 - Task: \Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance - C:\WINDOWS\system32\sc.exe START ImControllerService O22 - Task: \Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask - C:\WINDOWS\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32 O22 - Task: \Lenovo\ImController\TimeBasedEvents\69e4bf1a-6dde-404d-9a60-c4362704d185 - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe /timebasedeventtrigger 69e4bf1a-6dde-404d-9a60-c4362704d185 O22 - Task: \Lenovo\ImController\TimeBasedEvents\a0459a0f-188c-48f9-922e-b875538a02d5 - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe /timebasedeventtrigger a0459a0f-188c-48f9-922e-b875538a02d5 O22 - Task: \Lenovo\LSC\LSCHardwareScan - C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe -diag HWScan O22 - Task: \Lenovo\LSC\LSCHardwareScanPostpone - C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe -diag HWScan O22 - Task: \Lenovo\LSC\Lenovo Solution Center Notifications - C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe /show O22 - Task: \Lenovo\Lenovo Customer Feedback Program 64 - C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe O22 - Task: \Lenovo\Lenovo Service Bridge\S-1-5-21-29348351-1471581154-3195188587-1001 - C:\Users\micha\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSBUpdater.exe O22 - Task: \Lenovo\Lenovo Solution Center Launcher - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.UpdateStatusService.exe UpdateStatus O22 - Task: \Lenovo\Power Manager\Background monitor - C:\WINDOWS\SysWOW64\Lenovo\PowerMgr\PowerMgr.exe O22 - Task: \Lenovo\Power Manager\Uninstall task - C:\WINDOWS\SysWOW64\Lenovo\PowerMgr\PowerMgrInst.exe -checkremoval O22 - Task: \Lenovo\QuicknoteLock - C:\Program Files (x86)\Lenovo\WRITEit\WRITEit-Lockscreen.exe /lock O22 - Task: \Lenovo\QuicknoteUnlock - C:\Program Files (x86)\Lenovo\WRITEit\WRITEit-Lockscreen.exe /unlock O22 - Task: \Lenovo\TouchInject - C:\Program Files (x86)\Lenovo\WRITEit\WRITEit-InjectTouch.exe O22 - Task: \Microsoft\Office\Office Automatic Updates 2.0 - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /frequentupdate SCHEDULEDTASK displaylevel=False (Microsoft) O22 - Task: \Microsoft\Office\Office ClickToRun Service Monitor - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /WatchService (Microsoft) O22 - Task: \Microsoft\Office\Office Feature Updates - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe (Microsoft) O22 - Task: \Microsoft\Office\Office Feature Updates Logon - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\sdxhelper.exe /onlogon (Microsoft) O22 - Task: \Microsoft\Office\OfficeBackgroundTaskHandlerLogon - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe (Microsoft) O22 - Task: \Microsoft\Office\OfficeBackgroundTaskHandlerRegistration - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe (Microsoft) O22 - Task: \Microsoft\Windows\Conexant\AFA - C:\Program Files\CONEXANT\cAudioFilterAgent\SACpl.exe /uid:cAudioFilterAgent /delay:45 O22 - Task: \Microsoft\Windows\Conexant\SA2 - C:\Program Files\CONEXANT\SAII\SACpl.exe /c /delay:30 O22 - Task: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceLocationRightsChange - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -SettingChange - C:\WINDOWS\system32\DeviceDirectoryClient.dll (Microsoft) O22 - Task: \Microsoft\Windows\DeviceDirectoryClient\RegisterDevicePolicyChange - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -SettingChange - C:\WINDOWS\system32\DeviceDirectoryClient.dll (Microsoft) O22 - Task: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceProtectionStateChanged - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -ProtectionStateChanged -FreeNetworkOnly - C:\WINDOWS\system32\DeviceDirectoryClient.dll (Microsoft) O22 - Task: \Microsoft\Windows\DeviceDirectoryClient\RegisterDeviceWnsFallback - {AE31B729-D5FD-401E-AF42-784074835AFE},-RegisterDevice -Periodic - C:\WINDOWS\system32\DeviceDirectoryClient.dll (Microsoft) O22 - Task: \Microsoft\Windows\DirectX\DXGIAdapterCache - C:\WINDOWS\system32\dxgiadaptercache.exe (Microsoft) O22 - Task: \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures - {59EECBFE-C2F5-4419-9B99-13FE05FF2675} - C:\WINDOWS\System32\fcon.dll (Microsoft) O22 - Task: \Microsoft\Windows\InstallService\ScanForUpdates - {A558C6A5-B42B-4C98-B610-BF9559143139} - C:\Windows\System32\InstallServiceTasks.dll (Microsoft) O22 - Task: \Microsoft\Windows\InstallService\ScanForUpdatesAsUser - {DDAFAEA2-8842-4E96-BADE-D44A8D676FDB} - C:\Windows\System32\InstallServiceTasks.dll (Microsoft) O22 - Task: \Microsoft\Windows\InstallService\SmartRetry - {F3A219C3-2698-4CBF-9C07-037EDB8E72E6} - C:\Windows\System32\InstallServiceTasks.dll (Microsoft) O22 - Task: \Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources - {D0582E3B-3126-4CAA-9155-AC37C912A489} - C:\WINDOWS\System32\LanguageOverlayServer.dll (Microsoft) O22 - Task: \Microsoft\Windows\PLA\LSC Memory - C:\Windows\system32\rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)" O22 - Task: \Microsoft\Windows\Speech\HeadsetButtonPress - C:\WINDOWS\system32\speech_onecore\common\SpeechRuntime.exe StartedFromTask (Microsoft) O22 - Task: \Microsoft\Windows\UpdateOrchestrator\AC Power Download - C:\WINDOWS\system32\usoclient.exe StartDownload (Microsoft) O22 - Task: \Microsoft\Windows\WaaSMedic\PerformRemediation - {72566E27-1ABB-4EB3-B4F0-EB431CB1CB32},None - C:\WINDOWS\System32\WaaSMedicSvc.dll (Microsoft) O22 - Task: \Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe -IdleTask -TaskName WdCacheMaintenance O22 - Task: \Microsoft\Windows\Windows Defender\Windows Defender Cleanup - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe -IdleTask -TaskName WdCleanup O22 - Task: \Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe Scan -ScheduleJob -ScanTrigger 55 O22 - Task: \Microsoft\Windows\Windows Defender\Windows Defender Verification - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MpCmdRun.exe -IdleTask -TaskName WdVerification O22 - Task: \Microsoft\Windows\rempl\shell - C:\Program Files\rempl\sedlauncher.exe (Microsoft) O22 - Task: \TVT\TVSUUpdateTask - C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe /CM -search R -action INSTALL -includerebootpackages 1,3,4 -noicon -noreboot -nolicense -defaultupdate -schtask O22 - Task: \TVT\TVSUUpdateTask_UserLogOn - C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe PendingTask O22 - Task: \WiseCleaner\WRCSkipUAC - C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe $UAC O23 - Service R2: Microsoft Office-Klick-und-Los-Dienst - (ClickToRunSvc) - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe /service O23 - Service R2: System Interface Foundation Service - (ImControllerService) - C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe O23 - Service R2: Windows Defender Antivirus Service - (WinDefend) - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe O23 - Service R2: Windows Remediation Service - (sedsvc) - C:\Program Files\rempl\sedsvc.exe O23 - Service R3: Windows Defender Antivirus-Netzwerkinspektionsdienst - (WdNisSvc) - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\NisSrv.exe O23 - Service S2: Adobe Acrobat Update Service - (AdobeARMservice) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service S2: BiometricSensorDataSynchronization - (valWbioSyncSvc) - C:\WINDOWS\system32\valWbioSyncSvc.exe O23 - Service S2: Conexant Audio Message Service - (CxAudMsg) - C:\WINDOWS\system32\CxAudMsg64.exe O23 - Service S2: Conexant SmartAudio service - (SAService) - C:\WINDOWS\system32\SAsrv.exe O23 - Service S2: CxUtilSvc - C:\Program Files\Conexant\SAII\CxUtilSvc.exe O23 - Service S2: DbxSvc - C:\WINDOWS\system32\DbxSvc.exe O23 - Service S2: Dolby DAX2 API Service - C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe O23 - Service S2: Dropbox-Update-Service (dbupdate) - (dbupdate) - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /svc O23 - Service S2: EMC Captiva Cloud Service - (Emc.Captiva.WebCaptureService) - C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe O23 - Service S2: Elan Service - (ETDService) - C:\Program Files\Elantech\ETDService.exe O23 - Service S2: Intel Bluetooth Service - (ibtsiva) - C:\WINDOWS\system32\ibtsiva.exe O23 - Service S2: Intel(R) Content Protection HDCP Service - (cplspcon) - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_11890c3a16cefa51\IntelCpHDCPSvc.exe O23 - Service S2: Intel(R) Driver & Support Assistant - (DSAService) - C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe O23 - Service S2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe O23 - Service S2: Intel(R) HD Graphics Control Panel Service - (igfxCUIService2.0.0.0) - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_11890c3a16cefa51\igfxCUIService.exe O23 - Service S2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe O23 - Service S2: Intel(R) PROSet/Wireless Event Log - (EvtEng) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service S2: Intel(R) PROSet/Wireless Registry Service - (RegSrvc) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service S2: Intel(R) PROSet/Wireless Zero Configuration Service - (ZeroConfigService) - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe O23 - Service S2: Intel(R) Rapid Storage Technology - (IAStorDataMgrSvc) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe O23 - Service S2: Intel(R) System Usage Report Service SystemUsageReportSvc_QUEENCREEK - (SystemUsageReportSvc_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe O23 - Service S2: Intel(R) TPM Provisioning Service - C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\TPMProvisioningService.exe O23 - Service S2: Lenovo EasyResume Service - (Lenovo Instant On) - C:\WINDOWS\SysWOW64\Lenovo\PowerMgr\EasyResume.exe O23 - Service S2: Lenovo Hotkey Client Loader - (TPHKLOAD) - C:\WINDOWS\System32\DriverStore\FileRepository\fn.inf_amd64_7ed9406f9c73fd1f\driver\TPHKLOAD.exe O23 - Service S2: Lenovo PM Service - (IBMPMSVC) - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service S2: Lenovo Platform Service - (LPlatSvc) - C:\WINDOWS\System32\LPlatSvc.exe O23 - Service S2: MagentaCLOUD Update Service - (MagentaCLOUDMaintenanceService) - C:\Program Files (x86)\Telekom\MagentaCloud\Updater\MaintenanceService.exe O23 - Service S2: O2FLASH - C:\WINDOWS\System32\drivers\o2flash.exe O23 - Service S2: PDF24 - C:\Program Files (x86)\PDF24\pdf24.exe -service O23 - Service S2: Smart Sense Service - (SSSvc) - C:\ProgramData\Lenovo\ImController\Plugins\ThinkIntelligentSensingPackage\x86\SSSvc.exe O23 - Service S2: Synaptics FP WBF Policy Service - (valWBFPolicyService) - C:\WINDOWS\system32\valWBFPolicyService.exe O23 - Service S2: Wacom ISD Service - (WTabletServiceISD) - C:\Program Files\Tablet\ISD\WTabletServiceISD.exe O23 - Service S2: Wifi AutoInstall Service - (WifiAutoInstallSrv) - C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe O23 - Service S3: Dropbox-Update-Service (dbupdatem) - (dbupdatem) - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe /medsvc O23 - Service S3: Energy Server Service queencreek - (ESRV_SVC_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe "--AUTO_START" "--start" "--start_options_registry_key" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK_start" O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS\SocketHeciServer.exe O23 - Service S3: Intel(R) Content Protection HECI Service - (cphs) - C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_11890c3a16cefa51\IntelCpHeciSvc.exe O23 - Service S3: Intel(R) Driver & Support Assistant Updater - (DSAUpdateService) - C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe O23 - Service S3: Intel(R) SUR QC Software Asset Manager - (Intel(R) SUR QC SAM) - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe O23 - Service S3: Intel(R) WiDi Software Asset Manager - (Intel(R) WiDi SAM) - C:\Program Files (x86)\Intel Corporation\Intel WiDi\Intel(R) Software Asset Manager\bin\IntelSoftwareAssetManagerService.exe O23 - Service S3: Lenovo Solution Center System Service - (LSC.Services.SystemService) - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe O23 - Service S3: Mozilla Maintenance Service - (MozillaMaintenance) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service S3: System Update - (SUService) - C:\Program Files (x86)\Lenovo\System Update\SUService.exe O23 - Service S3: User Energy Server Service queencreek - (USER_ESRV_SVC_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe "--run_as_user_process" O23 - Service S3: Windows Defender Advanced Threat Protection-Dienst - (Sense) - C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe O23 - Service S3: Wireless PAN DHCP Server - (MyWiFiDHCPDNS) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

-- End of file - Time spent: 22 sec. - 61480 bytes, CRC32: FFFFFFFF. Sign: 㶤碝

dragokas commented 4 years ago

Hi, thank you for the log. If you need our assistance:

Please, note that only members of VIRUSNET-Association are allowed to respond in PC cure topics. Ignore any recommendations given by other users, including PM !!!

Assistance is provided free of charge at our free time. If you found our help useful, you can thank us with any amount using this form or you can leave a feedback in Guestbook.

dragokas commented 4 years ago

Closed. Reason: no answer for 10 days. If you still need our help, please, execute tha last steps, requested by helper. Also, download again AutoLogger, prepare new CollectionLog and write what problems remained.