| |
| |||||||
Log-Analyse und Auswertung: Bekomme Bikiniland nicht wegWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
06.02.2015, 10:06
| #1 |
| |  Bekomme Bikiniland nicht weg Hallo Brauche Hilfe , hab mir den jdownloader 2 runtergeladen und hab jetzt plötzlich diesen blöden Bikiniland Trojaner drauf. Was muss ich tun um den zu löschen Bitte hilft mir |
|
06.02.2015, 10:10
| #2 |
| /// the machine /// TB-Ausbilder    | Bekomme Bikiniland nicht weg hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
06.02.2015, 11:19
| #3 | |
| | Bekomme Bikiniland nicht weg hi
__________________bin leider laie hab jetzt beides aufm desktop wie kann ich dir das senden ich meine ich hab die FRST.txt und Addition.txt auf dem Desktop weis jetzt aber nicht weiter Zitat:
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015
Ran by Werner (administrator) on LOLLO on 06-02-2015 10:24:59
Running from C:\Users\Werner\Downloads
Loaded Profiles: Werner (Available profiles: Werner & Robin)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Phrase Finder) C:\Program Files (x86)\PhraseFinder_1.10.0.8\Service\pfsvc.exe
(Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Pokki) C:\Users\Werner\AppData\Local\Pokki\Engine\HostAppServiceUpdater.exe
(Pokki) C:\Users\Werner\AppData\Local\Pokki\Engine\HostAppService.exe
(Spotify Ltd) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
(Acer) C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe
(Pokki) C:\Users\Werner\AppData\Local\Pokki\Engine\HostAppService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Pokki) C:\Users\Werner\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
() C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-21] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-03-26] (NVIDIA Corporation)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [217088 2014-06-06] (Realtek Semiconductor Corporation)
HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [62208 2014-12-19] (Acer Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe [90880 2014-12-19] ()
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-08-21] (Spotify Ltd)
HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd)
HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Run: [AcerPortal] => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2480384 2014-12-19] (Acer)
ShellIconOverlayIdentifiers: [ACloudSyncedRF] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncedSF] -> {5D5F18B7-D59B-4B18-A3E9-0A4BDCCCB699} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-23525054-694708089-3318730015-1001\Software\Microsoft\Internet Explorer\Main,Start Page = Binkiland Search
HKU\S-1-5-21-23525054-694708089-3318730015-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKLM -> DefaultScope {2220B4D4-B63A-4A88-B710-EC9079F99F73} URL = hxxp://binkiland.com/results.php?f=4&q={searchTerms}&a=bnk_ir_15_06&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0BtD0Dzy0D0E0CtGyDtDtA0CtGtD0ByBtBtGtAzytD0AtGyEyByC0BtAyDtBtB0EtAtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=1823343424&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ir_14_47_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtDyDtAtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2SyB0A0BzzyCtD0EyBtGyB0D0AtBtGyDyDyCtAtGyC0EtCtAtGtAyD0ByByEtB0ByD0AtCyDtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=90091399&ir=
SearchScopes: HKLM -> {2220B4D4-B63A-4A88-B710-EC9079F99F73} URL = hxxp://binkiland.com/results.php?f=4&q={searchTerms}&a=bnk_ir_15_06&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0BtD0Dzy0D0E0CtGyDtDtA0CtGtD0ByBtBtGtAzytD0AtGyEyByC0BtAyDtBtB0EtAtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=1823343424&ir=
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-23525054-694708089-3318730015-1001 -> DefaultScope {2220B4D4-B63A-4A88-B710-EC9079F99F73} URL = hxxp://binkiland.com/results.php?f=4&q={searchTerms}&a=bnk_ir_15_06&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0BtD0Dzy0D0E0CtGyDtDtA0CtGtD0ByBtBtGtAzytD0AtGyEyByC0BtAyDtBtB0EtAtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=1823343424&ir=
SearchScopes: HKU\S-1-5-21-23525054-694708089-3318730015-1001 -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ir_14_47_ff&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtDyDtAtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2SyB0A0BzzyCtD0EyBtGyB0D0AtBtGyDyDyCtAtGyC0EtCtAtGtAyD0ByByEtB0ByD0AtCyDtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=90091399&ir=
SearchScopes: HKU\S-1-5-21-23525054-694708089-3318730015-1001 -> {2220B4D4-B63A-4A88-B710-EC9079F99F73} URL = hxxp://binkiland.com/results.php?f=4&q={searchTerms}&a=bnk_ir_15_06&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0BtD0Dzy0D0E0CtGyDtDtA0CtGtD0ByBtBtGtAzytD0AtGyEyByC0BtAyDtBtB0EtAtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=1823343424&ir=
SearchScopes: HKU\S-1-5-21-23525054-694708089-3318730015-1001 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-23525054-694708089-3318730015-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default
FF DefaultSearchEngine: Binkiland
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Binkiland
FF Homepage: hxxp://binkiland.com/?f=1&a=bnk_ir_15_06&cd=2XzuyEtN2Y1L1Qzu0CyEyDyEyEyE0CtAtD0D0CyB0AtDtAtCtN0D0Tzu0StCtCtAtBtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0BtD0Dzy0D0E0CtGyDtDtA0CtGtD0ByBtBtGtAzytD0AtGyEyByC0BtAyDtBtB0EtAtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtCzz0E0EzytC0CtG0Ezz0F0AtGyE0ByDtCtGzz0DzytDtGtAyD0FtD0D0BtAyB0B0EtD0A2Q&cr=1823343424&ir=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF user.js: detected! => C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\user.js
FF SearchPlugin: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\searchplugins\Binkiland.xml
FF SearchPlugin: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\searchplugins\Vosteran.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF Extension: Cliqz Beta - C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\Extensions\cliqz@cliqz.com.xpi [2014-11-02]
FF Extension: Adblock Plus - C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-20]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com
FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2014-11-28]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2014-11-28]
FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com
FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2014-11-28]
FF HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Werner\AppData\Roaming\Mozilla\Firefox\Profiles\2xkqd0rr.default\extensions\cliqz@cliqz.com
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [94208 2014-05-06] () [File not signed]
R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2713856 2014-12-19] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573032 2014-06-12] (Acer Incorporated)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-12] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation)
S2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [466664 2014-06-10] (Acer Incorporate)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1616160 2014-03-26] (NVIDIA Corporation)
R2 pfsvc_1.10.0.8; C:\Program Files (x86)\PhraseFinder_1.10.0.8\Service\pfsvc.exe [278608 2015-01-21] (Phrase Finder)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-06-26] (Acer Incorporate)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [233216 2014-06-23] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S2 Update BrowseStudio; "C:\Program Files (x86)\BrowseStudio\updateBrowseStudio.exe" [X]
S2 Util BrowseStudio; "C:\Program Files (x86)\BrowseStudio\bin\utilBrowseStudio.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [111336 2014-04-28] (GenesysLogic)
R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-03] (Intel Corporation)
R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-03] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [150536 2014-11-28] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [247480 2014-08-12] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [799944 2014-11-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [68616 2014-11-28] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [77512 2014-11-28] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
R1 pfnfd_1_10_0_8; C:\Windows\System32\drivers\pfnfd_1_10_0_8.sys [58232 2015-01-21] (Phrase Finder)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [573144 2014-04-18] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3468504 2014-05-22] (Realtek Semiconductor Corporation )
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [42224 2014-02-20] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-06 10:24 - 2015-02-06 10:25 - 00023504 _____ () C:\Users\Werner\Downloads\FRST.txt
2015-02-06 10:24 - 2015-02-06 10:25 - 00000000 ____D () C:\FRST
2015-02-06 10:23 - 2015-02-06 10:23 - 02131968 _____ (Farbar) C:\Users\Werner\Downloads\FRST64.exe
2015-02-06 09:55 - 2015-02-06 09:55 - 00000792 _____ () C:\Windows\PFRO.log
2015-02-06 09:55 - 2015-02-06 09:55 - 00000116 _____ () C:\Windows\setupact.log
2015-02-06 09:55 - 2015-02-06 09:55 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-06 09:43 - 2015-02-06 10:20 - 00277897 _____ () C:\Windows\WindowsUpdate.log
2015-02-06 09:36 - 2015-02-06 09:36 - 00015360 ___SH () C:\Users\Werner\Desktop\Thumbs.db
2015-02-06 09:27 - 2015-02-06 09:27 - 00000000 ____D () C:\Users\Werner\AppData\Local\4857296
2015-02-06 09:27 - 2015-02-06 09:27 - 00000000 ____D () C:\Program Files (x86)\PhraseFinder_1.10.0.8
2015-02-06 09:25 - 2015-02-06 09:25 - 00231544 _____ () C:\Users\Werner\Downloads\install_jd_two.exe
2015-02-04 13:06 - 2015-02-04 13:06 - 00000000 ____D () C:\Users\Werner\AppData\Local\Cyberlink
2015-02-01 13:22 - 2015-02-01 13:22 - 00000000 ____D () C:\Users\Werner\Downloads\terminblock24-wochenplaner-2015
2015-02-01 13:21 - 2015-02-01 13:21 - 10667879 _____ () C:\Users\Werner\Downloads\terminblock24-wochenplaner-2015.zip
2015-02-01 13:00 - 2015-02-01 13:00 - 00000000 ____D () C:\Users\Werner\Documents\Kalender-Excel-8.12
2015-02-01 13:00 - 2015-02-01 13:00 - 00000000 ____D () C:\Users\Werner\AppData\Roaming\DesktopIconAmazon
2015-02-01 13:00 - 2015-02-01 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kalender-Excel-8.12
2015-02-01 12:59 - 2015-02-01 12:59 - 01191200 _____ () C:\Users\Werner\Downloads\Kalender-Excel-8.12-Setup - CHIP-Installer.exe
2015-01-21 20:42 - 2015-01-21 20:42 - 00058232 _____ (Phrase Finder) C:\Windows\system32\Drivers\pfnfd_1_10_0_8.sys
2015-01-17 15:24 - 2015-01-17 15:24 - 00020592 _____ () C:\Users\Werner\Downloads\376577f05a8b5b16fb00e19b3cf944df16492e01.dlc
2015-01-17 10:33 - 2015-01-30 15:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-14 15:06 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 15:06 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 15:06 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 15:06 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 15:06 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 15:06 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 15:06 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 15:06 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 15:06 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 15:06 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 15:06 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 15:06 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 15:06 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 15:06 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 15:06 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 15:06 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 15:06 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 15:06 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 15:06 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 15:06 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 15:06 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 15:06 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 15:06 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 15:06 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 15:06 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 14:58 - 2015-01-14 14:58 - 00002001 _____ () C:\Users\Public\Desktop\abMedia.lnk
2015-01-13 15:41 - 2015-01-13 15:41 - 00003334 _____ () C:\Windows\System32\Tasks\AcerCloud
2015-01-13 15:40 - 2015-01-13 15:41 - 00002028 _____ () C:\Users\Public\Desktop\Acer Portal.lnk
2015-01-13 15:36 - 2015-01-13 15:36 - 00002346 _____ () C:\Users\Robin\Desktop\Sicherer Zahlungsverkehr.lnk
2015-01-09 15:06 - 2015-01-09 15:06 - 00009476 _____ () C:\Users\Werner\Downloads\655a1acb55a55a8858918439c150fc9d513ad22c.dlc
2015-01-09 14:53 - 2015-01-09 14:53 - 00001969 _____ () C:\Users\Public\Desktop\abDocs.lnk
2015-01-07 16:25 - 2015-01-07 16:26 - 00002005 _____ () C:\Users\Public\Desktop\abPhoto.lnk
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-06 10:15 - 2014-10-31 13:30 - 00003592 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-23525054-694708089-3318730015-1001
2015-02-06 10:12 - 2014-10-31 16:33 - 00000000 ____D () C:\Users\Werner\AppData\Local\CrashDumps
2015-02-06 10:12 - 2014-10-31 13:24 - 00000000 ____D () C:\Users\Werner\AppData\Local\Pokki
2015-02-06 10:10 - 2014-11-28 18:04 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-06 10:10 - 2014-10-31 13:29 - 00000000 ___RD () C:\Users\Werner\OneDrive
2015-02-06 10:10 - 2014-10-31 13:25 - 00095574 _____ () C:\Users\Werner\AppData\Local\BTServer.log
2015-02-06 10:10 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-06 10:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-06 09:55 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-06 09:54 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2015-02-06 09:51 - 2014-11-25 18:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-06 09:30 - 2014-11-19 22:37 - 00000000 ____D () C:\Users\Werner\AppData\Local\JDownloader v2.0
2015-02-06 09:27 - 2014-10-31 13:42 - 00001159 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-06 08:51 - 2014-11-25 18:12 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 08:12 - 2014-10-31 13:39 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0C415CED-14D2-477E-882C-723F52B52697}
2015-02-04 14:14 - 2014-11-09 17:04 - 00000000 ____D () C:\Users\Werner\Desktop\Filme
2015-02-04 13:07 - 2014-08-21 14:41 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-04 13:06 - 2014-08-21 14:52 - 00000000 ____D () C:\Users\Public\CyberLink
2015-02-03 20:31 - 2014-11-15 20:16 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-11-15 20:16 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 12:01 - 2014-10-31 13:28 - 00002326 _____ () C:\Users\Werner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-01-30 15:51 - 2014-10-31 15:27 - 00019060 _____ () C:\Users\Robin\AppData\Local\BTServer.log
2015-01-30 15:51 - 2014-10-31 15:26 - 00000000 ____D () C:\Users\Robin\AppData\Local\Pokki
2015-01-30 15:49 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-01-30 15:42 - 2014-10-31 15:33 - 00003592 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-23525054-694708089-3318730015-1004
2015-01-30 15:37 - 2014-11-02 13:55 - 00000000 ____D () C:\Users\Robin\AppData\Local\CrashDumps
2015-01-30 15:37 - 2014-10-31 15:30 - 00002325 _____ () C:\Users\Robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-01-30 15:37 - 2014-10-31 15:29 - 00000000 ___RD () C:\Users\Robin\OneDrive
2015-01-30 15:36 - 2014-10-31 13:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 15:42 - 2014-12-15 17:25 - 00032768 _____ () C:\Windows\system32\persistent_q.db-shm
2015-01-25 15:41 - 2014-10-31 13:51 - 00000000 ____D () C:\Users\Werner\AppData\Roaming\vlc
2015-01-17 09:52 - 2014-11-02 13:06 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-17 09:50 - 2014-11-02 13:05 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 14:58 - 2014-08-21 14:30 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-01-14 14:58 - 2014-08-21 14:30 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-01-14 14:56 - 2014-10-31 13:26 - 00000000 ____D () C:\Users\Werner\AppData\Local\clear.fi
2015-01-13 15:39 - 2014-10-31 15:30 - 00002154 _____ () C:\Users\Robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2015-01-13 15:37 - 2014-10-31 15:28 - 00000000 ____D () C:\Users\Robin\AppData\Local\clear.fi
2015-01-12 13:49 - 2014-08-21 14:17 - 00000000 ____D () C:\ProgramData\Realtek
2015-01-09 15:55 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-07 16:50 - 2014-10-31 13:57 - 00000000 ____D () C:\Users\Werner\AppData\Roaming\UseNeXT
2015-01-07 16:47 - 2014-11-02 23:06 - 00000000 ____D () C:\Users\Werner\Documents\UseNeXT
==================== Files in the root of some directories =======
2014-10-31 13:25 - 2015-02-06 10:10 - 0095574 _____ () C:\Users\Werner\AppData\Local\BTServer.log
2014-08-21 14:07 - 2014-08-21 14:07 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some content of TEMP:
====================
C:\Users\Robin\AppData\Local\Temp\oct277F.tmp.exe
C:\Users\Werner\AppData\Local\Temp\130676847532022387.exe
C:\Users\Werner\AppData\Local\Temp\13067684758812061574.exe
C:\Users\Werner\AppData\Local\Temp\BNKStubSetup.exe
C:\Users\Werner\AppData\Local\Temp\proxy_vole778758898825312647.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-06 10:06
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2015 Ran by Werner at 2015-02-06 10:26:06 Running from C:\Users\Werner\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) abDocs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.05.2005 - Acer Incorporated) abDocs Office AddIn (HKLM-x32\...\{DCBF3379-246B-47E1-8173-639B63940838}) (Version: 3.01.2006 - Acer Incorporated) abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.00.3002 - Acer Incorporated) abMedia (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.06.2003.0 - Acer Incorporated) abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 3.01.2005.1 - Acer Incorporated) Acer Care Center (HKLM\...\{A424844F-CDB3-45E2-BB77-1DDE4A091E76}) (Version: 1.00.3008 - Acer Incorporated) Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated) Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8107 - Acer Incorporated) Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.04.2002 - Acer Incorporated) Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8105 - Acer Incorporated) Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3016.0 - Acer Incorporated) Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8108 - Acer Incorporated) Acer User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3004 - Acer Incorporated) Acer User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3004 - Acer Incorporated) Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2005.0 - Acer Incorporated) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated) Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.04.2001.2 - Acer Incorporated) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform) Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.) Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com) CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4917 - CyberLink Corp.) CyberLink Power Media Player 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.4218 - CyberLink Corp.) CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.4220 - CyberLink Corp.) Desktopicon amazon.de (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 - ) eBay Worldwide (HKLM-x32\...\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM) Farm to Fork Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Foxit PhantomPDF (HKLM-x32\...\{F74C595C-BEF2-4AF9-9C4E-68F3CD509C4D}) (Version: 6.0.120.609 - Foxit Corporation) Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 11.0.0.7 - WildTangent, Inc.) Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 11.0.0.7 - WildTangent, Inc.) Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.2.1 - Genesys Logic) Governor of Poker 2 Premium Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Host App Service (HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Pokki) (Version: 0.269.5.460 - Pokki) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.0.1001 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.165.1 - Intel Corporation) Jewel Match 3 (x32 Version: 3.0.2.59 - WildTangent) Hidden Kalender-Excel-8.12 (HKLM-x32\...\Kalender-Excel-8.12_is1) (Version: 8.12 - MSDatec) Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab) Kaspersky Internet Security (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden LUXOR Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation) Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.2 - Mozilla) NVIDIA Grafiktreiber 332.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.91 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.13.0927 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation) PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden Phrase Finder 1.10.0.8 (HKLM-x32\...\PhraseFinder_1.10.0.8) (Version: 1.10.0.8 - Phrase Finder) Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.59 - WildTangent) Hidden Pokki Start Menu (HKU\S-1-5-21-23525054-694708089-3318730015-1001\...\Pokki_Start_Menu) (Version: 0.269.5.460 - Pokki) Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.816.818.061114 - REALTEK Semiconductor Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.32.508.2014 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7218 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.243 - REALTEK Semiconductor Corp.) Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB) The Chronicles of Emerland Solitaire (x32 Version: 3.0.2.51 - WildTangent) Hidden Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.) VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN) WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent) WildTangent Games App (x32 Version: 4.0.11.13 - WildTangent) Hidden WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) Zuma's Revenge (x32 Version: 2.2.0.97 - WildTangent) Hidden ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-23525054-694708089-3318730015-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation) ==================== Restore Points ========================= Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1578F89C-BCE2-4F5B-8C48-71F5323CE100} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation) Task: {1E35A5B0-C13B-467A-B673-49323B7F5783} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-06-10] (Acer Incorporate) Task: {1F02052B-C1A0-4013-BEAF-94771B47E98E} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-06-17] (Acer Incorporated) Task: {212127E5-C182-4DBF-90EB-96600D90F85D} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2014-06-09] (Acer Incorporated) Task: {212BC543-F760-461C-B9F6-992DF0860B38} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation) Task: {44D8B53E-C9EC-4A31-B6D6-21D6669BAA07} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-12] (TODO: <Company name>) Task: {4615570C-F84E-45E0-A38F-2DB7378E4172} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2014-08-29] () Task: {5E89C70A-733D-4FE1-9DFF-C7435BF2637C} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate) Task: {68A09A9A-6AF4-4B03-B0EF-CBFEE5D6264C} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft) Task: {793C126A-0EA4-4B19-BF27-F3814A4C1FFE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated) Task: {8926A30D-99E7-4F3F-BA49-3E7D77AE59AA} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-06-12] (Acer Incorporated) Task: {8B8F3EF2-68E1-4EAE-9E1A-A7F6D44B10C0} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation) Task: {903BEA1E-03DF-4E66-9ABC-77CAB076899D} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2014-12-19] (Acer) Task: {ABCAE44B-9F1D-4CEA-AECF-CA085CE1A313} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation) Task: {B2E22539-88AC-4A79-B927-3C4ADFA0A1C6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-23] (Piriform Ltd) Task: {C14B36C6-96AF-4D05-AF92-1BC7EE8AC46F} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2014-08-29] () Task: {D30BA809-D8D8-4A20-A146-97D2386B6786} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-17] (Microsoft Corporation) Task: {DEB673DD-A34C-45DF-94E3-05B83F5A557B} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe Task: {EA828A3A-F6E5-48B3-B81A-DC575888A5BE} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============== 2014-08-21 14:12 - 2014-03-24 13:30 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-08-21 14:17 - 2014-05-06 13:41 - 00094208 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe 2014-08-21 14:43 - 2012-04-24 11:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe 2014-12-19 21:59 - 2014-12-19 21:59 - 00090880 _____ () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe 2014-10-23 20:19 - 2014-10-23 20:19 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2014-12-19 21:59 - 2014-12-19 21:59 - 00089344 _____ () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe 2014-08-30 17:12 - 2014-08-30 17:12 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\kpcengine.2.3.dll 2014-08-21 14:10 - 2013-12-10 00:27 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2014-12-19 21:48 - 2014-12-19 21:48 - 00203008 _____ () C:\Program Files (x86)\Acer\Acer Portal\curllib.dll 2014-12-19 21:48 - 2014-12-19 21:48 - 00119552 _____ () C:\Program Files (x86)\Acer\Acer Portal\OpenLDAP.dll 2015-01-04 05:06 - 2015-01-04 05:06 - 00569856 _____ () C:\Users\Werner\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll 2015-01-04 05:06 - 2015-01-04 05:06 - 01400846 _____ () C:\Users\Werner\AppData\Local\Pokki\Engine\avcodec-54.dll 2015-01-04 05:06 - 2015-01-04 05:06 - 00151054 _____ () C:\Users\Werner\AppData\Local\Pokki\Engine\avutil-51.dll 2015-01-04 05:06 - 2015-01-04 05:06 - 00222734 _____ () C:\Users\Werner\AppData\Local\Pokki\Engine\avformat-54.dll 2015-01-09 14:53 - 2015-01-09 14:53 - 00015616 _____ () C:\Windows\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll 2014-12-19 21:16 - 2014-12-19 21:16 - 00013568 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll 2014-12-29 13:25 - 2014-12-29 13:25 - 00203008 _____ () C:\Program Files (x86)\Acer\abPhoto\curllib.dll 2014-12-29 13:26 - 2014-12-29 13:26 - 00654552 _____ () C:\Program Files (x86)\Acer\abPhoto\sqlite3.dll 2014-12-29 13:26 - 2014-12-29 13:26 - 00630528 _____ () C:\Program Files (x86)\Acer\abPhoto\tag.dll 2014-12-29 13:26 - 2014-12-29 13:26 - 00119552 _____ () C:\Program Files (x86)\Acer\abPhoto\OpenLDAP.dll 2014-12-19 21:10 - 2014-12-19 21:10 - 00277096 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll 2014-12-19 22:00 - 2014-12-19 22:00 - 00279296 _____ () C:\Program Files (x86)\Acer\abDocs\libcurl.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Robin\OneDrive:ms-properties AlternateDataStreams: C:\Users\Werner\OneDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Registry Areas ===================== (Currently there is no automatic fix for this section.) HKU\S-1-5-21-23525054-694708089-3318730015-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Werner\AppData\Roaming\Microsoft\Windows Photo Viewer\Hintergrundbild der Windows-Fotoanzeige.jpg ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== Accounts: ============================= Administrator (S-1-5-21-23525054-694708089-3318730015-500 - Administrator - Disabled) Gast (S-1-5-21-23525054-694708089-3318730015-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-23525054-694708089-3318730015-1003 - Limited - Enabled) Robin (S-1-5-21-23525054-694708089-3318730015-1004 - Limited - Enabled) => C:\Users\Robin Werner (S-1-5-21-23525054-694708089-3318730015-1001 - Administrator - Enabled) => C:\Users\Werner ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (02/06/2015 10:12:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: AcerPortal.exe, Version: 3.0.4.2002, Zeitstempel: 0x54942c87 Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.3.9600.17331, Zeitstempel: 0x54023318 Ausnahmecode: 0xc0000005 Fehleroffset: 0x001bf5f0 ID des fehlerhaften Prozesses: 0x1e88 Startzeit der fehlerhaften Anwendung: 0xAcerPortal.exe0 Pfad der fehlerhaften Anwendung: AcerPortal.exe1 Pfad des fehlerhaften Moduls: AcerPortal.exe2 Berichtskennung: AcerPortal.exe3 Vollständiger Name des fehlerhaften Pakets: AcerPortal.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AcerPortal.exe5 Error: (02/06/2015 10:11:50 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1f64 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:48 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: QAEvent.exe, Version: 1.1.3016.0, Zeitstempel: 0x53aba71f Name des fehlerhaften Moduls: QAEvent.exe, Version: 1.1.3016.0, Zeitstempel: 0x53aba71f Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000f08c ID des fehlerhaften Prozesses: 0xa18 Startzeit der fehlerhaften Anwendung: 0xQAEvent.exe0 Pfad der fehlerhaften Anwendung: QAEvent.exe1 Pfad des fehlerhaften Moduls: QAEvent.exe2 Berichtskennung: QAEvent.exe3 Vollständiger Name des fehlerhaften Pakets: QAEvent.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: QAEvent.exe5 Error: (02/06/2015 10:11:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1cb8 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:44 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1d20 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:41 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1e48 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:38 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1d64 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:35 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1d14 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:32 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0xcdc Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 Error: (02/06/2015 10:11:29 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Name des fehlerhaften Moduls: ePowerTray.exe, Version: 7.0.8105.0, Zeitstempel: 0x53992380 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000799c ID des fehlerhaften Prozesses: 0x1fa0 Startzeit der fehlerhaften Anwendung: 0xePowerTray.exe0 Pfad der fehlerhaften Anwendung: ePowerTray.exe1 Pfad des fehlerhaften Moduls: ePowerTray.exe2 Berichtskennung: ePowerTray.exe3 Vollständiger Name des fehlerhaften Pakets: ePowerTray.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ePowerTray.exe5 System errors: ============= Error: (02/06/2015 09:56:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Launch Manager Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (02/06/2015 09:56:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Util BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/06/2015 09:56:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Update BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/06/2015 08:07:35 AM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Launch Manager Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (02/06/2015 08:06:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Util BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/06/2015 08:06:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Update BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/04/2015 01:06:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Launch Manager Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (02/04/2015 01:06:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Util BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/04/2015 01:06:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Update BrowseStudio" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (02/01/2015 03:31:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Launch Manager Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office Sessions: ========================= Error: (02/06/2015 10:12:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: AcerPortal.exe3.0.4.200254942c87SHELL32.dll6.3.9600.1733154023318c0000005001bf5f01e8801d041ed130f6701C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exeC:\Windows\SYSTEM32\SHELL32.dll50d1d5c9-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:50 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1f6401d041ecf0a3b9a2C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe2e7f1c47-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:48 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: QAEvent.exe1.1.3016.053aba71fQAEvent.exe1.1.3016.053aba71fc0000005000000000000f08ca1801d041ecefe9c196C:\Program Files\Acer\Acer Quick Access\QAEvent.exeC:\Program Files\Acer\Acer Quick Access\QAEvent.exe2d9fd6da-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1cb801d041eceed3fe00C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe2caf0994-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:44 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1d2001d041eced072473C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe2adcea32-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:41 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1e4801d041eceb39d7fcC:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe291012b2-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:38 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1d6401d041ece96d466fC:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe274528aa-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:35 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1d1401d041ece79e9145C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe257634a1-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:32 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799ccdc01d041ece5d2e434C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe23ac4443-ade0-11e4-82b5-c45444c30dc7 Error: (02/06/2015 10:11:29 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: ePowerTray.exe7.0.8105.053992380ePowerTray.exe7.0.8105.053992380c0000005000000000000799c1fa001d041ece4067d96C:\Program Files\Acer\Acer Power Management\ePowerTray.exeC:\Program Files\Acer\Acer Power Management\ePowerTray.exe21e1a790-ade0-11e4-82b5-c45444c30dc7 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-4210U CPU @ 1.70GHz Percentage of memory in use: 29% Total physical RAM: 8115.27 MB Available physical RAM: 5719.73 MB Total Pagefile: 9395.27 MB Available Pagefile: 7072.55 MB Total Virtual: 131072 MB Available Virtual: 131071.79 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:913.91 GB) (Free:683.85 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: CA47C940) Partition: GPT Partition Type. ==================== End Of Log ============================hoffentlich ist das so richtig |
|
06.02.2015, 14:34
| #4 |
| /// the machine /// TB-Ausbilder | Bekomme Bikiniland nicht weg So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.02.2015, 15:10
| #5 |
| | Bekomme Bikiniland nicht weg Danke dir Schrauber soll ich das alles machen,auch wenn Kaspersky nichts findet? Grüße |
|
06.02.2015, 19:44
| #6 |
| /// the machine /// TB-Ausbilder | Bekomme Bikiniland nicht weg Irgendwie versteh ich die Frage nit. Du hast ein Problem KAV bekommt es nit weg Du meldest dich hier, sagst KAV findet nix aber das Problem is immer noch da, hilfe Jetzt helfe ich und is auch nit gut?  Willst Du das Problem weg haben? Dann arbeite ab was ich poste, bis ich sage wir sind fertig .Deal or no Deal? 
__________________ --> Bekomme Bikiniland nicht weg |
|
| Themen zu Bekomme Bikiniland nicht weg |
| bikiniland, blöde, blöden, hilfe, hilft, jdownloader, loader, löschen, plötzlich, runtergeladen, troja, trojaner |
Linear-Darstellung
