| |
| |||||||
Log-Analyse und Auswertung: Problem beim starten: x86/Home Tab/Tb updater.dll, Modul nicht gefunden. Zusätzlich Probleme beim HerunterfahrenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.09.2013, 22:43
| #1 |
| |  Problem beim starten: x86/Home Tab/Tb updater.dll, Modul nicht gefunden. Zusätzlich Probleme beim Herunterfahren Hallo liebe Community, seit ein paar Tagen bekomme ich immer beim Start von Windows folgende Fehlermeldung: x86/Home Tab/Tb updater.dll. Das angegebene Modul wurde nicht gefunden. Zusätzlich zu diesem Problem hängt sich der Computer beim Herunterfahren auf bzw. es steht Herunterfahren da, passieren tut jedoch nichts. Desweiteren hängt sich Windows oft auf. Beispielsweise wenn ich etwas in der Systemsteuerung ändern möchte oder das Internet deaktiviere. Ich denke das hängt alles zusammen, ich bin mir allerdings nicht sicher da dieses Problem meinen Horizont übersteigt. Schuld an dem ganzen bin ich vermutlich selbst, da ich mir ein Programm heruntergeladen habe in dem sicherlich ein Virus versteckt war. Mein Virenscanner hat zwar nichts gefunden, doch die Probleme kamen direkt nach der Installation. Ich habe ein bisschen in eurem Forum geschaut und auch einen Beitrag gefunden der sich mit diesem Problem befasst, doch ich weis das jede Infektion anders ist und eröffne dieses Thema neu. Ich hoffe ihr könnt mit bei der Lösung helfen - ich kann es nicht. Vielen Dank schon mal im voraus. Ich hänge unten die Logs an die ich erstellt habe: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-09-2013
Ran by Administrator at 2013-09-09 17:50:39
Running from C:\Users\Administrator\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
2013 (Version: 2013.0.3392)
3DMark06 (x32 Version: 1.2.1)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AMD Catalyst Install Manager (Version: 8.0.903.0)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Audiograbber 1.83 SE (x32 Version: 1.83 SE)
AVG 2013 (Version: 13.0.3222)
AVG 2013 (Version: 13.0.3392)
Bonjour (Version: 3.0.0.10)
Command & Conquer Die ersten 10 Jahre (x32 Version: 1.00.0000)
D3DX10 (x32 Version: 15.4.2368.0902)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)
Fotogalerie (x32 Version: 16.4.3508.0205)
Futuremark SystemInfo (x32 Version: 4.15.0)
Google Chrome (x32 Version: 29.0.1547.66)
Google Update Helper (x32 Version: 1.3.21.153)
HomeTab 4.4 (x32 Version: 4.4)
iCloud (Version: 2.1.2.8)
IrfanView (remove only) (x32 Version: 4.32)
iTunes (Version: 11.0.5.5)
Java 7 Update 15 (x32 Version: 7.0.150)
Java Auto Updater (x32 Version: 2.1.9.0)
Junk Mail filter update (x32 Version: 16.4.3508.0205)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Corporation (Version: 9.1.0.0)
Microsoft Corporation (x32 Version: 9.1.0.0)
Microsoft LifeCam (Version: 3.22.270.0)
Microsoft Office (x32 Version: 14.0.6120.5004)
Microsoft SkyDrive (HKCU Version: 16.4.6013.0910)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3508.0205)
Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1)
Mozilla Maintenance Service (x32 Version: 20.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
NETGEAR Genie (x32 Version: 2.2.27.1 )
OpenOffice.org 3.2 (x32 Version: 3.2.9483)
Origin (x32 Version: 9.1.12.73)
Photo Common (x32 Version: 16.4.3508.0205)
Photo Gallery (x32 Version: 16.4.3508.0205)
PX5 Advanced Sound Editor (x32 Version: 1.0.0.1)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6873)
RegClean Pro (x32 Version: 6.21)
ROCCAT Kone Mouse Driver (x32)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.6)
TeamViewer 8 (x32 Version: 8.0.18051)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Updater Service (x32 Version: 15,9,28,27)
Uplay (x32 Version: 2.0)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
VLC media player 2.0.5 (Version: 2.0.5)
Winamp (x32 Version: 5.572 )
Windows Live Communications Platform (x32 Version: 16.4.3508.0205)
Windows Live Essentials (x32 Version: 16.4.3508.0205)
Windows Live Family Safety (Version: 16.4.3508.0205)
Windows Live Family Safety (x32 Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3508.0205)
Windows Live Mail (x32 Version: 16.4.3508.0205)
Windows Live MIME IFilter (Version: 16.4.3508.0205)
Windows Live Photo Common (x32 Version: 16.4.3508.0205)
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205)
Windows Live SOXE (x32 Version: 16.4.3508.0205)
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205)
Windows Live UX Platform (x32 Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205)
Windows Live Writer (x32 Version: 16.4.3508.0205)
Windows Live Writer Resources (x32 Version: 16.4.3508.0205)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
==================== Restore Points =========================
17-08-2013 18:20:28 Windows Update
30-08-2013 17:51:15 Geplanter Prüfpunkt
07-09-2013 14:58:46 Free System Utilities
07-09-2013 15:00:35 Free System Utilities 07.09.2013 17:00:35
07-09-2013 16:41:23 RegClean Pro Sa, Sep 07, 13 18:41
08-09-2013 21:49:10 Windows Update
08-09-2013 21:51:27 Free System Utilities 08.09.2013 23:51:27
08-09-2013 22:01:32 Free System Utilities
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {069DB207-16A8-45C2-945C-D7D6E186513F} - System32\Tasks\Freemium1ClickMaint => C:\Users\Administrator\Downloads\1Click.exe
Task: {0F7300E9-B718-4E36-9AEF-2D4CE1DB35E0} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-08-22] (Systweak Inc)
Task: {103B241F-28A2-4605-89A9-5FBE85353B04} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1EBE006F-AC49-4213-80D0-C4E564B3E76F} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-09-07] ()
Task: {1F0970CA-EF39-4204-8FBD-204AB719F0FD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-03] (Google Inc.)
Task: {224C18B9-CC15-4CC2-9D2B-64DAB4993F9D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {2636191C-16D9-4C08-982F-3E4E2DD013BF} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {2D6AFEDE-6C50-448E-B96D-04EE03980F35} - System32\Tasks\EPUpdater => C:\Users\ADMINI~1\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe
Task: {4AB7597E-9E4B-4C0E-AD8E-C71880D20180} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {4DA9BD30-1593-44DA-B97C-4EE35B81D2E0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-03] (Google Inc.)
Task: {6B786EB3-1A4B-45EF-88D0-107A9991F1EE} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)
Task: {8240FE2B-6B5E-47CE-9A17-95CC56C2A74B} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-21] (Microsoft Corporation)
Task: {82C6FFCA-97A6-4AEC-AD73-292056700C21} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-08-22] (Systweak Inc)
Task: {8510CFF8-924B-4BE7-AAB2-65E3239C7CE9} - System32\Tasks\ProtectedSearch\Protected Search => C:\Program Files (x86)\HomeTab\ProtectedSearch.exe
Task: {8CAF18BA-6D0D-40C7-9254-949D1FFB1CFB} - System32\Tasks\Lyrics Say Update => C:\Program Files (x86)\LyricsWOW\wowupd.exe
Task: {E299A46C-EDC4-4139-97CB-F4F6B8B03E35} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {E940684E-448C-4207-8CAA-7FE5F10D2EFF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-23] (Adobe Systems Incorporated)
Task: {EFF7DD02-D0C5-4279-ACF9-224DB6050168} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-08-23] ()
Task: {F44B6D03-B109-40ED-9301-C2099E2F3B48} - System32\Tasks\Browser Updater\Browser Updater => Rundll32.exe "C:\Program Files (x86)\HomeTab\TBUpdater.dll",TBCheckForUpdate
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Lyrics Say Update.job => C:\Program Files (x86)\LyricsWOW\wowupd.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
==================== Loaded Modules (whitelisted) =============
2013-05-29 07:19 - 2013-05-29 07:19 - 00244696 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00661448 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCP110.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00828872 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCR110.dll
2013-04-05 12:58 - 2013-04-05 12:58 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2013-02-07 20:27 - 2012-06-09 20:20 - 00196096 _____ (Alexander Roshal) C:\Program Files (x86)\WinRAR\rarext64.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 00053648 _____ (Open Source Software community project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 01292136 _____ (The ICU Project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuin.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 00923496 _____ (The ICU Project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libicuuc.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 16303976 _____ (The ICU Project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\icudt46.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-11-28 15:13 - 2012-11-28 15:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00220632 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00534480 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCP110.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00862664 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCR110.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00537560 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\Telemetry.dll
2013-05-29 07:19 - 2013-05-29 07:19 - 00038360 _____ (Microsoft Corporation) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\logging.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 09962960 _____ (The ICU Project) C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\icudt.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 00709584 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libglesv2.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libegl.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 04053456 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 00410576 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-06 22:16 - 2013-09-02 22:35 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Bluetooth-Gerät (PAN)
Description: Bluetooth-Gerät (PAN)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: BthPan
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/09/2013 05:37:33 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/08/2013 11:58:07 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/08/2013 11:55:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000532d0
ID des fehlerhaften Prozesses: 0x5b0
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3
Error: (09/08/2013 11:54:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000532d0
ID des fehlerhaften Prozesses: 0x784
Startzeit der fehlerhaften Anwendung: 0xexplorer.exe0
Pfad der fehlerhaften Anwendung: explorer.exe1
Pfad des fehlerhaften Moduls: explorer.exe2
Berichtskennung: explorer.exe3
Error: (09/08/2013 11:31:50 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/08/2013 01:21:45 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/08/2013 11:13:25 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/08/2013 00:02:58 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/07/2013 07:11:20 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
Error: (09/07/2013 06:47:19 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT)
Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden.
System errors:
=============
Error: (09/09/2013 05:38:11 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7
Error: (09/09/2013 05:38:11 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/
Error: (09/09/2013 05:38:11 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7
Error: (09/09/2013 05:38:11 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/
Error: (09/09/2013 00:21:44 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (09/08/2013 11:58:50 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7
Error: (09/08/2013 11:58:50 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/
Error: (09/08/2013 11:58:50 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7
Error: (09/08/2013 11:58:50 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/
Error: (09/08/2013 11:55:36 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
Error: (09/09/2013 05:37:33 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2013 11:58:07 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2013 11:55:18 PM) (Source: Application Error)(User: )
Description: explorer.exe6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec000000500000000000532d05b001ceacde0ccdff93C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dll59191b41-18d1-11e3-a5d4-902b34a84567
Error: (09/08/2013 11:54:46 PM) (Source: Application Error)(User: )
Description: explorer.exe6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec000000500000000000532d078401ceacdd3e3f89fcC:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dll4657461b-18d1-11e3-a5d4-902b34a84567
Error: (09/08/2013 11:31:50 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2013 01:21:45 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2013 11:13:25 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/08/2013 00:02:58 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/07/2013 07:11:20 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/07/2013 06:47:19 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 9%
Total physical RAM: 32765.22 MB
Available physical RAM: 29653.74 MB
Total Pagefile: 65528.63 MB
Available Pagefile: 62193.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:160 GB) (Free:60.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:771.51 GB) (Free:614.56 GB) NTFS
Drive e: (DE10J) (CDROM) (Total:7.01 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 161D202A)
Partition 1: (Active) - (Size=160 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=772 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013
Ran by Administrator (administrator) on ANDI-PC on 09-09-2013 17:50:00
Running from C:\Users\Administrator\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
() C:\ProgramData\IBUpdaterService\ibsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE
(ROCCAT) C:\Program Files (x86)\ROCCAT\Kone Mouse\osd.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
MountPoints2: {5b47ec29-711b-11e2-ad1a-806e6f6e6963} - E:\Autorun.exe
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411440 2013-07-01] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Kone] - C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE [151552 2008-10-06] (ROCCAT)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [LifeCam] - C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKU\Andi\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.)
HKU\Andi\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
HKU\Andi\...\Run: [NETGEARGenie] - C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [1041736 2012-10-16] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
SearchScopes: HKLM - DefaultScope {8220AC52-6487-446E-AD4C-3F381F48A75B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {8220AC52-6487-446E-AD4C-3F381F48A75B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
SearchScopes: HKLM-x32 - DefaultScope {8220AC52-6487-446E-AD4C-3F381F48A75B} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {8220AC52-6487-446E-AD4C-3F381F48A75B} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=0A07A0F3C1452048&affID=119557&tsp=4998
SearchScopes: HKCU - {8220AC52-6487-446E-AD4C-3F381F48A75B} URL =
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1378567237420&tguid=66920-6787-1378567237420-AE7871E215FF2A678F90A4B1C17356C3&q={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HomeTab - {a25e7121-3dd8-41b3-855b-756c5bc45449} - C:\Users\Administrator\AppData\Roaming\HomeTab\HomeTab.dll (Simply Tech Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - HomeTab - {a25e7121-3dd8-41b3-855b-756c5bc45449} - C:\Users\Administrator\AppData\Roaming\HomeTab\HomeTab.dll (Simply Tech Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
CHR HomePage: about:newtab?source=home
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U15) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.150.3) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0
CHR Extension: (Adblock for Youtube\u2122) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk\2.4_0
CHR Extension: (Google Search) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (ProxMate - Improve your Internet!) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgjpnmnpjmabddgmjdiaggacbololbjm\2.4.3_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [bddpogknpjlgfpbboediomaiiaecfajn] - C:\Program Files (x86)\HomeTab\chrome\HomeTab.crx
CHR HKLM-x32\...\Chrome\Extension: [nfmhcdakklnadpfeflffckpmjijiblia] - C:\Program Files (x86)\LyricsWOW\132.crx
==================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103424 2013-02-14] (Creative Technology Ltd)
R2 IBUpdaterService; C:\ProgramData\IBUpdaterService\ibsvc.exe [569120 2013-04-23] ()
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [231752 2012-09-25] (NETGEAR)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-09-07] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-07-06] (VIA Technologies, Inc.)
==================== Drivers (Whitelisted) ====================
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206648 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-07-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1044760 2013-02-14] (Creative Technology Ltd)
R3 cthdb; C:\Windows\System32\DRIVERS\cthdb.sys [28440 2013-02-14] (Creative Technology Ltd)
S3 E100B; C:\Windows\System32\DRIVERS\efe5b32e.sys [192256 2009-06-10] (Intel Corporation)
R3 KoneFltr; C:\Windows\System32\drivers\Kone.sys [15488 2008-12-11] (ROCCAT Ltd)
R2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2013-03-06] (CACE Technologies, Inc.)
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-09 17:49 - 2013-09-09 17:49 - 00000000 ____D C:\FRST
2013-09-09 17:48 - 2013-09-09 17:48 - 00000488 _____ C:\Users\Administrator\Downloads\defogger_disable.log
2013-09-09 17:48 - 2013-09-09 17:48 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-09-09 17:47 - 2013-09-09 17:47 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-09-09 00:11 - 2013-09-09 00:12 - 00000000 ____D C:\SoloApp
2013-09-08 23:49 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-08 23:49 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-08 23:49 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-08 23:49 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-08 23:49 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-08 23:49 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-08 23:49 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-08 23:49 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-08 23:49 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-08 23:49 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-08 23:49 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-08 11:24 - 2013-09-08 11:24 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-07 18:49 - 2013-09-07 18:49 - 00000000 ____D C:\Windows\pss
2013-09-07 18:45 - 2013-09-07 18:46 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\amazon
2013-09-07 18:42 - 2013-09-07 18:44 - 00001688 _____ C:\Windows\system32\ASOROSet.bin
2013-09-07 18:42 - 2013-09-07 18:42 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-09-07 18:40 - 2013-09-07 18:41 - 00000091 _____ C:\Users\Administrator\Desktop\Reg clean pro.txt
2013-09-07 18:37 - 2013-09-08 23:55 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Systweak
2013-09-07 18:37 - 2013-09-08 15:02 - 00000292 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-07 18:37 - 2013-09-07 18:45 - 00000300 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-07 18:37 - 2013-09-07 18:37 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.1772.dll
2013-09-07 18:37 - 2013-09-07 18:37 - 00003056 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-07 18:37 - 2013-09-07 18:37 - 00002900 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-07 18:37 - 2013-09-07 18:37 - 00001056 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-07 18:37 - 2013-09-07 18:37 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-07 18:36 - 2013-09-07 18:37 - 05683272 _____ (Systweak Inc ) C:\Users\Administrator\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-09-07 17:20 - 2013-09-07 17:52 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\SimplyTech
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Windows\System32\Tasks\ProtectedSearch
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\HomeTab
2013-09-07 17:20 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-07 17:13 - 2013-09-07 17:13 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes
2013-09-07 17:13 - 2013-09-07 17:13 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Software Updater
2013-09-07 17:12 - 2013-09-07 17:12 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-07 17:12 - 2013-09-07 17:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-07 17:00 - 2013-09-07 17:00 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Freemium
2013-09-07 16:59 - 2013-09-09 17:39 - 00004208 _____ C:\Windows\System32\Tasks\Software Updater
2013-09-07 16:59 - 2013-09-09 17:39 - 00004200 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-09-07 16:59 - 2013-09-09 00:02 - 00000000 ____D C:\ProgramData\FreeSystemUtilities
2013-09-07 16:59 - 2013-09-08 23:49 - 00003778 _____ C:\Windows\System32\Tasks\Freemium1ClickMaint
2013-09-07 16:59 - 2013-09-07 17:01 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-09-07 16:59 - 2013-09-07 16:59 - 00000000 ____D C:\Program Files (x86)\Covus Freemium
2013-09-07 16:58 - 2013-09-07 18:16 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\DownloadGuide
2013-09-07 16:57 - 2013-09-07 16:57 - 00444408 _____ C:\Users\Administrator\Downloads\free-system-utilities-DE.exe
2013-09-07 16:57 - 2013-09-07 16:57 - 00444408 _____ C:\Users\Administrator\Downloads\free-system-utilities-DE (1).exe
2013-09-07 16:32 - 2013-09-09 17:35 - 00000390 _____ C:\Windows\Tasks\Lyrics Say Update.job
2013-09-07 16:32 - 2013-09-07 17:20 - 00003410 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-07 16:32 - 2013-09-07 16:32 - 00003054 _____ C:\Windows\System32\Tasks\Lyrics Say Update
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\ProgramData\Babylon
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\Program Files (x86)\LyricsWOW
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\Program Files (x86)\Delta
2013-08-27 22:09 - 2013-08-27 22:09 - 00101468 ____H C:\Windows\SysWOW64\mlfcache.dat
2013-08-17 20:23 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-17 20:23 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-17 20:23 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-17 20:23 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-17 20:23 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-17 20:23 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-17 20:23 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-17 20:23 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-17 20:23 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-17 20:23 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-17 20:23 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-17 20:23 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-17 20:23 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-17 20:23 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-17 20:15 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-17 20:15 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-17 20:15 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-17 20:15 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-17 20:15 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-17 20:15 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-17 20:15 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-17 20:15 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-17 20:15 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-17 20:15 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-17 20:15 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-17 20:15 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-17 20:15 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-17 20:15 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-17 20:15 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-17 20:15 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
==================== One Month Modified Files and Folders =======
2013-09-09 17:49 - 2013-09-09 17:49 - 01948948 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-09-09 17:49 - 2013-09-09 17:49 - 00000000 ____D C:\FRST
2013-09-09 17:48 - 2013-09-09 17:48 - 00000488 _____ C:\Users\Administrator\Downloads\defogger_disable.log
2013-09-09 17:48 - 2013-09-09 17:48 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-09-09 17:48 - 2013-05-16 20:44 - 00000000 ____D C:\Users\Administrator
2013-09-09 17:47 - 2013-09-09 17:47 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-09-09 17:43 - 2009-07-14 06:45 - 00025408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-09 17:43 - 2009-07-14 06:45 - 00025408 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-09 17:40 - 2013-02-07 20:11 - 00000000 ____D C:\ProgramData\MFAData
2013-09-09 17:40 - 2013-02-07 13:48 - 01242346 _____ C:\Windows\WindowsUpdate.log
2013-09-09 17:40 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-09 17:40 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-09 17:40 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-09 17:39 - 2013-09-07 16:59 - 00004208 _____ C:\Windows\System32\Tasks\Software Updater
2013-09-09 17:39 - 2013-09-07 16:59 - 00004200 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-09-09 17:38 - 2013-04-16 20:08 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-09 17:35 - 2013-09-07 16:32 - 00000390 _____ C:\Windows\Tasks\Lyrics Say Update.job
2013-09-09 17:35 - 2013-04-03 21:49 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-09 17:35 - 2010-11-21 05:47 - 00056596 _____ C:\Windows\PFRO.log
2013-09-09 17:35 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-09 17:35 - 2009-07-14 06:51 - 00070434 _____ C:\Windows\setupact.log
2013-09-09 00:14 - 2013-04-03 21:49 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-09 00:12 - 2013-09-09 00:11 - 00000000 ____D C:\SoloApp
2013-09-09 00:02 - 2013-09-07 16:59 - 00000000 ____D C:\ProgramData\FreeSystemUtilities
2013-09-08 23:55 - 2013-09-07 18:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Systweak
2013-09-08 23:49 - 2013-09-07 16:59 - 00003778 _____ C:\Windows\System32\Tasks\Freemium1ClickMaint
2013-09-08 15:02 - 2013-09-07 18:37 - 00000292 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-08 11:24 - 2013-09-08 11:24 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-08 11:24 - 2013-05-20 12:59 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-08 11:24 - 2013-05-20 12:59 - 00000000 ____D C:\Program Files\iTunes
2013-09-08 11:24 - 2013-05-20 12:59 - 00000000 ____D C:\Program Files\iPod
2013-09-08 11:24 - 2013-05-20 12:59 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-09-07 18:49 - 2013-09-07 18:49 - 00000000 ____D C:\Windows\pss
2013-09-07 18:49 - 2013-05-16 20:44 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-07 18:46 - 2013-09-07 18:45 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\amazon
2013-09-07 18:45 - 2013-09-07 18:37 - 00000300 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-07 18:44 - 2013-09-07 18:42 - 00001688 _____ C:\Windows\system32\ASOROSet.bin
2013-09-07 18:44 - 2009-07-14 04:34 - 56623104 _____ C:\Windows\system32\config\SOFTWARE.bak
2013-09-07 18:44 - 2009-07-14 04:34 - 16777216 _____ C:\Windows\system32\config\SYSTEM.bak
2013-09-07 18:44 - 2009-07-14 04:34 - 00024576 _____ C:\Windows\system32\config\SECURITY.bak
2013-09-07 18:42 - 2013-09-07 18:42 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-09-07 18:42 - 2009-07-14 04:34 - 00028672 _____ C:\Windows\system32\config\SAM.bak
2013-09-07 18:41 - 2013-09-07 18:40 - 00000091 _____ C:\Users\Administrator\Desktop\Reg clean pro.txt
2013-09-07 18:37 - 2013-09-07 18:37 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.1772.dll
2013-09-07 18:37 - 2013-09-07 18:37 - 00003056 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-07 18:37 - 2013-09-07 18:37 - 00002900 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-07 18:37 - 2013-09-07 18:37 - 00001056 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-07 18:37 - 2013-09-07 18:37 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-07 18:37 - 2013-09-07 18:36 - 05683272 _____ (Systweak Inc ) C:\Users\Administrator\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-09-07 18:16 - 2013-09-07 16:58 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\DownloadGuide
2013-09-07 17:52 - 2013-09-07 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\SimplyTech
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Windows\System32\Tasks\ProtectedSearch
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Windows\System32\Tasks\Browser Updater
2013-09-07 17:20 - 2013-09-07 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\HomeTab
2013-09-07 17:20 - 2013-09-07 16:32 - 00003410 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-07 17:13 - 2013-09-07 17:13 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes
2013-09-07 17:13 - 2013-09-07 17:13 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Software Updater
2013-09-07 17:12 - 2013-09-07 17:12 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-07 17:12 - 2013-09-07 17:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-07 17:01 - 2013-09-07 16:59 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-09-07 17:00 - 2013-09-07 17:00 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Freemium
2013-09-07 17:00 - 2013-06-26 21:05 - 00000000 ____D C:\Windows\Minidump
2013-09-07 16:59 - 2013-09-07 16:59 - 00000000 ____D C:\Program Files (x86)\Covus Freemium
2013-09-07 16:57 - 2013-09-07 16:57 - 00444408 _____ C:\Users\Administrator\Downloads\free-system-utilities-DE.exe
2013-09-07 16:57 - 2013-09-07 16:57 - 00444408 _____ C:\Users\Administrator\Downloads\free-system-utilities-DE (1).exe
2013-09-07 16:32 - 2013-09-07 16:32 - 00003054 _____ C:\Windows\System32\Tasks\Lyrics Say Update
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\ProgramData\Babylon
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\Program Files (x86)\LyricsWOW
2013-09-07 16:32 - 2013-09-07 16:32 - 00000000 ____D C:\Program Files (x86)\Delta
2013-08-30 19:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-27 22:09 - 2013-08-27 22:09 - 00101468 ____H C:\Windows\SysWOW64\mlfcache.dat
2013-08-23 11:38 - 2013-04-16 20:08 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-23 11:38 - 2013-02-07 19:18 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-23 11:38 - 2013-02-07 19:18 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-22 18:36 - 2013-04-23 19:16 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2013-08-17 20:21 - 2013-07-14 17:40 - 00000000 ____D C:\Windows\system32\MRT
2013-08-17 20:20 - 2013-02-07 19:07 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 08:38 - 2013-09-07 17:20 - 00032328 _____ C:\Windows\Launcher.exe
Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.1772.dll
C:\Users\ADMINI~1\AppData\Local\Temp\apptorun.exe
C:\Users\Andi\AppData\Local\Temp\BackupSetup.exe
C:\Users\Andi\AppData\Local\Temp\Сodec Performer803601.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-05 06:33
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-10 17:51:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000061 TOSHIBA_ rev.MS2O 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\kwtdrpod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
.text C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe[1744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe[1744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2208] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
.text C:\Program Files (x86)\AVG\AVG2013\avgui.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\AVG\AVG2013\avgui.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
.text C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[5244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c41465 2 bytes [C4, 75]
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[5244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c414bb 2 bytes [C4, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\13fa5dc91190
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\13fa5dc91190 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:48 on 09/09/2013 (Administrator)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
| Themen zu Problem beim starten: x86/Home Tab/Tb updater.dll, Modul nicht gefunden. Zusätzlich Probleme beim Herunterfahren |
| 4d36e972-e325-11ce-bfc1-08002be10318, adblock, administrator, computer, epupdater, error, farbar, farbar recovery scan tool, fehlermeldung, firefox, flash player, freemium, helper, herunterfahren, homepage, hometab, hometab\tbupdater.dll, hängt, internet, monitor, newtab, ntdll.dll, plug-in, problem, programm, registry, rundll, scan, server, software, software updater ui, start von windows, starten, svchost.exe, systweak, tbupdater.dll, updates, virus, windows, winlogon.exe, x86 basierend, ändern |
Baum-Darstellung