| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: wie entferne ich Home Tab\TBUpdater.dll?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.07.2013, 17:24
| #1 |
 |  wie entferne ich Home Tab\TBUpdater.dll? Guten Tag allerseits, neulich hatte ich home tab Trojaner über chip.de versehenlich herunterladen. Und ich habe es erfölgreich mit Adwcleaner und Antimalware aus Computer entfernt. Aber jedesmal ich den Rechner hochfahre, ein Meldungfenster von 'Problem beim starten von C:Program Files (x86)\Home Tab\TBUpadater.dll Das angegebene Modul wurde nicht gefunden' taucht jedes mal auf, sogar während Nutzung des Internets. Kann jemand hier bitte mir Tips geben, wie ich diese nervige Sache entgültig entferne? Oder ist mein Computer immernoch infiziert? Vielen dank erstmal. butoh |
|
12.07.2013, 17:29
| #2 |
| /// the machine /// TB-Ausbilder    | wie entferne ich Home Tab\TBUpdater.dll? hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
13.07.2013, 11:06
| #3 |
| | wie entferne ich Home Tab\TBUpdater.dll? Hallo.. anbei sind 2 reports.
__________________==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Windows Net) C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6602856 2011-01-12] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-21] (Synaptics Incorporated) HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden [363064 2010-07-21] (Hewlett-Packard Company) HKLM\...\Run: [MSC] - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation) HKLM\...\Run: [AtherosBtStack] - "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [984736 2011-10-22] (Atheros Communications) HKLM\...\Run: [AthBtTray] - "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [799904 2011-10-22] (Atheros Commnucations) HKCU\...\Run: [Google Update] - "C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-08-27] (Google Inc.) HKCU\...\Run: [QuickScanner] - C:\Program Files (x86)\Defender Pro Quick Scanner\quickscan.exe [14483800 2013-03-21] (Defender Pro) HKCU\...\Policies\system: [disableregistrytools] 0 HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc) HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [295512 2013-07-05] (RealNetworks, Inc.) Startup: C:\Users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk ShortcutTarget: net.lnk -> C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe (Windows Net) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab URLSearchHook: (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: HomeTab - {ba696155-d96e-4281-b467-0367a0456474} - C:\Users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll No File BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: QuickNet BHO - {EA5CA8B6-9B9C-4994-A7A1-947B6C631BE7} - C:\Program Files (x86)\RegTweaker\key.dll No File Toolbar: HKLM-x32 - HomeTab - {ba696155-d96e-4281-b467-0367a0456474} - C:\Users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll No File Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 83.169.184.33 83.169.184.97 FireFox: ======== FF ProfilePath: C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll () FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.5.109 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.5.109 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google) FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lee Hong Guan\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lee Hong Guan\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF Extension: pricealarm - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM FF Extension: HomeTab - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\{24532715-4abc-47ee-bd4f-a6774d0723d2} FF Extension: artur.dubovoy - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\artur.dubovoy@gmail.com.xpi FF Extension: No Name - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\WTB_GLOBAL.sqlite FF Extension: No Name - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ Chrome: ======= CHR RestoreOnStartup: "about:newtab?source=home" CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{go ogle:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={goo gle:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\pdf.dll () CHR Plugin: (Google Talk Plugin) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google) CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (WildTangent Games App V2 Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) CHR Plugin: (RealJukebox NS Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll No File CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) CHR Extension: (RealDownloader) - C:\Users\LEEHON~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0 ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation) R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] () S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-06] (soft Xpansion) S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-02-25] (Xobni Corporation) R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-10-22] (Atheros) ==================== Drivers (Whitelisted) ==================== R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation) S3 gfiark; system32\drivers\gfiark.sys [x] S3 motmodem; system32\DRIVERS\motmodem.sys [x] S2 sbapifs; system32\DRIVERS\sbapifs.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-13 11:55 - 2013-07-13 11:55 - 00000000 ____D C:\FRST 2013-07-13 11:54 - 2013-07-13 11:55 - 01777859 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST64.exe 2013-07-13 11:53 - 2013-07-13 11:54 - 01218386 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST.exe 2013-07-12 09:39 - 2013-07-12 09:39 - 00000000 ___SD C:\ComboFix 2013-07-12 09:33 - 2013-07-12 09:39 - 00000000 ____D C:\Qoobox 2013-07-12 09:31 - 2013-07-12 09:31 - 00000000 ____D C:\Windows\erdnt 2013-07-12 09:25 - 2013-07-12 09:25 - 00001267 _____ C:\AdwCleaner[S1].txt 2013-07-12 09:24 - 2013-07-12 09:25 - 00001205 _____ C:\AdwCleaner[R1].txt 2013-07-12 09:23 - 2013-07-12 09:23 - 00662345 _____ C:\Users\Lee Hong Guan\Downloads\adwcleaner.exe 2013-07-10 22:45 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-10 22:45 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-10 22:45 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-10 22:45 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-10 22:45 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-10 22:45 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-10 22:45 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-10 22:45 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-10 22:45 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-10 22:45 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-07-10 22:45 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-10 22:45 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-07-10 22:45 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-10 22:45 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-07-10 22:45 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-10 22:45 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-10 22:44 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-10 22:44 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-10 22:44 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-10 21:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-07-10 21:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2013-07-10 21:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-10 21:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-10 21:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-10 21:18 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-10 21:18 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-07-09 10:45 - 2013-07-09 12:40 - 00000000 ____D C:\Windows\pss 2013-07-08 23:02 - 2013-07-08 23:02 - 00000000 ____D C:\Windows\Sun 2013-07-08 21:13 - 2013-07-09 13:08 - 00000000 ____D C:\Program Files\CCleaner 2013-07-08 20:50 - 2013-07-08 20:50 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Malwarebytes 2013-07-08 20:49 - 2013-07-09 22:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-07 14:39 - 2013-07-11 16:36 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\SoftGrid Client 2013-07-06 13:51 - 2013-07-06 13:51 - 00000240 _____ C:\Windows\SysWOW64\Drivers\kgpcpy.cfg 2013-07-06 11:49 - 2013-07-06 14:14 - 00010672 _____ C:\Windows\system32\Drivers\kgpcpy.cfg 2013-07-06 11:04 - 2013-07-06 11:04 - 00010464 _____ C:\Windows\SysWOW64\sx_p2d.tlb 2013-07-06 10:47 - 2013-07-06 10:53 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog 2013-07-06 10:46 - 2013-07-06 10:46 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data 2013-07-05 14:48 - 2013-07-05 14:50 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001 2013-07-05 14:48 - 2013-07-05 14:50 - 00003226 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001 2013-07-05 14:48 - 2013-07-05 14:48 - 00001128 _____ C:\Users\Public\Desktop\RealPlayer.lnk 2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\ProgramData\RealNetworks 2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\Program Files (x86)\RealNetworks 2013-07-05 14:46 - 2013-07-05 14:46 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll 2013-07-04 20:00 - 2013-07-06 13:21 - 00000016 _____ C:\Windows\system32\config\software.szfi 2013-07-04 18:47 - 2013-07-04 18:53 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012 2013-07-04 12:42 - 2013-07-04 12:42 - 00000000 _____ C:\Windows\SysWOW64\sho3E87.tmp 2013-07-04 12:18 - 2013-07-09 13:07 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-07-04 12:00 - 2013-07-04 12:01 - 00000085 _____ C:\Windows\wininit.ini 2013-07-04 11:35 - 2013-07-04 11:40 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-07-04 11:35 - 2013-07-04 11:35 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-07-04 10:45 - 2013-07-04 10:45 - 00000000 _____ C:\Windows\SysWOW64\shoA15E.tmp 2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\freepdf 2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\SoftwareUpdater 2013-07-04 10:36 - 2013-07-04 10:36 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater 2013-07-04 10:36 - 2013-05-13 05:52 - 00023624 _____ C:\Windows\Launcher.exe 2013-07-04 10:27 - 2013-07-04 10:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Originals 2013-06-24 12:27 - 2013-06-24 12:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Autoruns_11.61 2013-06-24 11:05 - 2013-06-24 11:05 - 00001011 _____ C:\quickscan.xml 2013-06-24 11:04 - 2013-06-24 11:05 - 00009850 _____ C:\quickscan.txt 2013-06-24 11:04 - 2013-06-24 11:04 - 02051696 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs64.dll 2013-06-24 11:04 - 2013-06-24 11:04 - 00733224 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs.dll 2013-06-24 11:04 - 2013-06-24 11:04 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\QuickScan 2013-06-24 11:03 - 2013-06-24 11:11 - 00000000 ____D C:\Program Files (x86)\Defender Pro Quick Scanner 2013-06-24 10:50 - 2013-06-24 10:50 - 00003306 _____ C:\Windows\System32\Tasks\4799 2013-06-24 10:50 - 2013-06-24 10:50 - 00003204 _____ C:\Windows\System32\Tasks\0 2013-06-23 16:24 - 2013-06-23 16:24 - 13579152 _____ C:\Users\Lee Hong Guan\Downloads\mf socrates.mp4 2013-06-23 16:22 - 2013-06-23 16:22 - 14196074 _____ C:\Users\Lee Hong Guan\Downloads\mf kriz.mp4 2013-06-23 16:19 - 2013-06-23 16:19 - 10337572 _____ C:\Users\Lee Hong Guan\Downloads\MF kriz chiko.mp4 2013-06-19 09:51 - 2013-06-24 10:22 - 00000005 _____ C:\Users\Lee Hong Guan\AppData\Roaming\WBPU-TTL.DAT 2013-06-18 21:21 - 2013-06-12 21:43 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-06-18 21:20 - 2013-06-12 21:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-06-18 21:20 - 2013-06-12 21:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-06-18 21:20 - 2013-06-12 21:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-06-18 21:19 - 2013-06-18 21:20 - 00004944 _____ C:\Windows\SysWOW64\jupdate-1.7.0_25-b16.log 2013-06-14 23:15 - 2013-06-14 23:15 - 00000017 _____ C:\Windows\SysWOW64\shortcut_ex.dat 2013-06-13 08:23 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-06-13 08:23 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2013-06-13 08:23 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-06-13 08:22 - 2013-05-13 07:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-06-13 08:22 - 2013-05-13 07:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-06-13 08:22 - 2013-05-13 07:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-06-13 08:22 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2013-06-13 08:22 - 2013-05-13 06:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-06-13 08:22 - 2013-05-13 06:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-06-13 08:22 - 2013-05-13 06:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-06-13 08:22 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2013-06-13 08:22 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2013-06-13 08:22 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2013-06-13 08:22 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2013-06-13 08:22 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll 2013-06-13 08:22 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2013-06-13 08:22 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2013-06-13 08:22 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2013-06-13 08:22 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll ==================== One Month Modified Files and Folders ======= 2013-07-13 11:55 - 2013-07-13 11:55 - 00000000 ____D C:\FRST 2013-07-13 11:55 - 2013-07-13 11:54 - 01777859 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST64.exe 2013-07-13 11:55 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-13 11:55 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-13 11:54 - 2013-07-13 11:53 - 01218386 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST.exe 2013-07-13 11:53 - 2011-08-02 22:29 - 00654844 _____ C:\Windows\system32\perfh007.dat 2013-07-13 11:53 - 2011-08-02 22:29 - 00130426 _____ C:\Windows\system32\perfc007.dat 2013-07-13 11:53 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI 2013-07-13 11:47 - 2012-10-13 09:47 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-13 11:47 - 2011-08-02 13:31 - 00000000 ____D C:\ProgramData\PDFC 2013-07-13 11:46 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-07-13 11:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-13 11:46 - 2009-07-14 06:51 - 00121660 _____ C:\Windows\setupact.log 2013-07-12 21:13 - 2011-11-13 04:01 - 01537300 _____ C:\Windows\WindowsUpdate.log 2013-07-12 21:03 - 2012-10-13 09:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-12 20:45 - 2013-05-17 13:25 - 00000364 _____ C:\Windows\Tasks\HPCeeScheduleForLee Hong Guan.job 2013-07-12 20:45 - 2012-08-27 20:46 - 00001152 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA.job 2013-07-12 20:45 - 2012-04-02 09:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-12 17:58 - 2012-01-17 15:28 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{7ED3601F-B192-488C-8297-41E3614F0C47} 2013-07-12 12:59 - 2012-08-27 20:46 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core.job 2013-07-12 09:39 - 2013-07-12 09:39 - 00000000 ___SD C:\ComboFix 2013-07-12 09:39 - 2013-07-12 09:33 - 00000000 ____D C:\Qoobox 2013-07-12 09:31 - 2013-07-12 09:31 - 00000000 ____D C:\Windows\erdnt 2013-07-12 09:25 - 2013-07-12 09:25 - 00001267 _____ C:\AdwCleaner[S1].txt 2013-07-12 09:25 - 2013-07-12 09:24 - 00001205 _____ C:\AdwCleaner[R1].txt 2013-07-12 09:23 - 2013-07-12 09:23 - 00662345 _____ C:\Users\Lee Hong Guan\Downloads\adwcleaner.exe 2013-07-11 16:36 - 2013-07-07 14:39 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\SoftGrid Client 2013-07-11 15:43 - 2012-01-17 15:39 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla 2013-07-11 09:58 - 2009-07-14 06:45 - 00277640 _____ C:\Windows\system32\FNTCACHE.DAT 2013-07-11 09:58 - 2007-01-02 03:25 - 00000000 ____D C:\Windows\Panther 2013-07-11 09:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-11 09:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-10 22:47 - 2012-01-20 16:14 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-07-09 22:53 - 2013-02-18 17:47 - 00225280 ____H C:\Users\Lee Hong Guan\Documents\photothumb.db 2013-07-09 22:43 - 2013-07-08 20:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-09 13:17 - 2012-01-17 14:18 - 00000000 ____D C:\Users\Lee Hong Guan 2013-07-09 13:08 - 2013-07-08 21:13 - 00000000 ____D C:\Program Files\CCleaner 2013-07-09 13:08 - 2013-04-27 22:35 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft 2013-07-09 13:08 - 2012-06-20 23:38 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\DVDVideoSoft 2013-07-09 13:08 - 2012-01-17 15:28 - 00000000 ___RD C:\Users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-07-09 13:08 - 2011-11-13 13:52 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-07-09 13:08 - 2011-11-13 04:07 - 00000000 ____D C:\ProgramData\Atheros 2013-07-09 13:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2013-07-09 13:07 - 2013-07-04 12:18 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-07-09 13:07 - 2012-01-17 16:07 - 00000000 ____D C:\ProgramData\Real 2013-07-09 13:07 - 2012-01-17 15:39 - 00000000 ____D C:\Users\LEEHON~1\AppData\Local\Mozilla 2013-07-09 12:40 - 2013-07-09 10:45 - 00000000 ____D C:\Windows\pss 2013-07-08 23:02 - 2013-07-08 23:02 - 00000000 ____D C:\Windows\Sun 2013-07-08 21:15 - 2012-03-15 22:59 - 00000000 ____D C:\Users\Lee Hong Guan\Tracing 2013-07-08 21:15 - 2012-01-17 16:13 - 00000000 ____D C:\Users\LEEHON~1\AppData\Local\CrashDumps 2013-07-08 20:50 - 2013-07-08 20:50 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Malwarebytes 2013-07-07 15:13 - 2012-01-20 14:14 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Skype 2013-07-06 23:22 - 2012-02-10 01:45 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-07-06 23:22 - 2012-01-19 09:22 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-07-06 14:27 - 2011-08-02 13:17 - 00000000 ____D C:\Program Files (x86)\HP Games 2013-07-06 14:14 - 2013-07-06 11:49 - 00010672 _____ C:\Windows\system32\Drivers\kgpcpy.cfg 2013-07-06 13:51 - 2013-07-06 13:51 - 00000240 _____ C:\Windows\SysWOW64\Drivers\kgpcpy.cfg 2013-07-06 13:21 - 2013-07-04 20:00 - 00000016 _____ C:\Windows\system32\config\software.szfi 2013-07-06 11:15 - 2010-11-21 05:47 - 00298736 _____ C:\Windows\PFRO.log 2013-07-06 11:04 - 2013-07-06 11:04 - 00010464 _____ C:\Windows\SysWOW64\sx_p2d.tlb 2013-07-06 10:53 - 2013-07-06 10:47 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog 2013-07-06 10:46 - 2013-07-06 10:46 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data 2013-07-05 14:50 - 2013-07-05 14:48 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001 2013-07-05 14:50 - 2013-07-05 14:48 - 00003226 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001 2013-07-05 14:50 - 2012-01-17 16:07 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Real 2013-07-05 14:48 - 2013-07-05 14:48 - 00001128 _____ C:\Users\Public\Desktop\RealPlayer.lnk 2013-07-05 14:48 - 2012-03-05 21:22 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\RealNetworks 2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\ProgramData\RealNetworks 2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\Program Files (x86)\RealNetworks 2013-07-05 14:47 - 2012-01-17 16:07 - 00000000 ____D C:\Program Files (x86)\Real 2013-07-05 14:46 - 2013-07-05 14:46 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll 2013-07-05 14:46 - 2013-07-05 14:46 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll 2013-07-05 11:36 - 2012-08-27 20:46 - 00004138 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA 2013-07-05 11:36 - 2012-08-27 20:46 - 00003742 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core 2013-07-04 19:33 - 2012-11-08 13:30 - 00000000 ____D C:\Windows\Minidump 2013-07-04 18:53 - 2013-07-04 18:47 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012 2013-07-04 12:42 - 2013-07-04 12:42 - 00000000 _____ C:\Windows\SysWOW64\sho3E87.tmp 2013-07-04 12:01 - 2013-07-04 12:00 - 00000085 _____ C:\Windows\wininit.ini 2013-07-04 11:40 - 2013-07-04 11:35 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-07-04 11:35 - 2013-07-04 11:35 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-07-04 11:18 - 2012-01-17 15:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-04 10:45 - 2013-07-04 10:45 - 00000000 _____ C:\Windows\SysWOW64\shoA15E.tmp 2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\freepdf 2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\SoftwareUpdater 2013-07-04 10:36 - 2013-07-04 10:36 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater 2013-07-04 10:27 - 2013-07-04 10:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Originals 2013-07-04 10:22 - 2012-07-16 12:14 - 00930816 ____H C:\Users\Lee Hong Guan\Downloads\photothumb.db 2013-07-02 18:48 - 2012-03-05 21:37 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\vlc 2013-07-01 10:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-06-29 20:17 - 2012-01-17 15:27 - 00058408 _____ C:\Users\LEEHON~1\AppData\Local\GDIPFONTCACHEV1.DAT 2013-06-26 17:22 - 2011-08-02 13:31 - 00000000 ____D C:\ProgramData\Skype 2013-06-26 17:21 - 2013-01-23 10:55 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-06-24 12:27 - 2013-06-24 12:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Autoruns_11.61 2013-06-24 11:11 - 2013-06-24 11:03 - 00000000 ____D C:\Program Files (x86)\Defender Pro Quick Scanner 2013-06-24 11:05 - 2013-06-24 11:05 - 00001011 _____ C:\quickscan.xml 2013-06-24 11:05 - 2013-06-24 11:04 - 00009850 _____ C:\quickscan.txt 2013-06-24 11:04 - 2013-06-24 11:04 - 02051696 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs64.dll 2013-06-24 11:04 - 2013-06-24 11:04 - 00733224 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs.dll 2013-06-24 11:04 - 2013-06-24 11:04 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\QuickScan 2013-06-24 10:50 - 2013-06-24 10:50 - 00003306 _____ C:\Windows\System32\Tasks\4799 2013-06-24 10:50 - 2013-06-24 10:50 - 00003204 _____ C:\Windows\System32\Tasks\0 2013-06-24 10:22 - 2013-06-19 09:51 - 00000005 _____ C:\Users\Lee Hong Guan\AppData\Roaming\WBPU-TTL.DAT 2013-06-23 16:24 - 2013-06-23 16:24 - 13579152 _____ C:\Users\Lee Hong Guan\Downloads\mf socrates.mp4 2013-06-23 16:22 - 2013-06-23 16:22 - 14196074 _____ C:\Users\Lee Hong Guan\Downloads\mf kriz.mp4 2013-06-23 16:19 - 2013-06-23 16:19 - 10337572 _____ C:\Users\Lee Hong Guan\Downloads\MF kriz chiko.mp4 2013-06-18 21:20 - 2013-06-18 21:19 - 00004944 _____ C:\Windows\SysWOW64\jupdate-1.7.0_25-b16.log 2013-06-18 21:20 - 2013-03-09 17:30 - 00000000 ____D C:\Program Files (x86)\Java 2013-06-17 13:38 - 2012-01-26 12:41 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Bluetooth Folder 2013-06-14 23:15 - 2013-06-14 23:15 - 00000017 _____ C:\Windows\SysWOW64\shortcut_ex.dat Files to move or delete: ==================== C:\ProgramData\ntuser.dat ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-03 13:05 ==================== End Of Log ============================ FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-07-2013
==================== Installed Programs =======================
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
AMD APP SDK Runtime (Version: 2.4.650.9)
AMD Fuel (Version: 2011.0705.1115.18310)
AMD Media Foundation Decoders (Version: 1.0.60705.1113)
AMD VISION Engine Control Center (x32 Version: 2011.0705.1115.18310)
Atheros Bluetooth Suite (64) (Version: 7.4.0.102)
Atheros Driver Installation Program (x32 Version: 9.2)
ATI Catalyst Install Manager (Version: 3.0.829.0)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Big Rig Europe (x32 Version: 2.2.0.95)
Blasterball 3 (x32 Version: 2.2.0.95)
Bounce Symphony (x32 Version: 2.2.0.95)
Cake Mania (x32 Version: 2.2.0.95)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0705.1115.18310)
Catalyst Control Center InstallProxy (x32 Version: 2011.0705.1115.18310)
Catalyst Control Center Localization All (x32 Version: 2011.0705.1115.18310)
CCC Help Chinese Standard (x32 Version: 2011.0705.1114.18310)
CCC Help Chinese Traditional (x32 Version: 2011.0705.1114.18310)
CCC Help Czech (x32 Version: 2011.0705.1114.18310)
CCC Help Danish (x32 Version: 2011.0705.1114.18310)
CCC Help Dutch (x32 Version: 2011.0705.1114.18310)
CCC Help English (x32 Version: 2011.0705.1114.18310)
CCC Help Finnish (x32 Version: 2011.0705.1114.18310)
CCC Help French (x32 Version: 2011.0705.1114.18310)
CCC Help German (x32 Version: 2011.0705.1114.18310)
CCC Help Greek (x32 Version: 2011.0705.1114.18310)
CCC Help Hungarian (x32 Version: 2011.0705.1114.18310)
CCC Help Italian (x32 Version: 2011.0705.1114.18310)
CCC Help Japanese (x32 Version: 2011.0705.1114.18310)
CCC Help Korean (x32 Version: 2011.0705.1114.18310)
CCC Help Norwegian (x32 Version: 2011.0705.1114.18310)
CCC Help Polish (x32 Version: 2011.0705.1114.18310)
CCC Help Portuguese (x32 Version: 2011.0705.1114.18310)
CCC Help Russian (x32 Version: 2011.0705.1114.18310)
CCC Help Spanish (x32 Version: 2011.0705.1114.18310)
CCC Help Swedish (x32 Version: 2011.0705.1114.18310)
CCC Help Thai (x32 Version: 2011.0705.1114.18310)
CCC Help Turkish (x32 Version: 2011.0705.1114.18310)
ccc-utility64 (Version: 2011.0705.1115.18310)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cisco EAP-FAST Module (x32 Version: 2.2.14)
Cisco LEAP Module (x32 Version: 1.0.19)
Cisco PEAP Module (x32 Version: 1.1.6)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.95)
CyberLink YouCam (x32 Version: 3.2.1.3726)
D3DX10 (x32 Version: 15.4.2368.0902)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
DVD Shrink 3.2 (x32)
Energy Star Digital Logo (x32 Version: 1.0.1)
ESU for Microsoft Windows 7 SP1 (x32 Version: 2.1.1)
Evernote v. 4.2.2 (x32 Version: 4.2.2.3979)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.95)
Fishdom (x32 Version: 2.2.0.95)
Free YouTube Download version 3.2.2.422 (x32 Version: 3.2.2.422)
Free YouTube to MP3 Converter version 3.12.2.422 (x32 Version: 3.12.2.422)
Google Chrome (x32 Version: 28.0.1500.71)
Google Talk Plugin (x32 Version: 4.2.1.14031)
Google Update Helper (x32 Version: 1.3.21.145)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP Auto (Version: 1.0.12935.3667)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Deskjet 2050 J510 series Hilfe (x32 Version: 140.0.61.61)
HP Documentation (x32 Version: 1.1.0.0)
HP Games (x32 Version: 1.0.2.4)
HP On Screen Display (x32 Version: 1.3.5)
HP Photo Creations (x32 Version: 1.0.0.3781)
HP Power Manager (x32 Version: 1.2.1)
HP Quick Launch (x32 Version: 2.7.2)
HP Setup (x32 Version: 8.5.4526.3645)
HP Software Framework (x32 Version: 4.6.10.1)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.002.006.003)
HP Wireless Assistant (Version: 4.0.10.0)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 22 (64-bit) (Version: 6.0.220)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
Mah Jong Medley (x32 Version: 2.2.0.95)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5128.5002)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0)
MotoHelper MergeModules (x32 Version: 1.2.0)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95)
Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95)
Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0)
Nero Blu-ray Player (x32 Version: 12.0.20012)
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000)
Nero Core Components (x32 Version: 11.0.20200)
Nero Kwik Media (x32 Version: 1.18.20100)
Nero Kwik Media (x32 Version: 12.5.00300)
Nero Kwik Media Help (CHM) (x32 Version: 12.0.12000)
Nero Kwik Themes Basic (x32 Version: 12.0.11500)
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0)
Nero Update (x32 Version: 11.0.11800.31.0)
neroxml (x32 Version: 1.0.0)
PDF Complete Special Edition (x32 Version: 4.0.34)
Penguins! (x32 Version: 2.2.0.95)
PhotoScape (x32)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Polar Bowler (x32 Version: 2.2.0.95)
Prerequisite installer (x32 Version: 12.0.0003)
RealDownloader (x32 Version: 1.3.2)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.2)
Realtek Ethernet Controller Driver (x32 Version: 7.42.304.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6287)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.77)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Recovery Manager (x32 Version: 1.0.22)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Skype™ 6.5 (x32 Version: 6.5.158)
Slingo Deluxe (x32 Version: 2.2.0.95)
Synaptics Pointing Device Driver (Version: 15.2.4.3)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
Visitenkarten in 2 Minuten (x32)
VLC media player 2.0.0 (x32 Version: 2.0.0)
Wedding Dash (x32 Version: 2.2.0.95)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.5)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Xobni (x32 Version: 1.9.5.13209)
Xobni Core (x32 Version: 1.0.0)
Yahoo! Messenger (x32)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
23-06-2013 17:00:16 Windows-Sicherung
24-06-2013 17:12:43 Windows Update
28-06-2013 16:17:30 Windows Update
30-06-2013 18:53:24 Windows-Sicherung
01-07-2013 21:57:04 Windows Update
04-07-2013 08:37:09 Free Pdf Perfect Prereq
04-07-2013 08:52:02 Free Pdf Perfect Prereq
04-07-2013 16:57:40 Installed Microsoft Fix it 50522
04-07-2013 17:01:29 Installed Microsoft Fix it 50522
04-07-2013 17:17:20 Installed STOPzilla
04-07-2013 19:02:41 Removed STOPzilla
05-07-2013 12:53:02 Windows Update
06-07-2013 08:47:53 Free Pdf Perfect Prereq
06-07-2013 08:54:01 Free Pdf Perfect Prereq
06-07-2013 09:26:07 Installed STOPzilla
06-07-2013 09:49:32 STOPzilla Restore Point.
06-07-2013 12:33:05 Removed STOPzilla
06-07-2013 12:36:51 Removed STOPzilla
06-07-2013 12:46:41 Removed STOPzilla
07-07-2013 17:00:25 Windows-Sicherung
08-07-2013 18:52:22 Windows Update
09-07-2013 11:02:47 Wiederherstellungsvorgang
09-07-2013 11:29:19 Windows Update
10-07-2013 20:31:16 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-07-04 19:25 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {06F0F26A-049D-4055-AB87-70ADF21B598D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core => C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27] (Google Inc.)
Task: {09939E6D-CCCE-43A4-9009-DB131089C410} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {0B27FBF0-37CE-49D6-B6DA-4997A6F5909E} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {18A73559-2621-4B6D-9E29-9DE6BB8DAA35} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13] (Google Inc.)
Task: {3C8AF852-8130-42CE-AB05-362D80F72020} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-06-04] (Microsoft)
Task: {404C7E4B-B8F0-47CE-9D56-B6E8ABB29615} - System32\Tasks\DSite => C:\Users\LEEHON~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE No File
Task: {47E87F75-179B-4F56-AC4C-22B7D5181C52} - System32\Tasks\4799 => C:\Windows\System32\wscript.exe [2009-07-14] (Microsoft Corporation)
Task: {4AD5C283-0151-40AF-910D-011EF81F1BD8} - System32\Tasks\{C98FDD41-27B1-42D8-8447-151AA6D48FE5} => C:\Program Files (x86)\FVD Suite\FVDSuite.exe No File
Task: {4DEC2B1B-F17E-48AA-A7A7-2A78B07C9CD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {57D96809-0509-441C-A923-47CC4A9E4076} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {67F51E38-698B-4019-B666-00A5C8B6BB11} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {7A41963E-BEEA-4926-9D81-791B56DF0C01} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {90FD1B8A-DCEF-4BDA-8223-A6069BA03432} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {9444C850-52B1-4A2E-897A-AFF204569DC5} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {9A3FFDC7-79DD-43FF-AAC4-6DD886EA193E} - System32\Tasks\Browser Updater\Browser Updater => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {A013FBFA-7D37-4A65-8A08-54FC9427374B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-21] (Microsoft Corporation)
Task: {B2025A7B-79BC-4CE1-BF20-6CEAE6885B85} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {B4DC83C2-1074-44CC-9273-7116882162BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA => C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27] (Google Inc.)
Task: {B77D70E7-4B02-4F18-ACB8-6AB32225463F} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-04-16] (RealNetworks, Inc.)
Task: {BA2A910F-8D3C-42A6-AA39-53C7EA7FE351} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-02-09] (CyberLink)
Task: {BD7FA4E2-D600-49BA-9821-05A47854C4D0} - System32\Tasks\User_Feed_Synchronization-{7ED3601F-B192-488C-8297-41E3614F0C47} => C:\Windows\system32\msfeedssync.exe [2013-05-21] (Microsoft Corporation)
Task: {CEEE3410-0751-45DE-91B6-E1A76CD9F714} - System32\Tasks\{613C0AFC-D9DD-4063-8E98-3A1EDDDC59C3} => C:\Program Files (x86)\FVD Suite\FVDSuite.exe No File
Task: {DAF46943-8A06-408B-8887-2B2489CB8134} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] (Microsoft Corporation)
Task: {DE612E59-AB33-46A4-BF01-66668D785663} - System32\Tasks\0 => C:\program files\internet explorer\iexplore.exe [2013-06-12] (Microsoft Corporation)
Task: {E11C6BDC-89F4-4B99-AA7B-48B0D8CEFD99} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {E773D902-6539-48ED-A961-D2E59C17C39F} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] (Microsoft Corporation)
Task: {EBB4F325-AB7B-4AE9-A32A-ACD89937063F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated)
Task: {ED762C39-476E-4155-8A5E-6F915031D1E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-04-01] (Hewlett-Packard Company)
Task: {F2B8CB1E-2EAE-489C-BA7D-67C2ACDA5925} - System32\Tasks\HPCeeScheduleForLee Hong Guan => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {F347106F-1A2D-471C-BE64-C6F4E2902C1D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core.job => C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA.job => C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForLee Hong Guan.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Faulty Device Manager Devices =============
Name: Atheros AR3011 Bluetooth 3.0 + HS Adapter
Description: Atheros AR3011 Bluetooth 3.0 + HS Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/13/2013 11:47:20 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 05:52:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:41:48 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:28:52 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:15:11 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 09:18:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 03:22:23 PM) (Source: Application Hang) (User: )
Description: Programm WINWORDC.EXE, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 13d0
Startzeit: 01ce7e30367b6f79
Endzeit: 532
Anwendungspfad: Q:\140066.deu\Office14\WINWORDC.EXE
Berichts-ID: c7c6115d-ea2c-11e2-bf42-2c768ad82ab2
Error: (07/11/2013 09:58:37 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/10/2013 09:08:17 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/10/2013 00:56:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/13/2013 11:46:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/12/2013 09:13:27 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/12/2013 05:52:26 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/12/2013 03:35:16 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/12/2013 09:41:24 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/12/2013 09:39:45 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/12/2013 09:27:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/12/2013 09:26:07 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/12/2013 09:14:18 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/11/2013 11:19:46 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Microsoft Office Sessions:
=========================
Error: (07/13/2013 11:47:20 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 05:52:56 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:41:48 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:28:52 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/12/2013 09:15:11 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 09:18:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 03:22:23 PM) (Source: Application Hang)(User: )
Description: WINWORDC.EXE0.0.0.013d001ce7e30367b6f79532Q:\140066.deu\Office14\WINWORDC.EXEc7c6115d-ea2c-11e2-bf42-2c768ad82ab2
Error: (07/11/2013 09:58:37 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/10/2013 09:08:17 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/10/2013 00:56:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 73%
Total physical RAM: 1642.91 MB
Available physical RAM: 436.66 MB
Total Pagefile: 3285.81 MB
Available Pagefile: 1355.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:282.45 GB) (Free:154 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.34 GB) (Free:1.87 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32 (Disk=0 Partition=4)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 0EFD49B7)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
==================== End Of Log ============================
|
|
13.07.2013, 12:26
| #4 |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Hi, FRST.txt ist nicht komplett.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.07.2013, 13:32
| #5 |
| | wie entferne ich Home Tab\TBUpdater.dll? Hallo, hoffe, diesmal ist komplett?   |
|
13.07.2013, 15:18
| #6 |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Weiß ich nit, ich hab dir gesagt Du sollst die Logs in Codetags posten 
__________________ --> wie entferne ich Home Tab\TBUpdater.dll? |
|
13.07.2013, 16:49
| #7 |
| | wie entferne ich Home Tab\TBUpdater.dll? sorry.. ich weiss nicht, wo ich code-tags finde. :-( |
|
13.07.2013, 19:03
| #8 | |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Hier hab ich Dir haarklien erklärt wie man das macht  Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.07.2013, 20:11
| #9 |
| | wie entferne ich Home Tab\TBUpdater.dll? Leider Schrauber... habe so wenig ahnung wie ein haar oder staub! die anweisung habe verstanden, aber was ist denn CODE-BOX, wo ich die datei reinpacken soll??? gruß guan |
|
13.07.2013, 21:05
| #10 |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Wenn Du jetzt unter dieser Antwort von mir runter in die Antwortbox scrollst, siehst du neben vielen bunten Bildchen ein # Zeichen. Drauf klicken. jetzt siehst Du in der Antwortbox folgendes: [code ] [/code ] Dazwischen kopierste das Log. [code ]logfile hier rein[/code ] und abschicken, sieht dann nachher so aus: Code:
ATTFilter logfile hier rein
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.07.2013, 09:44
| #11 |
| | wie entferne ich Home Tab\TBUpdater.dll? FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-07-2013
Ran by Lee Hong Guan (administrator) on 13-07-2013 17:46:00
Running from C:\Users\Lee Hong Guan\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Windows Net) C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6602856 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-21] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden [363064 2010-07-21] (Hewlett-Packard Company)
HKLM\...\Run: [MSC] - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [AtherosBtStack] - "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [984736 2011-10-22] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [799904 2011-10-22] (Atheros Commnucations)
HKCU\...\Run: [Google Update] - "C:\Users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-08-27] (Google Inc.)
HKCU\...\Run: [QuickScanner] - C:\Program Files (x86)\Defender Pro Quick Scanner\quickscan.exe [14483800 2013-03-21] (Defender Pro)
HKCU\...\Policies\system: [disableregistrytools] 0
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [TkBellExe] - "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [295512 2013-07-05] (RealNetworks, Inc.)
Startup: C:\Users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
ShortcutTarget: net.lnk -> C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe (Windows Net)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
URLSearchHook: (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HomeTab - {ba696155-d96e-4281-b467-0367a0456474} - C:\Users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: QuickNet BHO - {EA5CA8B6-9B9C-4994-A7A1-947B6C631BE7} - C:\Program Files (x86)\RegTweaker\key.dll No File
Toolbar: HKLM-x32 - HomeTab - {ba696155-d96e-4281-b467-0367a0456474} - C:\Users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 83.169.184.33 83.169.184.97
FireFox:
========
FF ProfilePath: C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.5.109 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.5.109 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lee Hong Guan\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lee Hong Guan\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: pricealarm - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
FF Extension: HomeTab - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\{24532715-4abc-47ee-bd4f-a6774d0723d2}
FF Extension: artur.dubovoy - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\artur.dubovoy@gmail.com.xpi
FF Extension: No Name - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\WTB_GLOBAL.sqlite
FF Extension: No Name - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\Extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
Chrome:
=======
CHR RestoreOnStartup: "about:newtab?source=home"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\pdf.dll ()
CHR Plugin: (Google Talk Plugin) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (WildTangent Games App V2 Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealJukebox NS Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll No File
CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (RealDownloader) - C:\Users\LEEHON~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-06] (soft Xpansion)
S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-02-25] (Xobni Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-10-22] (Atheros)
==================== Drivers (Whitelisted) ====================
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 gfiark; system32\drivers\gfiark.sys [x]
S3 motmodem; system32\DRIVERS\motmodem.sys [x]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-13 11:55 - 2013-07-13 11:55 - 00000000 ____D C:\FRST
2013-07-13 11:54 - 2013-07-13 11:55 - 01777859 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST64.exe
2013-07-12 09:39 - 2013-07-12 09:39 - 00000000 ___SD C:\ComboFix
2013-07-12 09:33 - 2013-07-12 09:39 - 00000000 ____D C:\Qoobox
2013-07-12 09:31 - 2013-07-12 09:31 - 00000000 ____D C:\Windows\erdnt
2013-07-12 09:25 - 2013-07-12 09:25 - 00001267 _____ C:\AdwCleaner[S1].txt
2013-07-12 09:24 - 2013-07-12 09:25 - 00001205 _____ C:\AdwCleaner[R1].txt
2013-07-12 09:23 - 2013-07-12 09:23 - 00662345 _____ C:\Users\Lee Hong Guan\Downloads\adwcleaner.exe
2013-07-10 22:45 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 22:45 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 22:45 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 22:45 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 22:45 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 22:45 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 22:45 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 22:45 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 22:45 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 22:45 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 22:45 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 22:45 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 22:45 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 22:45 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 22:45 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 22:45 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 22:44 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 22:44 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 22:44 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 21:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 21:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 21:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 21:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 21:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 21:18 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 21:18 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-09 10:45 - 2013-07-09 12:40 - 00000000 ____D C:\Windows\pss
2013-07-08 23:02 - 2013-07-08 23:02 - 00000000 ____D C:\Windows\Sun
2013-07-08 21:13 - 2013-07-09 13:08 - 00000000 ____D C:\Program Files\CCleaner
2013-07-08 20:50 - 2013-07-08 20:50 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Malwarebytes
2013-07-08 20:49 - 2013-07-09 22:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-07 14:39 - 2013-07-11 16:36 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\SoftGrid Client
2013-07-06 13:51 - 2013-07-06 13:51 - 00000240 _____ C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2013-07-06 11:49 - 2013-07-06 14:14 - 00010672 _____ C:\Windows\system32\Drivers\kgpcpy.cfg
2013-07-06 11:04 - 2013-07-06 11:04 - 00010464 _____ C:\Windows\SysWOW64\sx_p2d.tlb
2013-07-06 10:47 - 2013-07-06 10:53 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-07-06 10:46 - 2013-07-06 10:46 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data
2013-07-05 14:48 - 2013-07-05 14:50 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001
2013-07-05 14:48 - 2013-07-05 14:50 - 00003226 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001
2013-07-05 14:48 - 2013-07-05 14:48 - 00001128 _____ C:\Users\Public\Desktop\RealPlayer.lnk
2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\ProgramData\RealNetworks
2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-07-05 14:46 - 2013-07-05 14:46 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-07-04 20:00 - 2013-07-06 13:21 - 00000016 _____ C:\Windows\system32\config\software.szfi
2013-07-04 18:47 - 2013-07-04 18:53 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012
2013-07-04 12:42 - 2013-07-04 12:42 - 00000000 _____ C:\Windows\SysWOW64\sho3E87.tmp
2013-07-04 12:18 - 2013-07-09 13:07 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-04 12:00 - 2013-07-04 12:01 - 00000085 _____ C:\Windows\wininit.ini
2013-07-04 11:35 - 2013-07-04 11:40 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-04 11:35 - 2013-07-04 11:35 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-04 10:45 - 2013-07-04 10:45 - 00000000 _____ C:\Windows\SysWOW64\shoA15E.tmp
2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\freepdf
2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\SoftwareUpdater
2013-07-04 10:36 - 2013-07-04 10:36 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater
2013-07-04 10:36 - 2013-05-13 05:52 - 00023624 _____ C:\Windows\Launcher.exe
2013-07-04 10:27 - 2013-07-04 10:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Originals
2013-06-24 12:27 - 2013-06-24 12:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Autoruns_11.61
2013-06-24 11:05 - 2013-06-24 11:05 - 00001011 _____ C:\quickscan.xml
2013-06-24 11:04 - 2013-06-24 11:05 - 00009850 _____ C:\quickscan.txt
2013-06-24 11:04 - 2013-06-24 11:04 - 02051696 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs64.dll
2013-06-24 11:04 - 2013-06-24 11:04 - 00733224 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs.dll
2013-06-24 11:04 - 2013-06-24 11:04 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\QuickScan
2013-06-24 11:03 - 2013-06-24 11:11 - 00000000 ____D C:\Program Files (x86)\Defender Pro Quick Scanner
2013-06-24 10:50 - 2013-06-24 10:50 - 00003306 _____ C:\Windows\System32\Tasks\4799
2013-06-24 10:50 - 2013-06-24 10:50 - 00003204 _____ C:\Windows\System32\Tasks\0
2013-06-23 16:24 - 2013-06-23 16:24 - 13579152 _____ C:\Users\Lee Hong Guan\Downloads\mf socrates.mp4
2013-06-23 16:22 - 2013-06-23 16:22 - 14196074 _____ C:\Users\Lee Hong Guan\Downloads\mf kriz.mp4
2013-06-23 16:19 - 2013-06-23 16:19 - 10337572 _____ C:\Users\Lee Hong Guan\Downloads\MF kriz chiko.mp4
2013-06-19 09:51 - 2013-06-24 10:22 - 00000005 _____ C:\Users\Lee Hong Guan\AppData\Roaming\WBPU-TTL.DAT
2013-06-18 21:21 - 2013-06-12 21:43 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-18 21:20 - 2013-06-12 21:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-18 21:20 - 2013-06-12 21:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-18 21:20 - 2013-06-12 21:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-18 21:19 - 2013-06-18 21:20 - 00004944 _____ C:\Windows\SysWOW64\jupdate-1.7.0_25-b16.log
2013-06-14 23:15 - 2013-06-14 23:15 - 00000017 _____ C:\Windows\SysWOW64\shortcut_ex.dat
2013-06-13 08:23 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-13 08:23 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-13 08:23 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 08:22 - 2013-05-13 07:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-13 08:22 - 2013-05-13 07:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-13 08:22 - 2013-05-13 07:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-13 08:22 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-13 08:22 - 2013-05-13 06:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 08:22 - 2013-05-13 06:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 08:22 - 2013-05-13 06:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 08:22 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-13 08:22 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 08:22 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 08:22 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-13 08:22 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 08:22 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 08:22 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 08:22 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-13 08:22 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
==================== One Month Modified Files and Folders =======
2013-07-13 17:37 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-13 17:37 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-13 17:35 - 2011-08-02 22:29 - 00654844 _____ C:\Windows\system32\perfh007.dat
2013-07-13 17:35 - 2011-08-02 22:29 - 00130426 _____ C:\Windows\system32\perfc007.dat
2013-07-13 17:35 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-13 17:33 - 2011-11-13 04:01 - 01575253 _____ C:\Windows\WindowsUpdate.log
2013-07-13 17:29 - 2012-10-13 09:47 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-13 17:29 - 2011-08-02 13:31 - 00000000 ____D C:\ProgramData\PDFC
2013-07-13 17:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-13 17:28 - 2009-07-14 06:51 - 00121716 _____ C:\Windows\setupact.log
2013-07-13 14:23 - 2012-04-02 09:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-13 14:22 - 2012-08-27 20:46 - 00001152 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA.job
2013-07-13 14:22 - 2012-08-27 20:46 - 00001100 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core.job
2013-07-13 14:17 - 2012-08-27 20:46 - 00004138 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA
2013-07-13 14:17 - 2012-08-27 20:46 - 00003742 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core
2013-07-13 14:16 - 2013-05-17 13:25 - 00000364 _____ C:\Windows\Tasks\HPCeeScheduleForLee Hong Guan.job
2013-07-13 14:15 - 2012-10-13 09:47 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-13 11:55 - 2013-07-13 11:55 - 00000000 ____D C:\FRST
2013-07-13 11:55 - 2013-07-13 11:54 - 01777859 _____ (Farbar) C:\Users\Lee Hong Guan\Downloads\FRST64.exe
2013-07-13 11:46 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 17:58 - 2012-01-17 15:28 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{7ED3601F-B192-488C-8297-41E3614F0C47}
2013-07-12 09:39 - 2013-07-12 09:39 - 00000000 ___SD C:\ComboFix
2013-07-12 09:39 - 2013-07-12 09:33 - 00000000 ____D C:\Qoobox
2013-07-12 09:31 - 2013-07-12 09:31 - 00000000 ____D C:\Windows\erdnt
2013-07-12 09:25 - 2013-07-12 09:25 - 00001267 _____ C:\AdwCleaner[S1].txt
2013-07-12 09:25 - 2013-07-12 09:24 - 00001205 _____ C:\AdwCleaner[R1].txt
2013-07-12 09:23 - 2013-07-12 09:23 - 00662345 _____ C:\Users\Lee Hong Guan\Downloads\adwcleaner.exe
2013-07-11 16:36 - 2013-07-07 14:39 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\SoftGrid Client
2013-07-11 15:43 - 2012-01-17 15:39 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla
2013-07-11 09:58 - 2009-07-14 06:45 - 00277640 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 09:58 - 2007-01-02 03:25 - 00000000 ____D C:\Windows\Panther
2013-07-11 09:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 09:57 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 22:47 - 2012-01-20 16:14 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-09 22:53 - 2013-02-18 17:47 - 00225280 ____H C:\Users\Lee Hong Guan\Documents\photothumb.db
2013-07-09 22:43 - 2013-07-08 20:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-09 13:17 - 2012-01-17 14:18 - 00000000 ____D C:\Users\Lee Hong Guan
2013-07-09 13:08 - 2013-07-08 21:13 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 13:08 - 2013-04-27 22:35 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-07-09 13:08 - 2012-06-20 23:38 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\DVDVideoSoft
2013-07-09 13:08 - 2012-01-17 15:28 - 00000000 ___RD C:\Users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-09 13:08 - 2011-11-13 13:52 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-09 13:08 - 2011-11-13 04:07 - 00000000 ____D C:\ProgramData\Atheros
2013-07-09 13:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-09 13:07 - 2013-07-04 12:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-09 13:07 - 2012-01-17 16:07 - 00000000 ____D C:\ProgramData\Real
2013-07-09 13:07 - 2012-01-17 15:39 - 00000000 ____D C:\Users\LEEHON~1\AppData\Local\Mozilla
2013-07-09 12:40 - 2013-07-09 10:45 - 00000000 ____D C:\Windows\pss
2013-07-08 23:02 - 2013-07-08 23:02 - 00000000 ____D C:\Windows\Sun
2013-07-08 21:15 - 2012-03-15 22:59 - 00000000 ____D C:\Users\Lee Hong Guan\Tracing
2013-07-08 21:15 - 2012-01-17 16:13 - 00000000 ____D C:\Users\LEEHON~1\AppData\Local\CrashDumps
2013-07-08 20:50 - 2013-07-08 20:50 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Malwarebytes
2013-07-07 15:13 - 2012-01-20 14:14 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Skype
2013-07-06 23:22 - 2012-02-10 01:45 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-07-06 23:22 - 2012-01-19 09:22 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-07-06 14:27 - 2011-08-02 13:17 - 00000000 ____D C:\Program Files (x86)\HP Games
2013-07-06 14:14 - 2013-07-06 11:49 - 00010672 _____ C:\Windows\system32\Drivers\kgpcpy.cfg
2013-07-06 13:51 - 2013-07-06 13:51 - 00000240 _____ C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2013-07-06 13:21 - 2013-07-04 20:00 - 00000016 _____ C:\Windows\system32\config\software.szfi
2013-07-06 11:15 - 2010-11-21 05:47 - 00298736 _____ C:\Windows\PFRO.log
2013-07-06 11:04 - 2013-07-06 11:04 - 00010464 _____ C:\Windows\SysWOW64\sx_p2d.tlb
2013-07-06 10:53 - 2013-07-06 10:47 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-07-06 10:46 - 2013-07-06 10:46 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Windows Net Data
2013-07-05 14:50 - 2013-07-05 14:48 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3341223641-901810946-21637757-1001
2013-07-05 14:50 - 2013-07-05 14:48 - 00003226 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3341223641-901810946-21637757-1001
2013-07-05 14:50 - 2012-01-17 16:07 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\Real
2013-07-05 14:48 - 2013-07-05 14:48 - 00001128 _____ C:\Users\Public\Desktop\RealPlayer.lnk
2013-07-05 14:48 - 2012-03-05 21:22 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\RealNetworks
2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\ProgramData\RealNetworks
2013-07-05 14:47 - 2013-07-05 14:47 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-07-05 14:47 - 2012-01-17 16:07 - 00000000 ____D C:\Program Files (x86)\Real
2013-07-05 14:46 - 2013-07-05 14:46 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-07-05 14:46 - 2013-07-05 14:46 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-07-04 19:33 - 2012-11-08 13:30 - 00000000 ____D C:\Windows\Minidump
2013-07-04 18:53 - 2013-07-04 18:47 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012
2013-07-04 12:42 - 2013-07-04 12:42 - 00000000 _____ C:\Windows\SysWOW64\sho3E87.tmp
2013-07-04 12:01 - 2013-07-04 12:00 - 00000085 _____ C:\Windows\wininit.ini
2013-07-04 11:40 - 2013-07-04 11:35 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-04 11:35 - 2013-07-04 11:35 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-04 11:18 - 2012-01-17 15:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-04 10:45 - 2013-07-04 10:45 - 00000000 _____ C:\Windows\SysWOW64\shoA15E.tmp
2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\freepdf
2013-07-04 10:38 - 2013-07-04 10:38 - 00000000 ____D C:\SoftwareUpdater
2013-07-04 10:36 - 2013-07-04 10:36 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater
2013-07-04 10:27 - 2013-07-04 10:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Originals
2013-07-04 10:22 - 2012-07-16 12:14 - 00930816 ____H C:\Users\Lee Hong Guan\Downloads\photothumb.db
2013-07-02 18:48 - 2012-03-05 21:37 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\vlc
2013-07-01 10:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-29 20:17 - 2012-01-17 15:27 - 00058408 _____ C:\Users\LEEHON~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-26 17:22 - 2011-08-02 13:31 - 00000000 ____D C:\ProgramData\Skype
2013-06-26 17:21 - 2013-01-23 10:55 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-24 12:27 - 2013-06-24 12:27 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Autoruns_11.61
2013-06-24 11:11 - 2013-06-24 11:03 - 00000000 ____D C:\Program Files (x86)\Defender Pro Quick Scanner
2013-06-24 11:05 - 2013-06-24 11:05 - 00001011 _____ C:\quickscan.xml
2013-06-24 11:05 - 2013-06-24 11:04 - 00009850 _____ C:\quickscan.txt
2013-06-24 11:04 - 2013-06-24 11:04 - 02051696 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs64.dll
2013-06-24 11:04 - 2013-06-24 11:04 - 00733224 _____ (Bitdefender SRL) C:\Users\LEEHON~1\AppData\Local\qs.dll
2013-06-24 11:04 - 2013-06-24 11:04 - 00000000 ____D C:\Users\Lee Hong Guan\AppData\Roaming\QuickScan
2013-06-24 10:50 - 2013-06-24 10:50 - 00003306 _____ C:\Windows\System32\Tasks\4799
2013-06-24 10:50 - 2013-06-24 10:50 - 00003204 _____ C:\Windows\System32\Tasks\0
2013-06-24 10:22 - 2013-06-19 09:51 - 00000005 _____ C:\Users\Lee Hong Guan\AppData\Roaming\WBPU-TTL.DAT
2013-06-23 16:24 - 2013-06-23 16:24 - 13579152 _____ C:\Users\Lee Hong Guan\Downloads\mf socrates.mp4
2013-06-23 16:22 - 2013-06-23 16:22 - 14196074 _____ C:\Users\Lee Hong Guan\Downloads\mf kriz.mp4
2013-06-23 16:19 - 2013-06-23 16:19 - 10337572 _____ C:\Users\Lee Hong Guan\Downloads\MF kriz chiko.mp4
2013-06-18 21:20 - 2013-06-18 21:19 - 00004944 _____ C:\Windows\SysWOW64\jupdate-1.7.0_25-b16.log
2013-06-18 21:20 - 2013-03-09 17:30 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-17 13:38 - 2012-01-26 12:41 - 00000000 ____D C:\Users\Lee Hong Guan\Documents\Bluetooth Folder
2013-06-14 23:15 - 2013-06-14 23:15 - 00000017 _____ C:\Windows\SysWOW64\shortcut_ex.dat
Files to move or delete:
====================
C:\ProgramData\ntuser.dat
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 13:05
==================== End Of Log ============================
--- --- --- Lieber Schrauber... hoffe, diesmal ist endlich richtig :-)) Dir einen ungenervten aber entspannten Sonntag! |
|
14.07.2013, 12:43
| #12 | |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Perfekt Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.07.2013, 13:51
| #13 |
| | wie entferne ich Home Tab\TBUpdater.dll? Combofix Logfile: Code:
ATTFilter ComboFix 13-07-14.01 - Lee Hong Guan 14.07.2013 14:31:54.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1643.481 [GMT 2:00]
ausgeführt von:: c:\users\Lee Hong Guan\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-14 bis 2013-07-14 ))))))))))))))))))))))))))))))
.
.
2013-07-14 12:43 . 2013-07-14 12:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-14 12:22 . 2013-07-14 12:22 0 ----a-w- c:\windows\SysWow64\sho75A0.tmp
2013-07-14 11:18 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91789397-20FA-41F2-AB60-3B665BA63BC2}\mpengine.dll
2013-07-13 10:00 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-13 09:55 . 2013-07-13 09:55 -------- d-----w- C:\FRST
2013-07-10 20:44 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-10 20:44 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-10 19:18 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-07-10 19:18 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-07-08 21:02 . 2013-07-08 21:02 -------- d-----w- c:\windows\Sun
2013-07-08 19:13 . 2013-07-09 11:08 -------- d-----w- c:\program files\CCleaner
2013-07-08 18:50 . 2013-07-08 18:50 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\Malwarebytes
2013-07-08 18:49 . 2013-07-09 20:43 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-07 12:39 . 2013-07-11 14:36 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\SoftGrid Client
2013-07-06 09:04 . 2013-07-06 09:04 -------- d-----w- c:\program files (x86)\Common Files\soft Xpansion
2013-07-06 08:46 . 2013-07-06 08:46 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\Windows Net Data
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\program files (x86)\RealNetworks
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\programdata\RealNetworks
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\program files (x86)\Common Files\xing shared
2013-07-05 12:46 . 2013-07-05 12:46 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2013-07-05 12:46 . 2013-07-05 12:46 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2013-07-04 16:47 . 2013-07-04 16:53 -------- d-----w- c:\program files (x86)\RegistryNuke 2012
2013-07-04 10:42 . 2013-07-04 10:42 0 ----a-w- c:\windows\SysWow64\sho3E87.tmp
2013-07-04 10:18 . 2013-07-09 11:07 -------- d-----w- c:\programdata\Malwarebytes
2013-07-04 09:35 . 2013-07-04 09:40 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-07-04 08:45 . 2013-07-04 08:45 0 ----a-w- c:\windows\SysWow64\shoA15E.tmp
2013-07-04 08:38 . 2013-07-04 08:38 -------- d-----w- C:\SoftwareUpdater
2013-07-04 08:36 . 2013-05-13 03:52 23624 ----a-w- c:\windows\Launcher.exe
2013-06-24 09:04 . 2013-06-24 09:04 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\QuickScan
2013-06-24 09:03 . 2013-06-24 09:11 -------- d-----w- c:\program files (x86)\Defender Pro Quick Scanner
2013-06-21 07:16 . 2013-06-21 07:13 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{41830778-8711-4ED5-983B-7C78038DCF2A}\gapaengine.dll
2013-06-18 19:20 . 2013-06-12 19:47 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 12:55 . 2012-01-17 16:04 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-07-11 12:55 . 2012-01-17 16:04 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-07-10 20:47 . 2012-01-20 14:14 78185248 ----a-w- c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-27 19:42 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2011-08-02 11:38 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-11 20:23 . 2012-04-02 07:42 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 20:23 . 2012-01-17 13:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-06 21:09 . 2013-06-06 21:09 0 ----a-w- c:\windows\SysWow64\sho3E6.tmp
2013-05-27 20:57 . 2013-05-27 20:57 0 ----a-w- c:\windows\SysWow64\sho9942.tmp
2013-05-24 21:34 . 2013-05-24 21:34 0 ----a-w- c:\windows\SysWow64\sho79ED.tmp
2013-05-21 20:58 . 2013-05-21 20:58 0 ----a-w- c:\windows\SysWow64\sho849C.tmp
2013-05-21 18:49 . 2012-02-11 04:15 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-21 13:04 . 2013-05-21 13:04 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-21 13:04 . 2013-05-21 13:04 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-05-21 13:04 . 2013-05-21 13:04 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-05-21 13:04 . 2013-05-21 13:04 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-05-21 13:04 . 2013-05-21 13:04 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-05-21 13:04 . 2013-05-21 13:04 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-05-21 13:04 . 2013-05-21 13:04 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-05-21 13:04 . 2013-05-21 13:04 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-05-21 13:04 . 2013-05-21 13:04 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-05-21 13:04 . 2013-05-21 13:04 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-05-21 13:04 . 2013-05-21 13:04 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-05-21 13:04 . 2013-05-21 13:04 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-21 13:04 . 2013-05-21 13:04 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-05-21 13:04 . 2013-05-21 13:04 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-05-21 13:04 . 2013-05-21 13:04 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-05-21 13:04 . 2013-05-21 13:04 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-05-21 13:04 . 2013-05-21 13:04 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-05-21 13:04 . 2013-05-21 13:04 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-05-21 13:04 . 2013-05-21 13:04 441856 ----a-w- c:\windows\system32\html.iec
2013-05-21 13:04 . 2013-05-21 13:04 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-05-21 13:04 . 2013-05-21 13:04 216064 ----a-w- c:\windows\system32\msls31.dll
2013-05-21 13:04 . 2013-05-21 13:04 197120 ----a-w- c:\windows\system32\msrating.dll
2013-05-21 13:04 . 2013-05-21 13:04 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-05-21 13:04 . 2013-05-21 13:04 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-21 13:04 . 2013-05-21 13:04 81408 ----a-w- c:\windows\system32\icardie.dll
2013-05-21 13:04 . 2013-05-21 13:04 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-05-21 13:04 . 2013-05-21 13:04 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-21 13:04 . 2013-05-21 13:04 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-05-21 13:04 . 2013-05-21 13:04 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-05-21 13:04 . 2013-05-21 13:04 235008 ----a-w- c:\windows\system32\url.dll
2013-05-21 13:04 . 2013-05-21 13:04 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-21 13:04 . 2013-05-21 13:04 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-05-21 13:04 . 2013-05-21 13:04 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-05-21 13:04 . 2013-05-21 13:04 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-05-21 13:04 . 2013-05-21 13:04 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-05-21 13:04 . 2013-05-21 13:04 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-05-21 13:04 . 2013-05-21 13:04 144896 ----a-w- c:\windows\system32\wextract.exe
2013-05-21 13:04 . 2013-05-21 13:04 102912 ----a-w- c:\windows\system32\inseng.dll
2013-05-21 13:04 . 2013-05-21 13:04 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-05-21 13:04 . 2013-05-21 13:04 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-05-21 13:04 . 2013-05-21 13:04 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-05-21 13:04 . 2013-05-21 13:04 149504 ----a-w- c:\windows\system32\occache.dll
2013-05-21 13:04 . 2013-05-21 13:04 13824 ----a-w- c:\windows\system32\mshta.exe
2013-05-21 13:04 . 2013-05-21 13:04 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-05-21 13:04 . 2013-05-21 13:04 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-05-21 13:04 . 2013-05-21 13:04 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-05-21 13:04 . 2013-05-21 13:03 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-21 13:03 . 2013-05-21 13:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-05-21 13:03 . 2013-05-21 13:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-05-18 15:26 . 2013-05-18 15:26 0 ----a-w- c:\windows\SysWow64\shoCA98.tmp
2013-05-16 08:30 . 2013-05-16 08:30 0 ----a-w- c:\windows\SysWow64\sho33C.tmp
2013-05-13 05:51 . 2013-06-13 06:22 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-13 06:22 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-13 06:22 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-13 06:22 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-13 06:22 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-13 06:22 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 04:45 . 2013-06-13 06:22 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 03:43 . 2013-06-13 06:22 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-13 06:22 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-13 06:22 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-10 06:57 . 2012-03-06 09:07 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-10 05:49 . 2013-06-13 06:22 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-13 06:22 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-13 06:23 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-05-03 20:44 . 2012-02-16 01:28 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-05-03 20:44 . 2012-02-16 01:27 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-05-03 20:44 . 2012-02-16 01:27 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-26 05:51 . 2013-06-13 06:23 751104 ----a-w- c:\windows\system32\win32spl.dll
2013-04-26 04:55 . 2013-06-13 06:23 492544 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-25 23:30 . 2013-06-13 06:22 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2013-04-25 19:21 . 2012-01-17 16:03 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-04-17 07:02 . 2013-06-13 06:22 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2013-04-17 06:24 . 2013-06-13 06:22 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{ba696155-d96e-4281-b467-0367a0456474}]
c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EA5CA8B6-9B9C-4994-A7A1-947B6C631BE7}]
c:\program files (x86)\RegTweaker\key.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{ba696155-d96e-4281-b467-0367a0456474}"= "c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{ba696155-d96e-4281-b467-0367a0456474}]
[HKEY_CLASSES_ROOT\wtb.Band.1]
[HKEY_CLASSES_ROOT\TypeLib\{5b191ea7-f309-4d2f-aaa5-c77d84d29ccd}]
[HKEY_CLASSES_ROOT\wtb.Band]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickScanner"="c:\program files (x86)\Defender Pro Quick Scanner\quickscan.exe" [2013-03-21 14483800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-01-31 656920]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2013-07-05 295512]
.
c:\users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
net.lnk - c:\users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe [2013-7-6 709120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe;c:\program files (x86)\Xobni\XobniService.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys;c:\windows\SYSNATIVE\drivers\gfiark.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 SXDS10;soft Xpansion Dispatch Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 10:03 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:23]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13 07:47]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13 07:47]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core.job
- c:\users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:46]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA.job
- c:\users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:46]
.
2013-07-14 c:\windows\Tasks\HPCeeScheduleForLee Hong Guan.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-10-22 984736]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-10-22 799904]
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = about:newtab
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter
IE: {{92808042-fb78-4fa0-bb4f-c9a95e0e9c10} - {ba696155-d96e-4281-b467-0367a0456474} - c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll
TCP: DhcpNameServer = 83.169.184.33 83.169.184.97
FF - ProfilePath - c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - ExtSQL: 2013-07-04 12:36; {24532715-4abc-47ee-bd4f-a6774d0723d2}; c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\extensions\{24532715-4abc-47ee-bd4f-a6774d0723d2}
FF - ExtSQL: 2013-07-25 10:31; EFGLQA@78ETGYN-0W7FN789T87.COM; c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-WT089455 - c:\program files (x86)\HP Games\Zuma Deluxe\Uninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-14 14:49:15
ComboFix-quarantined-files.txt 2013-07-14 12:49
ComboFix2.txt 2013-07-14 12:19
.
Vor Suchlauf: 20 Verzeichnis(se), 165.494.661.120 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 165.432.848.384 Bytes frei
.
- - End Of File - - 69EBFA460063B26AD10E4E30F0503969
A36C5E4F47E84449FF07ED3517B43A31 Hi Schrauber.. hier ist die logfile viele grüße! |
|
14.07.2013, 18:38
| #14 |
| /// the machine /// TB-Ausbilder | wie entferne ich Home Tab\TBUpdater.dll? Hi, bitte den Inhalt von C:\Qoobox\Combofix2.txt posten. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.07.2013, 10:38
| #15 |
| | wie entferne ich Home Tab\TBUpdater.dll? Combofix Logfile: Code:
ATTFilter ComboFix 13-07-13.01 - Lee Hong Guan 14.07.2013 14:01:36.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1643.573 [GMT 2:00]
ausgeführt von:: c:\users\Lee Hong Guan\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\HP
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1025\1025.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1025\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1025\synonyms-1025.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1026\1026.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1026\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1026\synonyms-1026.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1028\1028.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1028\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1028\synonyms-1028.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1029\1029.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1029\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1029\synonyms-1029.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1030\1030.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1030\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1030\synonyms-1030.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1031\1031.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1031\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1031\synonyms-1031.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1032\1032.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1032\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1032\synonyms-1032.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1033\1033.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1033\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1033\synonyms-1033.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1034\1034.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1034\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1034\synonyms-1034.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1035\1035.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1035\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1035\synonyms-1035.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1036\1036.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1036\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1036\synonyms-1036.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1037\1037.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1037\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1037\synonyms-1037.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1038\1038.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1038\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1038\synonyms-1038.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1040\1040.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1040\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1040\synonyms-1040.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1041\1041.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1041\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1041\synonyms-1041.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1042\1042.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1042\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1042\synonyms-1042.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1043\1043.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1043\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1043\synonyms-1043.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1044\1044.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1044\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1044\synonyms-1044.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1045\1045.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1045\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1045\synonyms-1045.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1046\1046.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1046\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1046\synonyms-1046.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1048\1048.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1048\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1048\synonyms-1048.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1049\1049.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1049\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1049\synonyms-1049.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1050\1050.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1050\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1050\synonyms-1050.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1051\1051.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1051\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1051\synonyms-1051.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1053\1053.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1053\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1053\synonyms-1053.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1054\1054.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1054\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1054\synonyms-1054.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1055\1055.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1055\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1055\synonyms-1055.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1057\1057.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1057\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1057\synonyms-1057.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1060\1060.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1060\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1060\synonyms-1060.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1061\1061.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1061\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1061\synonyms-1061.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1062\1062.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1062\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1062\synonyms-1062.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1063\1063.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1063\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\1063\synonyms-1063.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\2052\2052.cab
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\2052\dj2050_Animations.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\2052\synonyms-2052.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\AC_RunActiveContent.js
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\cueFunctions.js
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\hubURL.js
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\bullet.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\checkbox.PNG
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\cmyk-color-bar.svg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\collapsed.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\expanded.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\hyphen.PNG
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\icon_caution_color.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\icon_warning_color.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\projector_icon.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\registration-circle.svg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\RightArrow.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\spacer.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\images\well.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\Accessory\masterStyle.css
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_black_copy.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_color_copy.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_com.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_com_load_media.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_copy.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_copy_text_or_mixed_docs.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_gtk_printer_parts.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_ink_replace_cartridges.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_load_media_envelope.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_load_media_large_paper.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_load_media_small_paper.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_back.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_back_R.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_bottom.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_bottom_R.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_front.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_front_R.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_inside.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_paper_jam_inside_R.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_replace_cartridges.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\dj2050_tunoff.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\flash\globalAnivewerParts_V2.swf
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\booklet_reload.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\booklet_reload.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\c_panel.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\c_panel_2.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\cart_slots.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\cartridge_number.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\clean1.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\cleanout_door.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\cleanout_door_close.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\clear_jam_back.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\clear_jam_bottom.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\clear_jam_front.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\clear_jam_inside.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\close_lid.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\colorlok.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\diagnostics.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\fcvr_ajr.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\fcvr_close.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_1.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_10.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\Flashing_light_2.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\Flashing_light_3.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\Flashing_light_4.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_4a.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_4b.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_4c.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_4d.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\Flashing_light_5.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_6.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_8.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\flashing_light_9.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\globe.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_caution_color.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_document.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_envelope.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_photo_horizontal.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_poster.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_tasktray.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\icon_web.gif
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ink_blk1.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ink_cart_callouts.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ink_cart_date.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ink_cart_date.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\inkcart4.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\inkcart5_no_co.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\input_tray_1.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ironon_media.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_brochure.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_env3.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_papr2.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_papr3.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_papr4 .png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_papr4.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_pcard.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_photo_in_tray.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_photo_in_tray2.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_scan.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_scan_close.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_scan_open.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\ld_transp.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\load_booklet.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\load_label.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\load_poster.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\model_number.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\notouch.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\open_lid.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\opentype_icon.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\output_tray_1.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\phone_list_urls_lar_weuro_ap.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\poster_layout.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\poster_layout.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\printer_parts.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\projector_icon.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\pwr_cord.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_ar_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_bg_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_cs_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_da_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_de_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_el_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_en_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_es_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_et_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_fi_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_fr_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_he_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_hr_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_hu_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_id_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_it_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_jp_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_ko_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_lt_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_lv_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_ms_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_nl_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_no_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_pl_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_pt_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_ro_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_ru_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_sk_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_sl_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_sv_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_th_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_tr_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_uk_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_zh_cn.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_copyright_acknowledgements_no_bluetooth_zh_tw.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_doc.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_energystar_logo_ww.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_fcc_statement_class_b_us.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_notice_to_users_ko_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_power_cord_notice_jp_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_rohs_table_generic_zh_cn.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_vcci_class_b_notice_jp_ww.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\reg_weee_eu.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\release_pcart.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\release_pcart_no_co.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\truetype_icon.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\unpack_cart.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\graphics\online\usb_pc.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\images\global_product_bg_blue.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\images\global_product_bg_blue_gtk.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\images\global_product_bg_blue_hd.jpg
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\images\global_product_bg_blue_wide.png
c:\programdata\HP\HP Deskjet 2050 J510 series\Help\topicmap.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\XmlFileCache\CN1AD1P7DG05QV\Calibration\CalibrationManifest.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\XmlFileCache\CN1AD1P7DG05QV\DevMgmt\ConsumableConfigCap.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\XmlFileCache\CN1AD1P7DG05QV\DevMgmt\DiscoveryTree.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\XmlFileCache\CN1AD1P7DG05QV\DevMgmt\InternalPrintCap.xml
c:\programdata\HP\HP Deskjet 2050 J510 series\XmlFileCache\CN1AD1P7DG05QV\Scan\ScanCaps.xml
c:\users\Lee Hong Guan\AppData\Local\qs.dll
c:\users\Lee Hong Guan\AppData\Local\qs64.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-14 bis 2013-07-14 ))))))))))))))))))))))))))))))
.
.
2013-07-14 12:13 . 2013-07-14 12:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-14 11:18 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91789397-20FA-41F2-AB60-3B665BA63BC2}\mpengine.dll
2013-07-13 10:00 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-13 09:55 . 2013-07-13 09:55 -------- d-----w- C:\FRST
2013-07-10 20:44 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-10 20:44 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-10 19:18 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-07-10 19:18 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-07-08 21:02 . 2013-07-08 21:02 -------- d-----w- c:\windows\Sun
2013-07-08 19:13 . 2013-07-09 11:08 -------- d-----w- c:\program files\CCleaner
2013-07-08 18:50 . 2013-07-08 18:50 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\Malwarebytes
2013-07-08 18:49 . 2013-07-09 20:43 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-07 12:39 . 2013-07-11 14:36 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\SoftGrid Client
2013-07-06 09:04 . 2013-07-06 09:04 -------- d-----w- c:\program files (x86)\Common Files\soft Xpansion
2013-07-06 08:46 . 2013-07-06 08:46 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\Windows Net Data
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\program files (x86)\RealNetworks
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\programdata\RealNetworks
2013-07-05 12:47 . 2013-07-05 12:47 -------- d-----w- c:\program files (x86)\Common Files\xing shared
2013-07-05 12:46 . 2013-07-05 12:46 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2013-07-05 12:46 . 2013-07-05 12:46 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2013-07-04 16:47 . 2013-07-04 16:53 -------- d-----w- c:\program files (x86)\RegistryNuke 2012
2013-07-04 10:42 . 2013-07-04 10:42 0 ----a-w- c:\windows\SysWow64\sho3E87.tmp
2013-07-04 10:18 . 2013-07-09 11:07 -------- d-----w- c:\programdata\Malwarebytes
2013-07-04 09:35 . 2013-07-04 09:40 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-07-04 08:45 . 2013-07-04 08:45 0 ----a-w- c:\windows\SysWow64\shoA15E.tmp
2013-07-04 08:38 . 2013-07-04 08:38 -------- d-----w- C:\SoftwareUpdater
2013-07-04 08:36 . 2013-05-13 03:52 23624 ----a-w- c:\windows\Launcher.exe
2013-06-24 09:04 . 2013-06-24 09:04 -------- d-----w- c:\users\Lee Hong Guan\AppData\Roaming\QuickScan
2013-06-24 09:03 . 2013-06-24 09:11 -------- d-----w- c:\program files (x86)\Defender Pro Quick Scanner
2013-06-21 07:16 . 2013-06-21 07:13 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{41830778-8711-4ED5-983B-7C78038DCF2A}\gapaengine.dll
2013-06-18 19:20 . 2013-06-12 19:47 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 12:55 . 2012-01-17 16:04 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-07-11 12:55 . 2012-01-17 16:04 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-07-10 20:47 . 2012-01-20 14:14 78185248 ----a-w- c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-27 19:42 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2011-08-02 11:38 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-11 20:23 . 2012-04-02 07:42 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 20:23 . 2012-01-17 13:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-06 21:09 . 2013-06-06 21:09 0 ----a-w- c:\windows\SysWow64\sho3E6.tmp
2013-05-27 20:57 . 2013-05-27 20:57 0 ----a-w- c:\windows\SysWow64\sho9942.tmp
2013-05-24 21:34 . 2013-05-24 21:34 0 ----a-w- c:\windows\SysWow64\sho79ED.tmp
2013-05-21 20:58 . 2013-05-21 20:58 0 ----a-w- c:\windows\SysWow64\sho849C.tmp
2013-05-21 18:49 . 2012-02-11 04:15 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-21 13:04 . 2013-05-21 13:04 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-21 13:04 . 2013-05-21 13:04 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-05-21 13:04 . 2013-05-21 13:04 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-05-21 13:04 . 2013-05-21 13:04 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-05-21 13:04 . 2013-05-21 13:04 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-05-21 13:04 . 2013-05-21 13:04 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-05-21 13:04 . 2013-05-21 13:04 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-05-21 13:04 . 2013-05-21 13:04 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-05-21 13:04 . 2013-05-21 13:04 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-05-21 13:04 . 2013-05-21 13:04 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-05-21 13:04 . 2013-05-21 13:04 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-05-21 13:04 . 2013-05-21 13:04 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-21 13:04 . 2013-05-21 13:04 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-05-21 13:04 . 2013-05-21 13:04 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-05-21 13:04 . 2013-05-21 13:04 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-05-21 13:04 . 2013-05-21 13:04 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-05-21 13:04 . 2013-05-21 13:04 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-05-21 13:04 . 2013-05-21 13:04 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-05-21 13:04 . 2013-05-21 13:04 441856 ----a-w- c:\windows\system32\html.iec
2013-05-21 13:04 . 2013-05-21 13:04 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-05-21 13:04 . 2013-05-21 13:04 216064 ----a-w- c:\windows\system32\msls31.dll
2013-05-21 13:04 . 2013-05-21 13:04 197120 ----a-w- c:\windows\system32\msrating.dll
2013-05-21 13:04 . 2013-05-21 13:04 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-05-21 13:04 . 2013-05-21 13:04 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-21 13:04 . 2013-05-21 13:04 81408 ----a-w- c:\windows\system32\icardie.dll
2013-05-21 13:04 . 2013-05-21 13:04 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-05-21 13:04 . 2013-05-21 13:04 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-21 13:04 . 2013-05-21 13:04 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-05-21 13:04 . 2013-05-21 13:04 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-05-21 13:04 . 2013-05-21 13:04 235008 ----a-w- c:\windows\system32\url.dll
2013-05-21 13:04 . 2013-05-21 13:04 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-21 13:04 . 2013-05-21 13:04 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-05-21 13:04 . 2013-05-21 13:04 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-05-21 13:04 . 2013-05-21 13:04 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-05-21 13:04 . 2013-05-21 13:04 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-05-21 13:04 . 2013-05-21 13:04 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-05-21 13:04 . 2013-05-21 13:04 144896 ----a-w- c:\windows\system32\wextract.exe
2013-05-21 13:04 . 2013-05-21 13:04 102912 ----a-w- c:\windows\system32\inseng.dll
2013-05-21 13:04 . 2013-05-21 13:04 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-05-21 13:04 . 2013-05-21 13:04 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-05-21 13:04 . 2013-05-21 13:04 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-05-21 13:04 . 2013-05-21 13:04 149504 ----a-w- c:\windows\system32\occache.dll
2013-05-21 13:04 . 2013-05-21 13:04 13824 ----a-w- c:\windows\system32\mshta.exe
2013-05-21 13:04 . 2013-05-21 13:04 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-05-21 13:04 . 2013-05-21 13:04 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-05-21 13:04 . 2013-05-21 13:04 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-05-21 13:04 . 2013-05-21 13:03 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-21 13:03 . 2013-05-21 13:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-05-21 13:03 . 2013-05-21 13:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-05-18 15:26 . 2013-05-18 15:26 0 ----a-w- c:\windows\SysWow64\shoCA98.tmp
2013-05-16 08:30 . 2013-05-16 08:30 0 ----a-w- c:\windows\SysWow64\sho33C.tmp
2013-05-13 05:51 . 2013-06-13 06:22 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-13 06:22 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-13 06:22 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-13 06:22 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-13 06:22 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-13 06:22 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 04:45 . 2013-06-13 06:22 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 03:43 . 2013-06-13 06:22 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-13 06:22 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-13 06:22 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-10 06:57 . 2012-03-06 09:07 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-10 05:49 . 2013-06-13 06:22 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-13 06:22 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-13 06:23 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-05-03 20:44 . 2012-02-16 01:28 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-05-03 20:44 . 2012-02-16 01:27 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-05-03 20:44 . 2012-02-16 01:27 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-26 05:51 . 2013-06-13 06:23 751104 ----a-w- c:\windows\system32\win32spl.dll
2013-04-26 04:55 . 2013-06-13 06:23 492544 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-04-25 23:30 . 2013-06-13 06:22 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2013-04-25 19:21 . 2012-01-17 16:03 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-04-17 07:02 . 2013-06-13 06:22 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2013-04-17 06:24 . 2013-06-13 06:22 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickScanner"="c:\program files (x86)\Defender Pro Quick Scanner\quickscan.exe" [2013-03-21 14483800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-01-31 656920]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2013-07-05 295512]
.
c:\users\Lee Hong Guan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
net.lnk - c:\users\Lee Hong Guan\AppData\Roaming\Windows Net Data\net.exe [2013-7-6 709120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe;c:\program files (x86)\Xobni\XobniService.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys;c:\windows\SYSNATIVE\drivers\gfiark.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 SXDS10;soft Xpansion Dispatch Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 10:03 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:23]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13 07:47]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13 07:47]
.
2013-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001Core.job
- c:\users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:46]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3341223641-901810946-21637757-1001UA.job
- c:\users\Lee Hong Guan\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-27 18:46]
.
2013-07-14 c:\windows\Tasks\HPCeeScheduleForLee Hong Guan.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-10-22 984736]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-10-22 799904]
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = about:newtab
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter
IE: {{92808042-fb78-4fa0-bb4f-c9a95e0e9c10} - {ba696155-d96e-4281-b467-0367a0456474} - c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll
TCP: DhcpNameServer = 83.169.184.33 83.169.184.97
FF - ProfilePath - c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - ExtSQL: 2013-07-04 12:36; {24532715-4abc-47ee-bd4f-a6774d0723d2}; c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\extensions\{24532715-4abc-47ee-bd4f-a6774d0723d2}
FF - ExtSQL: 2013-07-25 10:31; EFGLQA@78ETGYN-0W7FN789T87.COM; c:\users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\extensions\EFGLQA@78ETGYN-0W7FN789T87.COM
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - (no file)
BHO-{ba696155-d96e-4281-b467-0367a0456474} - c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll
BHO-{EA5CA8B6-9B9C-4994-A7A1-947B6C631BE7} - c:\program files (x86)\RegTweaker\key.dll
Toolbar-{ba696155-d96e-4281-b467-0367a0456474} - c:\users\Lee Hong Guan\AppData\Roaming\HomeTab\HomeTab.dll
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-WT089455 - c:\program files (x86)\HP Games\Zuma Deluxe\Uninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-14 14:19:54
ComboFix-quarantined-files.txt 2013-07-14 12:19
.
Vor Suchlauf: 14 Verzeichnis(se), 165.591.781.376 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 165.506.162.688 Bytes frei
.
- - End Of File - - AAD96EAA160F8AA737C81C2BA5BF431B
A36C5E4F47E84449FF07ED3517B43A31 Hallo Schrauber.. das C:\Qoobox\Combofix2.txt. grüße guan AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.305 - Datei am 15/07/2013 um 12:07:29 erstellt
# Aktualisiert am 11/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Lee Hong Guan - HP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Lee Hong Guan\Desktop\adwcleaner.exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\Lee Hong Guan\AppData\Roaming\Mozilla\Firefox\Profiles\zpbpo59g.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v28.0.1500.72
Datei : C:\Users\Lee Hong Guan\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [1024 octets] - [15/07/2013 11:41:03]
AdwCleaner[R2].txt - [957 octets] - [15/07/2013 12:07:29]
AdwCleaner[S1].txt - [1087 octets] - [15/07/2013 11:42:50]
########## EOF - C:\AdwCleaner[R2].txt - [1076 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.0.9 (07.12.2013:2) OS: Windows 7 Home Premium x64 Ran by Lee Hong Guan on 15.07.2013 at 11:46:42,66 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs ~~~ Files Successfully deleted: [File] C:\Windows\syswow64\sho31DD.tmp Successfully deleted: [File] C:\Windows\syswow64\sho33C.tmp Successfully deleted: [File] C:\Windows\syswow64\sho3E6.tmp Successfully deleted: [File] C:\Windows\syswow64\sho3E87.tmp Successfully deleted: [File] C:\Windows\syswow64\sho4D58.tmp Successfully deleted: [File] C:\Windows\syswow64\sho7515.tmp Successfully deleted: [File] C:\Windows\syswow64\sho75A0.tmp Successfully deleted: [File] C:\Windows\syswow64\sho79ED.tmp Successfully deleted: [File] C:\Windows\syswow64\sho849C.tmp Successfully deleted: [File] C:\Windows\syswow64\sho9942.tmp Successfully deleted: [File] C:\Windows\syswow64\shoA15E.tmp Successfully deleted: [File] C:\Windows\syswow64\shoCA98.tmp Successfully deleted: [File] C:\Windows\syswow64\shoE519.tmp ~~~ Folders ~~~ FireFox Successfully deleted: [File] C:\Users\Lee Hong Guan\AppData\Roaming\mozilla\firefox\profiles\zpbpo59g.default\invalidprefs.js Successfully deleted the following from C:\Users\Lee Hong Guan\AppData\Roaming\mozilla\firefox\profiles\zpbpo59g.default\prefs.js user_pref("iminent.webbooster.scripts.sslminibar.FavLinkSplitTestingClass", "v1"); user_pref("iminent.webbooster.scripts.sslminibar.LayoutId", "1"); user_pref("iminent.webbooster.scripts.sslminibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar"); user_pref("iminent.webbooster.scripts.sslminibar.Services.BHPCode", "01"); user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultEvent", "000"); user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultWebSite", "000"); user_pref("iminent.webbooster.scripts.sslminibar.Services.IminentClientCode", "11"); user_pref("iminent.webbooster.scripts.sslminibar.Services.SmartFavCode", "02"); user_pref("iminent.webbooster.scripts.sslminibar.displayFavLinks", "1"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent101", "1373100679700"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent102", "1373100688719"); Emptied folder: C:\Users\Lee Hong Guan\AppData\Roaming\mozilla\firefox\profiles\zpbpo59g.default\minidumps [951 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 15.07.2013 at 11:59:55,88 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
|
| Themen zu wie entferne ich Home Tab\TBUpdater.dll? |
| antimalware, arten, beim starten, chip.de, computer, entferne, entgültig, files, guten, gültig, home, home tab, immernoch, infiziert, interne, modul, nervige, nutzung, problem, problem beim starten von c, program, rechner, sache, starte, starten, tab, tbupdater.dll, troja, trojaner |
Linear-Darstellung
