|
Log-Analyse und Auswertung: unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media viewWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.03.2014, 02:48 | #1 |
| unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view Hallo Ich habe in letzter Zeit Add-Ons in Firefox und IE vorgefunden die ich nicht wissentlich installiert habe und die sich nicht entfernen lassen. Ausserdem wird unerwünschte Werbung eingeblendet. Danke für eure Hilfe. Gruss Ruedi Die Log-Files: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 00:04 on 04/03/2014 (BTA_AW-) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-03-2014 03 Ran by BTA_AW- (administrator) on ASUSLAPTOP**** on 04-03-2014 00:20:26 Running from G:\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe (AMD) C:\Windows\system32\atieclxx.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\sched.exe (ABBYY) D:\Abby\ABBYY FineReader 11\NetworkLicenseServer.exe (ABBYY) D:\Abby\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe () C:\Program Files (x86)\LPT\srpts.exe () D:\Sony Ericsson PC Suite\SupServ.exe () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe () C:\Program Files (x86)\LPT\srptm.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (Dropbox, Inc.) C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Swisscom) C:\Program Files (x86)\Swisscom\Quick Help\SwisscomQuickHelp.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avwebg7.exe (Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (PixArt Imaging Incorporation) C:\Program Files (x86)\Common Files\PAC7302\Monitor.exe (Mozilla Corporation) D:\Mozilla\Firefox\firefox.exe () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Lrcnta.exe (Mozilla Corporation) D:\Mozilla\Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] () HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.) HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.) HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.) HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation) HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2010-06-25] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS) HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-07-02] () HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [128608 2007-06-17] (CANON INC.) HKLM-x32\...\Run: [Ulead AutoDetector v2] - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe [95504 2007-08-02] (Ulead Systems, Inc.) HKLM-x32\...\Run: [KeePass 2 PreLoad] - D:\KeePass_Password_Safe_2\KeePass.exe [1960448 2013-04-05] (Dominik Reichl) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [468112 2011-07-25] (CANON INC.) HKLM-x32\...\Run: [Swisscom Quick Help] - C:\Program Files (x86)\Swisscom\Quick Help\SwisscomQuickHelp.exe [16668080 2013-10-02] (Swisscom) HKLM-x32\...\Run: [Bonus.SSR.FR11] - D:\Abby\ABBYY FineReader 11\Bonus.ScreenshotReader.exe [933640 2012-01-19] (ABBYY.) HKLM-x32\...\Run: [avgnt] - D:\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-30] (Google Inc.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\Run: [Browser Infrastructure Helper] - C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\SnapDo.exe [21536 2014-02-06] (Smartbar) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\MountPoints2: {b5768a9b-0660-11e2-8ddb-bcaec5d1b9aa} - F:\Start.exe HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\MountPoints2: {cac55c9c-8b29-11e2-8d0d-bcaec5d1b9aa} - H:\DTVP_Launcher.exe Startup: C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk ShortcutTarget: Logitech . Produktregistrierung.lnk -> C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1M2gw6TFjbSZ2qx737TDNGJVp_NM0CgvLMyU-TB3eR2SFzDCPqs1NN28LCo_W9Y, HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} BHO: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) DPF: HKLM-x32 {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} C:\Users\BTA_AW-\AppData\Local\Temp\f5tmp\f5tunsrv.cab DPF: HKLM-x32 {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\BTA-AD~1\AppData\Local\Temp\IXP000.TMP\InstallerControl.cab#-1,-1,-1,-1 DPF: HKLM-x32 {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\BTA-AD~1\AppData\Local\Temp\f5tmp\urxhost.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll No File Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default FF SearchEngineOrder.1: Ask Search FF Homepage: hxxp://www.evwe.ch FF NetworkProxy: "gopher", "" FF NetworkProxy: "gopher_port", "" FF NetworkProxy: "no_proxies_on", "" FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll No File FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nielsen/FirefoxTracker - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter3\FirefoxAddOns\npfirefoxtracker.dll No File FF Plugin-x32: @photodex.com/PhotodexPresenter - C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll ( ) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\11-suche.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\ask-search.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\webde-suche.xml FF Extension: Swisscom Quick Help - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{6A6114A5-EEF5-45F4-BCD1-B00A7B33E04B} [2012-03-02] FF Extension: F5 Networks Host Plugin - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52} [2013-03-07] FF Extension: PlugIn-Checker - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\jid0-c1av474BVPIHcGJfBp3GkhlhAa4@jetpack.xpi [2013-01-21] FF Extension: FireFTP - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2012-01-10] FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter3\FirefoxAddOns\netsight@nielsen.xpi FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff FF Extension: BetterSurf - C:\Program Files (x86)\BetterSurf\ff [2013-11-14] FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff FF Extension: Better-Surf - C:\Program Files (x86)\Better-Surf\ff [2013-11-25] FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha335.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha335\ff FF Extension: Webexp Enhanced - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha335\ff [2013-12-20] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1471.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1471\ff FF Extension: Media Viewer - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1471\ff [2014-02-23] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewV1alpha1870.net] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1870\ff FF Extension: Media View - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1870\ff [2014-02-27] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-27] FF StartMenuInternet: FIREFOX.EXE - D:\Mozilla\Firefox\firefox.exe Chrome: ======= CHR HomePage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1M2gw6TFjbSZ2qx737TDNGJVp_NM0CgvLMyU-TB3eR2SFzDCPqs1NN28LCo_W9Y, CHR RestoreOnStartup: "sync": { "suppress_start" CHR DefaultSearchKeyword: search.snapdo.com CHR DefaultSearchProvider: Web CHR DefaultSearchURL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fRrvugmxlJOT40l3ePPj8-059HVvGjtksvRS5aNdwvQREAWYh-OuKApEPBlNodTHBhOIDVNvy65fM90ZvAVUboteuRsleKmcP0LnXZlOdOXFwBnR4ELZVQYRAy3RKXts1MGPGrJHYQZgwyhkLAMl-dOfw4PBzZ7AOeDl09vHXHX4HH-d6iXwGblxbOWlLLQ,&q={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - D:\Mozilla\Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility for IJ) - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.1.7\\npsitesafety.dll No File CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File CHR Plugin: (Photodex Presenter Plugin) - C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll ( ) CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File CHR Plugin: (iTunes Application Detector) - D:\iTunes\Mozilla Plugins\npitunes.dll () CHR Extension: (Angry Birds) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2013-11-20] CHR Extension: (Google Docs) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-04] CHR Extension: (Google Drive) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-04] CHR Extension: (Media View) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbaaiomfhenjhdipickmlehebkdcjick [2014-02-27] CHR Extension: (YouTube) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-04] CHR Extension: (Webexp Enhanced) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\bppabjgmhimmgdcnomenfdljlfekjpbo [2013-12-20] CHR Extension: (Google-Suche) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-04] CHR Extension: (Logitech Smooth Scrolling) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-02-27] CHR Extension: (FTP Free) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehdgcfaoankkonoiichmblcfijkomfbn [2013-06-04] CHR Extension: (Media Viewer) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\makliajhfiphjkjildjcahgnoimipiag [2014-02-23] CHR Extension: (Google Wallet) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30] CHR Extension: (Google Mail) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-04] CHR HKLM-x32\...\Chrome\Extension: [bbaaiomfhenjhdipickmlehebkdcjick] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1870\ch\MediaViewV1alpha1870.crx [2014-02-26] CHR HKLM-x32\...\Chrome\Extension: [bppabjgmhimmgdcnomenfdljlfekjpbo] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha335\ch\WebexpEnhancedV1alpha335.crx [2013-12-19] CHR HKLM-x32\...\Chrome\Extension: [dedmngkbaffkenlfdcbganndoghblmap] - C:\Program Files (x86)\BetterSurf\ch\Chrome.crx [2013-11-11] CHR HKLM-x32\...\Chrome\Extension: [makliajhfiphjkjildjcahgnoimipiag] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1471\ch\MediaViewerV1alpha1471.crx [2014-02-23] CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2013-11-25] ==================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Professional.11.0; D:\Abby\ABBYY FineReader 11\NetworkLicenseServer.exe [818952 2011-12-22] (ABBYY) R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; D:\Abby\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2010-02-01] (ABBYY) R2 AntiVirMailService; D:\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-12] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; D:\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG) R2 AntiVirService; D:\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; D:\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-12] (Avira Operations GmbH & Co. KG) R2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [32288 2014-02-06] () R2 OMSI download service; D:\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] () R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] () R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () R2 vmware-converter-agent; D:\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [423576 2012-10-15] (VMware, Inc.) R2 vmware-converter-server; D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [423576 2012-10-15] (VMware, Inc.) R2 vmware-converter-worker; D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [423576 2012-10-15] (VMware, Inc.) S2 vToolbarUpdater17.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-11-11] (AVG Technologies) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-12] (Avira Operations GmbH & Co. KG) S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [74352 2011-03-15] (VMware, Inc.) R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) R3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527872 2007-11-08] (PixArt Imaging Inc.) S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-01-14] (RapidSolution Software AG) R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-01-14] (RapidSolution Software AG) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation) R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] () R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] () U3 tmlwf; U3 tmwfp; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-04 00:20 - 2014-03-04 00:20 - 00000000 ____D () C:\FRST 2014-03-04 00:16 - 2014-03-04 00:16 - 00000000 ____D () C:\Users\BTA_AW-\Desktop\Logs_TrBo 2014-03-04 00:04 - 2014-03-04 00:04 - 00000000 _____ () C:\Users\BTA_AW-\defogger_reenable 2014-03-03 20:54 - 2014-03-03 21:05 - 00921632 _____ () C:\PA7302.DAT 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Windows\PixArt 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files (x86)\PixArt 2014-03-03 20:49 - 2008-04-11 19:10 - 00000566 _____ () C:\Windows\SysWOW64\SP7302.ini 2014-03-03 20:49 - 2007-11-20 17:58 - 00055296 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\Remove.exe 2014-03-03 20:49 - 2007-11-08 10:29 - 00527872 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS 2014-03-03 20:49 - 2007-11-02 11:07 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_071029.dll 2014-03-03 20:49 - 2007-10-30 17:48 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax 2014-03-03 20:49 - 2007-03-21 11:25 - 00000291 _____ () C:\Windows\SysWOW64\Remover.ini 2014-03-03 20:49 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll 2014-03-03 20:46 - 2014-03-03 20:46 - 00000000 ____D () C:\Users\Public\Documents\USB_CAM 2014-03-03 07:18 - 2014-03-03 07:18 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Skype 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\Public\Documents\Logishrd 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logitech 2014-02-27 23:25 - 2014-02-27 23:25 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Leadertech 2014-02-27 23:24 - 2014-02-27 23:26 - 00000860 _____ () C:\Windows\LkmdfCoInst.log 2014-02-27 23:24 - 2014-02-27 23:25 - 00007290 _____ () C:\Windows\LDPINST.LOG 2014-02-27 23:24 - 2014-02-27 23:24 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-02-27 23:23 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logishrd 2014-02-27 23:23 - 2014-02-27 23:25 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-02-27 23:23 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Logitech 2014-02-27 23:20 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logitech 2014-02-27 23:20 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logishrd 2014-02-27 23:09 - 2014-02-27 23:09 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-27 23:09 - 2014-02-27 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1 2014-02-25 07:19 - 2014-03-03 16:21 - 00000000 ____D () C:\Program Files (x86)\LPT 2014-02-25 07:18 - 2014-02-25 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Smartbar 2014-02-25 07:18 - 2014-02-25 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\LPT 2014-02-25 07:16 - 2014-02-25 07:16 - 00001564 _____ () C:\Users\Public\Desktop\Google SketchUp 8.lnk 2014-02-25 07:14 - 2014-02-25 07:14 - 47054016 _____ (Google Inc.) C:\Users\BTA_AW-\Desktop\GoogleSketchUpWDE_8.0.4811.exe 2014-02-23 23:09 - 2014-02-23 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-15 18:49 - 2014-02-15 18:49 - 00002093 _____ () C:\Users\BTA_AW-\.recently-used.xbel 2014-02-13 23:28 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-13 23:28 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-13 23:27 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-13 23:27 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-13 23:27 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-13 23:27 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-13 23:27 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-13 23:27 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-13 23:27 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-13 23:27 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-13 23:27 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-13 23:27 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-13 23:27 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-13 23:27 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-13 23:27 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-13 23:27 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-13 23:27 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-13 23:27 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-13 23:27 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-13 23:27 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-13 23:27 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-13 23:27 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-13 23:27 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-13 23:27 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-13 23:27 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-13 23:27 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-13 23:27 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-13 23:27 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-13 23:27 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-13 23:27 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-13 23:27 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-13 23:27 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-13 23:27 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-13 23:27 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-13 23:27 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-13 23:27 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-13 23:27 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-13 23:27 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-13 23:27 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-13 23:27 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-13 23:27 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-13 22:49 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-13 22:49 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-13 22:49 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-13 22:49 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-13 22:49 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-13 22:49 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-13 22:49 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-13 22:49 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-13 22:49 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-13 22:49 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-13 22:49 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-13 22:49 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-13 22:49 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-13 22:49 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-13 22:49 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-05 14:37 - 2014-02-26 22:58 - 00121914 _____ () C:\Windows\PFRO.log ==================== One Month Modified Files and Folders ======= 2014-03-04 00:20 - 2014-03-04 00:20 - 00000000 ____D () C:\FRST 2014-03-04 00:19 - 2011-12-29 22:51 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Skype 2014-03-04 00:16 - 2014-03-04 00:16 - 00000000 ____D () C:\Users\BTA_AW-\Desktop\Logs_TrBo 2014-03-04 00:15 - 2012-08-17 19:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-04 00:04 - 2014-03-04 00:04 - 00000000 _____ () C:\Users\BTA_AW-\defogger_reenable 2014-03-04 00:04 - 2011-03-23 14:16 - 00000000 ____D () C:\Users\BTA_AW- 2014-03-03 23:41 - 2012-09-20 01:06 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-03 23:09 - 2013-03-26 22:25 - 00000364 _____ () C:\Windows\Tasks\AmiUpdXp.job 2014-03-03 23:07 - 2011-01-30 22:59 - 01643144 _____ () C:\Windows\WindowsUpdate.log 2014-03-03 21:10 - 2009-07-14 03:34 - 00000761 _____ () C:\Windows\win.ini 2014-03-03 21:05 - 2014-03-03 20:54 - 00921632 _____ () C:\PA7302.DAT 2014-03-03 20:51 - 2014-01-31 09:32 - 00002030 _____ () C:\Windows\setupact.log 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Windows\PixArt 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files (x86)\PixArt 2014-03-03 20:49 - 2011-01-30 23:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-03-03 20:46 - 2014-03-03 20:46 - 00000000 ____D () C:\Users\Public\Documents\USB_CAM 2014-03-03 18:41 - 2012-09-20 01:06 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-03 16:21 - 2014-02-25 07:19 - 00000000 ____D () C:\Program Files (x86)\LPT 2014-03-03 16:21 - 2011-11-30 00:50 - 00000000 ____D () C:\Users\BTA_AW-\Documents\Outlook-Dateien 2014-03-03 07:23 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-03 07:23 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-03 07:18 - 2014-03-03 07:18 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Skype 2014-03-03 07:18 - 2011-12-29 22:51 - 00000000 ____D () C:\ProgramData\Skype 2014-03-03 07:16 - 2013-01-11 12:10 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Dropbox 2014-03-03 07:15 - 2013-08-15 16:15 - 00000000 ___RD () C:\Users\BTA_AW-\Dropbox 2014-03-03 07:14 - 2013-06-16 13:18 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2014-03-03 07:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-28 17:21 - 2011-01-30 23:48 - 00003276 _____ () C:\Windows\system32\AutoRunFilter.ini 2014-02-28 17:21 - 2011-01-30 23:48 - 00002498 _____ () C:\Windows\system32\ServiceFilter.ini 2014-02-27 23:30 - 2011-03-23 14:17 - 00000000 ___RD () C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\Public\Documents\Logishrd 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logitech 2014-02-27 23:27 - 2014-02-27 23:23 - 00000000 ____D () C:\ProgramData\Logishrd 2014-02-27 23:27 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logitech 2014-02-27 23:26 - 2014-02-27 23:24 - 00000860 _____ () C:\Windows\LkmdfCoInst.log 2014-02-27 23:25 - 2014-02-27 23:25 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Leadertech 2014-02-27 23:25 - 2014-02-27 23:24 - 00007290 _____ () C:\Windows\LDPINST.LOG 2014-02-27 23:25 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-02-27 23:24 - 2014-02-27 23:24 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-02-27 23:23 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Logitech 2014-02-27 23:20 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logishrd 2014-02-27 23:09 - 2014-02-27 23:09 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-27 23:09 - 2014-02-27 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1 2014-02-27 23:09 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-02-27 23:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-02-27 18:58 - 2011-03-25 08:08 - 01617240 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-27 18:58 - 2009-08-04 10:51 - 00708030 _____ () C:\Windows\system32\perfh007.dat 2014-02-27 18:58 - 2009-08-04 10:51 - 00153336 _____ () C:\Windows\system32\perfc007.dat 2014-02-27 18:58 - 2009-07-14 06:13 - 01617240 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-26 22:58 - 2014-02-05 14:37 - 00121914 _____ () C:\Windows\PFRO.log 2014-02-26 15:12 - 2011-10-01 08:15 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\XnView 2014-02-25 07:24 - 2013-06-03 16:28 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Google 2014-02-25 07:20 - 2011-01-30 23:18 - 00000000 ____D () C:\ProgramData\Google 2014-02-25 07:18 - 2014-02-25 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Smartbar 2014-02-25 07:18 - 2014-02-25 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\LPT 2014-02-25 07:16 - 2014-02-25 07:16 - 00001564 _____ () C:\Users\Public\Desktop\Google SketchUp 8.lnk 2014-02-25 07:14 - 2014-02-25 07:14 - 47054016 _____ (Google Inc.) C:\Users\BTA_AW-\Desktop\GoogleSketchUpWDE_8.0.4811.exe 2014-02-23 23:09 - 2014-02-23 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-21 13:27 - 2013-06-04 06:00 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-02-21 00:15 - 2012-08-17 19:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-02-21 00:15 - 2012-04-02 06:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-02-21 00:15 - 2011-06-08 16:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-02-17 12:50 - 2013-08-14 12:43 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 12:42 - 2011-03-25 11:10 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-15 19:09 - 2011-10-04 21:28 - 00000000 ____D () C:\Users\BTA_AW-\.gimp-2.6 2014-02-15 18:49 - 2014-02-15 18:49 - 00002093 _____ () C:\Users\BTA_AW-\.recently-used.xbel 2014-02-15 18:49 - 2011-10-04 21:31 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\gtk-2.0 2014-02-14 07:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-13 23:40 - 2011-03-24 16:05 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-12 18:36 - 2012-05-11 13:01 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-02-12 18:36 - 2012-05-11 13:01 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-02-06 13:16 - 2014-02-13 23:27 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-13 23:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-13 23:27 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-13 23:27 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-13 23:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-13 23:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-13 23:27 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-13 23:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-13 23:27 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-13 23:27 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-13 23:27 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-13 23:27 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-13 23:27 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-13 23:27 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-13 23:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-13 23:27 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-13 23:27 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-13 23:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-13 23:27 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-13 23:27 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:57 - 2014-02-13 23:27 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:52 - 2014-02-13 23:27 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-13 23:27 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-13 23:27 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-13 23:27 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-13 23:27 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-13 23:27 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-13 23:27 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:25 - 2014-02-13 23:27 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:24 - 2014-02-13 23:27 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-13 23:27 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-13 23:27 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-13 23:27 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-13 23:27 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-13 23:27 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-13 23:27 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-13 23:27 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-13 23:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-13 23:27 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Files to move or delete: ==================== C:\ProgramData\hpe8111.dll C:\ProgramData\PKP_DLes.DAT C:\ProgramData\PKP_DLet.DAT C:\ProgramData\PKP_DLev.DAT Some content of TEMP: ==================== C:\Users\BTA-User\AppData\Local\Temp\avgnt.exe C:\Users\BTA_AW-\AppData\Local\Temp\avgnt.exe C:\Users\BTA_AW-\AppData\Local\Temp\Installer.exe C:\Users\BTA_AW-\AppData\Local\Temp\LMkRstPt.exe C:\Users\BTA_AW-\AppData\Local\Temp\setapp.exe C:\Users\BTA_AW-\AppData\Local\Temp\Setup-a.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-28 15:40 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-03-2014 03 Ran by BTA_AW- at 2014-03-04 00:21:09 Running from G:\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 13.2.1 - Hewlett-Packard) Hidden 7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - ) ABBYY FineReader 11 (HKLM-x32\...\{F1100000-0011-0000-0001-074957833700}) (Version: 11.0.460 - ABBYY) ABBYY PDF Transformer 3.0 (HKLM-x32\...\ABBYY PDF Transformer 3.0) (Version: 3.00.317.68010 - ABBYY) ABBYY PDF Transformer 3.0 (Version: 3.00.317.68010 - ABBYY) Hidden Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated) Adobe Reader XI (11.0.02) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.02 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.8.638 - Adobe Systems, Inc.) ALTools Update (HKLM-x32\...\ALUpdate_is1) (Version: v11.4.28.1 - ESTsoft Corp.) ALZip 8.51 (HKLM-x32\...\ALZip_is1) (Version: v8.51 - ESTsoft Corp.) Any Video Converter 5.5.3 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com) AP Tuner 3.08 (HKLM-x32\...\AP Tuner 3.08) (Version: - ) Apple Application Support (HKLM-x32\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Arbeitsvoranschlag (HKLM-x32\...\{E2BAB827-16DD-4CE9-B95F-56C620C5EF81}) (Version: 1.1.14 - Agroscope ART Tänikon) Arbeitsvoranschlag (HKLM-x32\...\{F6802A31-47DA-4E7D-8D41-7851DCDFFEBA}) (Version: 1.1.16 - Agroscope ART Tänikon) Arclab Web Form Builder 2.0 (HKLM-x32\...\Arclab Web Form Builder_is1) (Version: - Arclab Software GbR) ASUS AI Recovery (HKLM-x32\...\{38253529-D97D-4901-AE53-5CC9736D3A2E}) (Version: 1.0.13 - ASUS) ASUS Data Security Manager (HKLM-x32\...\{FA2092C5-7979-412D-A962-6485274AE1EE}) (Version: 1.00.0014 - ASUS) ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.20 - ASUS) ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS) ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.1.40 - ASUS) ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0011 - ASUS) ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0028 - ASUS) ASUS Video Magic (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.4015 - CyberLink Corp.) ASUS Video Magic (x32 Version: 6.0.4015 - CyberLink Corp.) Hidden ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.20 - asus) ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 2.0.46.1429 - eCareme Technologies, Inc.) AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.3.585 - ASUSTEK) ATI AVIVO64 Codecs (Version: 11.6.0.50811 - ATI Technologies Inc.) Hidden ATI Catalyst Install Manager (HKLM\...\{FDB61EAE-7C1D-7EB6-E1EE-14528E3EB266}) (Version: 3.0.790.0 - ATI Technologies, Inc.) ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0006 - ASUS) Audials (HKLM-x32\...\{869690DA-0083-468D-B057-6D75C1538792}) (Version: 10.1.4600.0 - Audials AG) Avanquest update (HKLM-x32\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.30 - Avanquest Software) AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 17.3.0.49 - AVG Technologies) Avira Internet Security Suite (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.2.286 - Avira) BIG-IP Edge Client Components (All Users) (HKLM-x32\...\F5 Networks Client Components) (Version: 70.2011.0622.1118 - F5 Networks, Inc.) BIG-IP Edge Client Components (HKCU\...\F5 Networks Client Components) (Version: 70.2011.0622.1118 - F5 Networks, Inc.) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - ) Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version: - ) Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - ) Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - ) Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version: - ) Canon MP Navigator EX 5.1 (HKLM-x32\...\MP Navigator EX 5.1) (Version: - ) Canon MX890 series Benutzerregistrierung (HKLM-x32\...\Canon MX890 series Benutzerregistrierung) (Version: - ) Canon MX890 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX890_series) (Version: - ) Canon MX890 series On-screen Manual (HKLM-x32\...\Canon MX890 series On-screen Manual) (Version: - ) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - ) Catalyst Control Center InstallProxy (x32 Version: 2010.0811.2122.36462 - ATI Technologies, Inc.) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.00 - Piriform) Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.127.0.61 - Conexant) Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation) ControlDeck (HKLM-x32\...\{5B65EF64-1DFA-414A-8C94-7BB726158E21}) (Version: 1.0.8 - ASUS) Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation) Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation) Crescendo Music Notation Editor (HKLM-x32\...\Crescendo) (Version: - NCH Software) CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1908 - CyberLink Corp.) CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden CyberLink MediaShow Espresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 5.0.1606_25588 - CyberLink Corp.) CyberLink MediaShow Espresso (x32 Version: 5.0.1606_25588 - CyberLink Corp.) Hidden CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.) CyberLink PhotoNow (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.) CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2609a - CyberLink Corp.) CyberLink PowerDirector (x32 Version: 8.0.2609a - CyberLink Corp.) Hidden CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3009.50 - CyberLink Corp.) CyberLink PowerDVD 9 (x32 Version: 9.0.3009.50 - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{81FB7C60-565A-4869-9D90-3BE1D270E8B7}) (Version: - Microsoft) DesignPro 5 (HKLM-x32\...\InstallShield_{F82C6574-AD88-4B40-A432-970BC77F1BD2}) (Version: 5.5.708 - Avery Dennison) DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation) Documents To Go Desktop für iOS (HKLM-x32\...\DTGDesktop) (Version: 4.0001.010 - DataViz, Inc.) Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.) eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden ETDWare PS/2-x64 7.0.5.11_WHQL (HKLM\...\Elantech) (Version: 7.0.5.11 - ELAN Microelectronics Corp.) Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.8 - ASUS) FileZilla Client 3.6.0.1 (HKCU\...\FileZilla Client) (Version: 3.6.0.1 - FileZilla Project) Fisc2012 (HKLM-x32\...\Fisc2012) (Version: 1.0.0.0 - Abraxas Informatik AG) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.117 - Google Inc.) Google Drive (HKLM-x32\...\{E87022D3-C8C9-4C76-8E27-BC7F18F9B8FB}) (Version: 1.14.6059.644 - Google, Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google SketchUp 8 (HKLM-x32\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden GPS Pathfinder Office (HKLM-x32\...\InstallShield_{7811D114-1726-4891-A921-ACCD076877E5}) (Version: 5.40.0000 - Trimble) GPS Pathfinder Office (x32 Version: 5.40.0000 - Trimble) Hidden Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.115.11 - Intel) Internet Explorer Toolbar 4.6 by SweetPacks (HKLM-x32\...\{774C0434-9948-4DEE-A14E-69CDD316E36C}) (Version: 4.6.0003 - SweetIM Technologies Ltd.) <==== ATTENTION iTunes (HKLM\...\{0D924CB2-2EA4-4044-BAF7-770202D6BD0D}) (Version: 11.1.4.62 - Apple Inc.) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden JMicron Ethernet Adapter NDIS Driver (HKLM-x32\...\{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}) (Version: 6.0.17.1 - JMicron Technology Corp.) JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.33.2 - JMicron Technology Corp.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KeePass Password Safe 2.22 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: - Dominik Reichl) Landwirtschafts Simulator 2011 (HKLM-x32\...\FarmingSimulator2011DE_is1) (Version: 1.0 - GIANTS Software) Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech) LPT System Updater Service (HKLM-x32\...\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}) (Version: 1.0.0.0 - LPT) <==== ATTENTION Media View (HKLM-x32\...\MediaViewV1alpha1870) (Version: 1.1 - Media View) Media Viewer (HKLM-x32\...\MediaViewerV1alpha1471) (Version: 1.1 - Media Viewer) MEDION NAS TOOL (HKLM-x32\...\MEDION NAS TOOL) (Version: - MEDION) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Messenger 分享元件 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation) Microsoft IntelliType Pro 8.2 (Version: 8.20.469.0 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Miro Video Converter (HKLM-x32\...\Miro Video Converter) (Version: 0.8.0 - Participatory Culture Foundation) Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 17.0.4 - Mozilla) Mozilla Thunderbird 17.0.4 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 17.0.4 (x86 de)) (Version: 17.0.4 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation) Octava SD4 (HKLM-x32\...\{E680BB35-F552-4B28-BE4F-8E7CE515636F}) (Version: 5.01 - Obtiv) Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC) PaintStar 2.70 (HKLM-x32\...\PaintStar_is1) (Version: - Zhenzhou Wang) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge) Photodex Presenter (HKLM-x32\...\Photodex Presenter) (Version: - Photodex Corporation) PhotoImpact X3 (x32 Version: 13.0 - Corel) Hidden Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.3 - Nikon) PriMus Free 1.1 (Build 10437) (HKLM-x32\...\PriMus Free_is1) (Version: - Columbus Soft) QCAD 3.4.5 (HKLM-x32\...\QCAD) (Version: 3.4.5 - RibbonSoft GmbH) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Radio.fx (HKLM-x32\...\Tobit Radio.fx Server) (Version: - Tobit.Software) Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.) SaveByClick (HKLM\...\{0A57278A-E1B2-411A-A3F1-A990D1B4057C}) (Version: 1.0 - SaveByClick) <==== ATTENTION Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.) Snap.Do (HKLM-x32\...\{FB385922-2E32-4462-A7DC-27159614A660}) (Version: 10.213.1.15234 - ReSoft Ltd.) <==== ATTENTION Software Version Updater (HKLM-x32\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.3.6 - ) <==== ATTENTION Sony Ericsson PC Suite 6.012.00 (HKLM-x32\...\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}) (Version: 6.012.00 - Sony Ericsson) Sony PC Companion 2.10.030 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.030 - Sony) Swisscom Quick Help (HKLM-x32\...\Swisscom Quick Help) (Version: 3.3.2.340 - Swisscom (Switzerland) AG) Swisscom Quick Help (x32 Version: 3.3.2.340 - Swisscom (Switzerland) AG) Hidden swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Telescope Driver (HKLM-x32\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt) Ulead PhotoImpact X3 (HKLM-x32\...\InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}) (Version: 13.0 - Corel) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft) Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{E21274CE-CA0C-49FA-93F4-DC292A052264}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{B5C70C99-B109-42FD-B219-FF12CA543F19}) (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft) Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version: - Microsoft) USB2.0 UVC VGA WebCam (HKLM\...\USB2.0 UVC VGA WebCam) (Version: 5.8.54000.207 - Sonix) VMware vCenter Converter Standalone (HKLM-x32\...\{EDF0C1D5-D980-48F9-BA19-0ECEDEF8C5D4}) (Version: 5.0.1.875114 - VMware, Inc.) Webexp Enhanced (HKLM-x32\...\Webexp Enhanced) (Version: 1.1 - Webexp Enhanced) <==== ATTENTION Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation) WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.30.3 - ASUS) Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.17 - ASUS) XnView 1.98.2 (HKLM-x32\...\XnView_is1) (Version: 1.98.2 - Gougelet Pierre-e) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden מסייע Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden ==================== Restore Points ========================= 23-02-2014 20:02:25 Windows-Sicherung 03-03-2014 06:24:06 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 03:34 - 2012-12-07 11:44 - 00000822 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {24527AED-825C-4327-8516-433F5B777E45} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS) Task: {25B44D26-E7D2-410D-B081-512DEAC640E9} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK) Task: {29C5E4AE-2F85-427F-8F03-6C6C9C3E274B} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{9E21F265-EF00-4954-A581-904E50A34205}.exe Task: {38ADD19F-3492-49E4-995A-D496857060D2} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2957650136-178916342-3901743012-1006 Task: {38E01409-9858-45E7-BE45-457A83519AE9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {62B84B49-36E4-4AF9-85CF-DF6C049314A6} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {A243EB12-0F31-41C1-BC59-4AFF77F1B406} - System32\Tasks\AmiUpdXp => C:\Users\BTA_AW-\AppData\Local\SwvUpdater\Updater.exe [2013-07-22] (Amonetize ltd.) <==== ATTENTION Task: {A736B26E-3FDC-4A19-B59A-A65C8AEA4480} - System32\Tasks\CCleanerSkipUAC => D:\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd) Task: {ACFA2AC0-7191-4B62-B315-66670A3DC452} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2957650136-178916342-3901743012-1003 Task: {B377EFF9-829F-4B99-B46D-A3CA23FE0C7D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-11] (Google Inc.) Task: {C1A87979-ED1B-4EE7-937A-A01F9CF5C7CD} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation) Task: {DAF16984-A298-412A-9C2B-2B4A10B22A15} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {DB9F773B-F7F9-480D-B8D8-BC648464B5B9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21] (Adobe Systems Incorporated) Task: {E2F642C2-ABDB-40ED-8410-8BE5A1414305} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-11] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\BTA_AW-\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{9E21F265-EF00-4954-A581-904E50A34205}.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-02-06 21:19 - 2014-02-06 21:19 - 00032288 _____ () C:\Program Files (x86)\LPT\srpts.exe 2012-03-31 16:15 - 2009-04-30 11:23 - 00090112 _____ () D:\Sony Ericsson PC Suite\SupServ.exe 2013-05-24 14:22 - 2013-06-03 12:06 - 03999512 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe 2014-02-06 21:19 - 2014-02-06 21:19 - 00013344 _____ () C:\Program Files (x86)\LPT\srptm.exe 2008-09-30 22:02 - 2008-09-30 22:08 - 00011264 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll 2007-06-15 19:28 - 2007-06-15 19:28 - 00104960 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll 2007-06-02 01:52 - 2007-06-02 01:52 - 00159744 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll 2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () D:\FileZilla FTP Client\fzshellext_64.dll 2010-03-16 02:48 - 2010-03-16 02:48 - 00148816 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\EcaremeDLL.dll 2011-01-30 23:29 - 2011-01-30 23:29 - 00030032 _____ () C:\Windows\assembly\GAC_MSIL\SqliteShared\1.0.3726.20828__0d0f4b69e50e559b\SqliteShared.dll 2011-01-30 23:29 - 2011-01-30 23:29 - 00931840 _____ () C:\Windows\assembly\GAC_64\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll 2010-07-02 22:36 - 2010-07-02 22:36 - 01597440 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe 2011-01-30 23:11 - 2010-04-06 07:29 - 00244904 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe 2014-02-06 21:17 - 2014-02-06 21:17 - 00012832 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Lrcnta.exe 2012-12-17 18:42 - 2013-12-09 17:36 - 00394808 _____ () D:\Avira\AntiVir Desktop\sqlite3.dll 2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00070176 _____ () C:\Program Files (x86)\LPT\srpt.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00022048 _____ () C:\Program Files (x86)\LPT\srptc.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00018976 _____ () C:\Program Files (x86)\LPT\Smartbar.Common.dll 2012-10-15 10:19 - 2012-10-15 10:19 - 00085656 _____ () D:\VMware\VMware vCenter Converter Standalone\mspack.dll 2012-10-15 10:17 - 2012-10-15 10:17 - 01234584 _____ () D:\VMware\VMware vCenter Converter Standalone\libxml2.dll 2012-10-15 10:16 - 2012-10-15 10:16 - 00541848 _____ () D:\VMware\VMware vCenter Converter Standalone\sqlite3.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00052256 _____ () C:\Program Files (x86)\LPT\srut.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00054304 _____ () C:\Program Files (x86)\LPT\sppsm.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00152608 _____ () C:\Program Files (x86)\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00017440 _____ () C:\Program Files (x86)\LPT\Smartbar.Personalization.Common.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00166432 _____ () C:\Program Files (x86)\LPT\Smartbar.Infrastructure.Utilities.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00037408 _____ () C:\Program Files (x86)\LPT\srbu.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00014880 _____ () C:\Program Files (x86)\LPT\srpdm.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00033824 _____ () C:\Program Files (x86)\LPT\Smartbar.Monetization.Proxy.ProxyService.dll 2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll 2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll 2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\libcef.dll 2012-04-01 21:18 - 2007-08-02 20:07 - 00034064 _____ () C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\DetMethod.dll 2007-06-15 19:28 - 2007-06-15 19:28 - 00147456 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll 2007-06-02 02:08 - 2007-06-02 02:08 - 00143360 _____ () C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2014-02-15 15:43 - 2014-02-15 15:43 - 03578992 _____ () D:\Mozilla\Firefox\mozjs.dll 2014-02-06 21:17 - 2014-02-06 21:17 - 00020512 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\lrcnt.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00054304 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\sppsm.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00017440 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll 2014-02-06 21:19 - 2014-02-06 21:19 - 00052256 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\srut.dll 2014-02-06 21:18 - 2014-02-06 21:18 - 00166432 _____ () C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll 2014-02-21 00:15 - 2014-02-21 00:15 - 16265096 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" ==================== Faulty Device Manager Devices ============= Name: Sony Ericsson seehcri Control Device Description: Sony Ericsson seehcri Control Device Class Guid: {36fc9e60-c465-11cf-8056-444553540000} Manufacturer: Sony Ericsson Service: seehcri Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 9017 Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 9017 Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8019 Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8019 Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 7020 Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 7020 Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:35 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6022 System errors: ============= Error: (03/03/2014 11:07:39 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: %%-2140993535 Error: (03/03/2014 11:07:39 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Error: (03/03/2014 11:07:39 PM) (Source: PNRPSvc) (User: ) Description: 0x80630801 Error: (03/03/2014 11:07:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: %%-2140993535 Error: (03/03/2014 11:07:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Error: (03/03/2014 11:07:27 PM) (Source: PNRPSvc) (User: ) Description: 0x80630801 Error: (03/03/2014 09:52:38 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Error: (03/03/2014 09:52:38 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: %%-2140993535 Error: (03/03/2014 09:52:38 PM) (Source: PNRPSvc) (User: ) Description: 0x80630801 Error: (03/03/2014 00:32:25 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Microsoft Office Sessions: ========================= Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 9017 Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 9017 Error: (03/03/2014 09:52:38 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 8019 Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 8019 Error: (03/03/2014 09:52:37 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 7020 Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 7020 Error: (03/03/2014 09:52:36 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (03/03/2014 09:52:35 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6022 CodeIntegrity Errors: =================================== Date: 2013-01-15 21:06:12.834 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-01-15 21:06:12.622 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-12-13 17:37:16.170 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-12-13 17:37:15.961 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-12-13 17:37:15.666 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-12-13 17:37:15.462 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 66% Total physical RAM: 4020.51 MB Available physical RAM: 1361.19 MB Total Pagefile: 8039.2 MB Available Pagefile: 4509.98 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:182.44 GB) (Free:54.28 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (Programme) (Fixed) (Total:348.23 GB) (Free:343.18 GB) NTFS Drive g: (Daten) (Fixed) (Total:146.48 GB) (Free:87.1 GB) NTFS Drive i: (Backup ****) (Fixed) (Total:488.28 GB) (Free:392.59 GB) NTFS Drive j: (Backup Nicole) (Fixed) (Total:443.23 GB) (Free:429.5 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 4C1644FD) Partition 1: (Not Active) - (Size=21 GB) - (Type=1C) Partition 2: (Active) - (Size=182 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=495 GB) - (Type=OF Extended) ======================================================== Disk: 1 (Size: 932 GB) (Disk ID: 442479A5) Partition 1: (Not Active) - (Size=488 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-03-04 01:01:26 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST975042 rev.0002 698.64GB Running: Gmer-19357.exe; Driver: C:\Users\BTA_AW-\AppData\Local\Temp\agxoykod.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035f4000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035f402f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe[2496] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076538769 5 bytes JMP 000000010067b780 .text C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Lrcnta.exe[7328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76] .text C:\Users\BTA_AW-\AppData\Local\Smartbar\Application\Lrcnta.exe[7328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe [4496](2014-01-03 00:45:04) 00000000040b0000 Library C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe [4496](2013-10-18 23:55:02) 0000000064160000 Library C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe [4496] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 00000000631b0000 ---- EOF - GMER 2.1 ---- |
04.03.2014, 08:00 | #2 |
/// the machine /// TB-Ausbilder | unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view hi,
__________________Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
10.03.2014, 13:21 | #3 |
| unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view hi schrauber, hab die scans mit Malwarebytes und adwcleaner gemacht, bei JRT ist lediglich ei batchfile im texteditor aufgegangen, bei tastenbetätigung hat sich nichts getan, hab das batchfile zusammen mit den logfiles eingefügt. Malwarebytes hab ich versehentlich abgebrochen und nochmals durchgeführt.
__________________ich habe ein kleines netzwerk mit zwei weiteren geräten, muss ich bei denen den selben vorgang durchziehen? danke und gruss ruedi Logs im Anhang, da zu gross |
11.03.2014, 09:34 | #4 |
/// the machine /// TB-Ausbilder | unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view Nee die sollten sicher sein. Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
12.03.2014, 07:06 | #5 |
| unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view guten Morgen, anbei die log.txt von ESET. Schönen Tag und Gruss Ruedi Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=b9a44cae17f75241b57c53fbe61f0c3e # engine=17400 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-03-11 09:54:18 # local_time=2014-03-11 10:54:18 (+0100, Mitteleuropäische Zeit) # country="Switzerland" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 66 85 21039114 146204708 0 0 # scanned=697613 # found=2 # cleaned=0 # scan_time=19198 sh=7BC4998793462E1932A4F74E3A139DCDDA7653C6 ft=1 fh=19edba72960273eb vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Program Files (x86)\Swisscom\Quick Help\m2mupdate.exe" sh=FCC606A3FF1BD6D782A616B74F6551C9DCF8F560 ft=1 fh=8b4256a9d5b6cfaa vn="probably unknown NewHeur_PE virus" ac=I fn="C:\Users\BTA_AW-\Downloads\SwisscomQuickHelp_Setup.exe" habe SecurityCheck heruntergeladen, auf den desktop gelegt und gestartet. hat die batch-datei im editor angezeigt (siehe code), hab darin keine anweisungen gefunden, ist aber weiter nichts mehr gegangen. was mach ich falsch?? lg ruedi Code:
ATTFilter @echo off cd %~dp0 title Security Check color F set cleanver=0.99.80 echo. echo. echo.`````````````````````````Security Check by screen317````````````````````````` echo. echo. echo. echo. echo. echo.This will check your system and display the security programs on your computer. echo. echo.`````````If you don't want this done for any reason, please quit now.```````` echo. echo. echo. pause cls echo. echo. echo. :prep If "%OS%"=="Windows_NT" ( goto NT ) else ( echo. UNSUPPORTED OPERATING SYSTEM! Aborting now! && echo. UNSUPPORTED OPERATING SYSTEM! ABORTED!>checkup.txt ) goto preend :NT if exist checkup.txt del /q /f *.txt echo. Results of screen317's Security Check version %cleanver% >prelimcheckup.txt echo. echo. echo. echo. echo. echo. echo. echo. echo. ``Collecting information`` "%cd%\Other\cmdinfo.exe">check.txt @find /i "OS type" check.txt>OS1check.txt @find /i "Build number" check.txt>x64SPcheck.txt @FOR /F "eol=- tokens=3-6* delims= " %%d in (OS1check.txt) do @echo. %%d %%e %%f %%g %%h>OS1check2.txt @find /i "vista" OS1check2.txt>nul && set OS1=Windows Vista @find /i "XP" OS1check2.txt>nul && set OS1=Windows XP @find /i "2000" OS1check2.txt>nul && set OS1=Windows 2000 @find /i "7" OS1check2.txt>nul && set OS1=Windows 7 if not exist "%systemdrive%\Program Files (x86)" goto x64totalskip if "%OS1%"=="Windows 7" goto x64vistaskip @find /i "Build number" check.txt>x64SPcheck.txt @find /i "6001" x64SPcheck.txt>nul &&set OS2=Service Pack 1 @find /i "6002" x64SPcheck.txt>nul &&set OS2=Service Pack 2 goto UACcheck :x64vistaskip @find /i "7601" x64SPcheck.txt>nul &&set OS2=Service Pack 1 goto UACcheck :x64totalskip @find /i "Service Pack" check.txt>OS2check.txt @find /i "1" OS2check.txt>nul && set OS2=Service Pack 1 @find /i "2" OS2check.txt>nul && set OS2=Service Pack 2 @find /i "3" OS2check.txt>nul && set OS2=Service Pack 3 @find /i "4" OS2check.txt>nul && set OS2=Service Pack 4 :UACcheck "%cd%\Other\swreg.exe" query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System">UAC.txt @find /i "EnableLUA" "UAC.txt">"UAC2.txt" @find /I "1 " "UAC2.txt">nul && set UAC=(UAC is enabled) @find /I "0 " "UAC2.txt">nul && set UAC=(UAC is disabled!) :uacskip set x64check=x86 if "%programfiles(x86)%"=="%systemdrive%\Program Files (x86)" set x64check=x64 echo. %OS1% %OS2% %x64check% %UAC% >>prelimcheckup.txt @find /i "windows" prelimcheckup.txt>nul || echo. Error getting OS version @find /i "Windows 2000" prelimcheckup.txt>nul && @find /i "2000 Service Pack 4" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt @find /i "Windows Vista" prelimcheckup.txt>nul && @find /i "Vista Service Pack 2" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt @find /i "Windows XP" prelimcheckup.txt>nul && @find /i "XP Service Pack 3" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt @find /i "Windows 7" prelimcheckup.txt>nul && @find /i "7 Service Pack 1" prelimcheckup.txt>nul || echo. Out of date service pack!!>>prelimcheckup.txt :IE version "%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /V "svcVersion">IEversion.txt @FOR /F "eol=- tokens=1-3* delims= " %%a in (IEVersion.txt) do echo.%%c>IEVersion2.txt if "%OS1%"=="Windows Vista" goto oldIEV if "%OS1%"=="Windows XP" goto oldIE if "%OS1%"=="Windows 2000" goto oldIE @FOR /F "eol=- tokens=1 delims=." %%# in (IEVersion2.txt) do ( if "%%#" LSS "11" ( echo. Internet Explorer %%# Out of date!>>prelimcheckup.txt ) else ( echo. Internet Explorer 11 >>prelimcheckup.txt ) ) goto IESkip :oldIEV "%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector">IEversion.txt Find /I "IE" "IEVersion.txt">IEVersion2.txt @FOR /F "eol=- tokens=1-3* delims= " %%a in (IEVersion2.txt) do echo.%%c>IEVersion3.txt @FOR /F "eol=- tokens=1 delims=." %%# in (IEVersion3.txt) do ( if "%%#" LSS "9" ( echo. Internet Explorer %%# Out of date!>>prelimcheckup.txt ) else ( echo. Internet Explorer 9 >>prelimcheckup.txt ) ) :oldIE "%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector">IEversion.txt Find /I "IE" "IEVersion.txt">IEVersion2.txt @FOR /F "eol=- tokens=1-3* delims= " %%a in (IEVersion2.txt) do echo.%%c>IEVersion3.txt @FOR /F "eol=- tokens=1 delims=." %%# in (IEVersion3.txt) do ( if "%%#" LSS "8" ( echo. Internet Explorer %%# Out of date!>>prelimcheckup.txt ) else ( echo. Internet Explorer 8 >>prelimcheckup.txt ) ) :IESkip cls echo. echo. echo. echo. echo. echo. echo. echo. Collecting Information Done :preparing cls echo. echo. echo. echo. echo. echo. echo. echo. ``Preparing`` objlist.exe "programlist" if exist install.txt goto processlist1 objlist.exe "programlist" if exist install.txt goto processlist1 objlist.exe "programlist" if exist install.txt goto processlist1 if ERRORLEVEL 1 echo. Error creating install.txt after 3 tries! Trying alternate method...>>prelimcheckup.txt uninstalllist.exe :processlist1 objlist.exe "processlist" if exist process.txt goto preantivirus objlist.exe "processlist" if exist process.txt goto preantivirus objlist.exe "processlist" if exist process.txt goto preantivirus if ERRORLEVEL 1 echo. Error creating process.txt after after 3 tries! Trying Alternate method...>>prelimproccheck.txt runprocesses.exe if exist process.txt ( goto preantivirus ) else ( echo. Error creating Process List-- tell your Helper>>prelimcheckup.txt ) :preantivirus cls echo. echo. echo. echo. echo. echo. echo. echo. ``Preparing Done!`` :antivirus echo. echo.``````````````Antivirus/Firewall Check:``````````````>>prelimcheckup.txt if not exist "C:\windows\system32\sc.exe" goto skipwscsvccheck && echo. sc.exe missing!>>prelimcheckup.txt sc query "wscsvc">wscsvc1.txt @find /I "RUNNING" wscsvc1.txt>nul || echo. Windows Security Center service is not running! This report may not be accurate!>>prelimcheckup.txt :skipwscsvccheck if not exist "%windir%\system32\netsh.exe" goto skipfirewallcheck && echo. netsh.exe missing!>>prelimcheckup.txt if "%OS1%"=="Windows XP" ( netsh firewall show state>fw1.txt "%cd%\Other\nircmdc.exe" wait 1000 @find /I "Operational" fw1.txt>fw2.txt @find /I "Enable" fw2.txt >nul && echo. Windows Firewall Enabled! >>prelimcheckup.txt @find /I "Disable" fw2.txt >nul && echo. Windows Firewall Disabled! >>prelimcheckup.txt ) else ( netsh advfirewall show allprofiles > Vista7FirewallCheck1.txt "%cd%\Other\nircmdc.exe" wait 1000 @find /I "State" Vista7FirewallCheck1.txt>Vista7FirewallCheck2.txt @find /I "ON" Vista7FirewallCheck2.txt >nul && echo. Windows Firewall Enabled! >>prelimcheckup.txt @find /I "OFF" Vista7FirewallCheck2.txt >nul && echo. Windows Firewall Disabled! >>prelimcheckup.txt ) :skipfirewallcheck if exist "%windir%\system32\wbem\wmic.exe" goto scenter FIND /I "V3 VirusBlock" install.txt>>prelimviruscheck.txt FIND /V /I "V3 VirusBlock" install.txt>install2.txt FIND /I "avast! 4 Small Business Server Edition" install2.txt>>prelimviruscheck.txt FIND /V /I "avast! 4 Small Business Server Edition" install2.txt>install3.txt FIND /I "avast! Antivirus" install3.txt>>prelimviruscheck.txt FIND /V /I "avast! Antivirus" install3.txt>install4.txt FIND /I "avast! 4 SBS Edition" install4.txt>>prelimviruscheck.txt FIND /V /I "avast! 4 SBS Edition" install4.txt>install5.txt FIND /I "AVG Internet Security" install5.txt>>prelimviruscheck.txt FIND /V /I "AVG Internet Security" install5.txt>install6.txt FIND /I "AVG Anti-Virus" install6.txt>>prelimviruscheck.txt FIND /V /I "AVG Anti-Virus" install6.txt>install7.txt FIND /I "avast!" install7.txt>>prelimviruscheck.txt FIND /V /I "avast!" install7.txt>install8.txt FIND /I "AVG" install8.txt>>prelimviruscheck.txt FIND /V /I "AVG" install8.txt>install9.txt FIND /I "Avira AntiVir Personal - Free Antivirus" install9.txt>>prelimviruscheck.txt FIND /V /I "Avira AntiVir Personal - Free Antivirus" install9.txt>install10.txt FIND /I "Avira AntiVir Premium" install10.txt>>prelimviruscheck.txt FIND /V /I "Avira AntiVir Premium" install10.txt>install11.txt FIND /I "Avira AntiVir Professional" install11.txt>>prelimviruscheck.txt FIND /V /I "Avira AntiVir Professional" install11.txt>install12.txt FIND /I "Avira" install12.txt>>prelimviruscheck.txt FIND /V /I "Avira" install12.txt>install13.txt FIND /I "Rising Antivirus" install13.txt>>prelimviruscheck.txt FIND /V /I "Rising Antivirus" install13.txt>install14.txt FIND /I "BullGuard" install14.txt>>prelimviruscheck.txt FIND /V /I "BullGuard" install14.txt>install15.txt FIND /I "eTrust Antivirus" install15.txt>>prelimviruscheck.txt FIND /V /I "eTrust Antivirus" install15.txt>install16.txt FIND /I "Quick Heal" install16.txt>>prelimviruscheck.txt FIND /V /I "Quick Heal" install16.txt>install17.txt FIND /I "ClamWin" install17.txt>>prelimviruscheck.txt FIND /V /I "ClamWin" install17.txt>install18.txt FIND /I "EarthLink Protection" install18.txt>>prelimviruscheck.txt FIND /V /I "EarthLink Protection" install18.txt>install19.txt FIND /I "Aluria Security" install19.txt>>prelimviruscheck.txt FIND /V /I "Aluria Security" install19.txt>install20.txt FIND /I "Digital Security Blink Professional" install20.txt>>prelimviruscheck.txt FIND /V /I "Digital Security Blink Professional" install20.txt>install21.txt FIND /I "NOD32 Antivirus" install21.txt>>prelimviruscheck.txt FIND /V /I "NOD32 Antivirus" install21.txt>install22.txt FIND /I "ESET" install22.txt>>prelimviruscheck.txt FIND /V /I "ESET" install22.txt>install23.txt FIND /I "F-Prot Antivirus" install23.txt>>prelimviruscheck.txt FIND /V /I "F-Prot Antivirus" install23.txt>install24.txt FIND /I "F-Secure Anti-Virus" install24.txt>>prelimviruscheck.txt FIND /V /I "F-Secure Anti-Virus" install24.txt>install25.txt FIND /I "F-Secure Internet Security" install25.txt>>prelimviruscheck.txt FIND /V /I "F-Secure Internet Security" install25.txt>install26.txt FIND /I "ViRobot Expert" install26.txt>>prelimviruscheck.txt FIND /V /I "ViRobot Expert" install26.txt>install27.txt FIND /I "Kaspersky Anti-Virus" install27.txt>>prelimviruscheck.txt FIND /V /I "Kaspersky Anti-Virus" install27.txt>install28.txt FIND /I "Kaspersky Internet Security" "install28.txt" >>prelimviruscheck.txt FIND /V /I "Kaspersky Internet Security" "install28.txt" >install29.txt FIND /I "McAfee VirusScan" "install29.txt" >>prelimviruscheck.txt FIND /V /I "McAfee VirusScan" "install29.txt" >install30.txt FIND /I "McAfee Total Protection" "install30.txt" >>prelimviruscheck.txt FIND /V /I "McAfee Total Protection" "install30.txt" >install31.txt FIND /I "McAfee Internet Security" "install31.txt" >>prelimviruscheck.txt FIND /V /I "McAfee Internet Security" "install31.txt" >install32.txt FIND /I "OneCare" "install32.txt" >>prelimviruscheck.txt FIND /V /I "OneCare" "install32.txt" >install33.txt FIND /I "Norman" "install33.txt" >>prelimviruscheck.txt FIND /V /I "Norman" "install33.txt" >install34.txt FIND /I "Panda for Desktops" "install34.txt" >>prelimviruscheck.txt FIND /V /I "Panda for Desktops" "install34.txt" >install35.txt FIND /I "OneCare" "install35.txt" >>prelimviruscheck.txt FIND /V /I "OneCare" "install35.txt" >install36.txt FIND /I "Panda Antivirus" "install36.txt" >>prelimviruscheck.txt FIND /V /I "Panda Antivirus" "install36.txt" >install37.txt FIND /I "Panda Internet Security" "install37.txt" >>prelimviruscheck.txt FIND /V /I "Panda Internet Security" "install37.txt" >install38.txt FIND /I "Panda Global Protection" "install38.txt" >>prelimviruscheck.txt FIND /V /I "Panda Global Protection" "install38.txt" >install39.txt FIND /I "Panda Platinum" "install39.txt" >>prelimviruscheck.txt FIND /V /I "Panda Platinum" "install39.txt" >install40.txt FIND /I "Panda Titanium" "install40.txt" >>prelimviruscheck.txt FIND /V /I "Panda Titanium" "install40.txt" >install41.txt FIND /I "BitDefender" "install41.txt" >>prelimviruscheck.txt FIND /V /I "BitDefender" "install41.txt" >install42.txt FIND /I "Sophos Anti-Virus" "install42.txt" >>prelimviruscheck.txt FIND /V /I "Sophos Anti-Virus" "install42.txt" >install43.txt FIND /I "Norton AntiVirus" "install43.txt" >>prelimviruscheck.txt FIND /V /I "Norton AntiVirus" "install43.txt" >install44.txt FIND /I "Symantec EndPoint Protection" "install44.txt" >>prelimviruscheck.txt FIND /V /I "Symantec EndPoint Protection" "install44.txt" >install45.txt FIND /I "Symantec Antivirus" "install45.txt" >>prelimviruscheck.txt FIND /V /I "Symantec Antivirus" "install45.txt" >install46.txt FIND /I "Norton Internet Security" "install46.txt" >>prelimviruscheck.txt FIND /V /I "Norton Internet Security" "install46.txt" >install47.txt FIND /I "Norton System Works" "install47.txt" >>prelimviruscheck.txt FIND /V /I "Norton System Works" "install47.txt" >install48.txt FIND /I "PC-Cillin Internet Security" "install48.txt" >>prelimviruscheck.txt FIND /V /I "PC-Cillin Internet Security" "install48.txt" >install49.txt FIND /I "Trend Micro Internet Security" "install49.txt" >>prelimviruscheck.txt FIND /V /I "Trend Micro Internet Security" "install49.txt" >install50.txt FIND /I "Online Armor 3.5" "install50.txt" >>prelimviruscheck.txt FIND /V /I "Online Armor 3.5" "install50.txt" >install51.txt FIND /I "Kerio Personal Firewall 2.1.5" "install51.txt" >>prelimviruscheck.txt FIND /V /I "Kerio Personal Firewall 2.1.5" "install51.txt" >install52.txt FIND /I "NETGEAR ProSafe Firewall Router" "install52.txt" >>prelimviruscheck.txt FIND /V /I "NETGEAR ProSafe Firewall Router" "install52.txt" >install53.txt FIND /I "Trend Micro Officescan Client" "install53.txt" >>prelimviruscheck.txt FIND /V /I "Trend Micro Officescan Client" "install53.txt" >install54.txt FIND /I "Authentium AntiVirus" "install54.txt" >>prelimviruscheck.txt FIND /V /I "Authentium AntiVirus" "install54.txt" >install55.txt FIND /I "Sunbelt Personal Firewall" "install55.txt" >>prelimviruscheck.txt FIND /V /I "Sunbelt Personal Firewall" "install55.txt" >install57.txt FIND /I "Privatefirewall 6.1" "install57.txt" >>prelimviruscheck.txt FIND /V /I "Privatefirewall 6.1" "install57.txt" >install58.txt FIND /I "COMODO Internet" "install58.txt" >>prelimviruscheck.txt FIND /V /I "COMODO Internet" "install58.txt" >install59.txt FIND /I "Norton Personal Firewall" "install59.txt" >>prelimviruscheck.txt FIND /V /I "Norton Personal Firewall" "install59.txt" >install60.txt FIND /I "Aluria Firewall" "install60.txt" >>prelimviruscheck.txt FIND /V /I "Aluria Firewall" "install60.txt" >install61.txt FIND /V /I "EzTrends" "install61.txt" >install62.txt FIND /I "Norton 360" "install62.txt">nul && echo. Norton 360>>prelimviruscheck.txt FIND /V /I "Norton 360" "install62.txt" >install63.txt FIND /I "TrustPort Antivirus" "install63.txt" >>prelimviruscheck.txt FIND /V /I "TrustPort Antivirus" "install63.txt" >install64.txt FIND /V /I "malw" "install64.txt" >install65.txt FIND /V /I "virustotal" "install65.txt" >install66.txt FIND /V /I "Comodo Memory Firewall" "install66.txt" >install67.txt FIND /I "DriveSentry" "install67.txt" >>prelimviruscheck.txt FIND /V /I "TrendProtect" "install67.txt" >install68.txt FIND /V /I "SiteAdvisor" "install68.txt" >install69.txt FIND /V /I "RegScanner" "install69.txt" >install70.txt FIND /I "Outpost Firewall 2009" "install70.txt" >>prelimviruscheck.txt FIND /V /I "Outpost Firewall 2009" "install70.txt" >install71.txt echo.>hklmrun.txt @"%cd%\other\SWreg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run">>hklmrun.txt @FIND /I "iolo AntiVirus" "hklmrun.txt">nul && echo. iolo Antivirus>>prelimviruscheck.txt @FIND /I "iolo Personal Firewall" "hklmrun.txt">nul && echo. iolo Personal Firewall>>prelimviruscheck.txt @FOR /F "eol=- tokens=1-5* delims= " %%a in (prelimviruscheck.txt) do @echo. %%a %%b %%c %%d %%e %%f>>prelimcheckup.txt FIND /I "virus" "install71.txt" >>prelimviruscheck2.txt FIND /V /I "virus" "install71.txt" >install72.txt FIND /I "firewall" "install72.txt" >>prelimviruscheck2.txt FIND /V /I "firewall" "install72.txt" >install73.txt FIND /I "squared" "install73.txt" >>prelimviruscheck2.txt FIND /I "DefenseWall" "install73.txt" >>prelimviruscheck2.txt FIND /I "etrust" "install73.txt" >>prelimviruscheck2.txt FIND /I "armor" "install73.txt" >>prelimviruscheck2.txt FIND /I "McAfee" "install73.txt" >>prelimviruscheck2.txt FIND /I "ZoneAlarm" "install73.txt" >>prelimviruscheck2.txt FIND /I "bullguard" "install73.txt" >>prelimviruscheck2.txt FIND /I "trend" "install73.txt" >>prelimviruscheck2.txt FIND /I "prevx" "install73.txt" >>prelimviruscheck2.txt FIND /I "outpost" "install73.txt" >>prelimviruscheck2.txt FIND /I "AT^&T Internet Security" "install73.txt" >>prelimviruscheck2.txt FIND /I "iolo" "install73.txt" >>prelimviruscheck2.txt FIND /I "Microsoft Security Essentials" "install73.txt" >>prelimviruscheck2.txt @FOR /F "eol=- tokens=1-5* delims= " %%4 in (prelimviruscheck2.txt) do @echo. %%4 %%5 %%6 %%7 %%8 %%9>>prelimcheckup.txt goto autoupdate :scenter find /i "Windows XP" "prelimcheckup.txt">nul && goto XPWMI @wmic /namespace:\\root\SecurityCenter2 PATH AntivirusProduct GET displayname >AVDisplayName.txt type AVDisplayName.txt | findstr /v displayName >>prelimcheckup.txt @wmic /namespace:\\root\securitycenter2 PATH antivirusproduct GET productstate >AVstate.txt find /i "397312" AVstate.txt>nul && set updatestatus=Antivirus up to date! find /i "393216" AVstate.txt>nul && set scanstatus=(On Access scanning disabled!) find /i "266240" AVstate.txt>nul && set updatestatus=Antivirus up to date! find /i "270336" AVstate.txt>nul && set updatestatus=Antivirus out of date! find /i "266256" AVstate.txt>nul && set updatestatus=Antivirus out of date! find /i "262144" AVstate.txt>nul && set updatestatus=Antivirus up to date! find /i "262144" AVstate.txt>nul && set scanstatus=(On Access scanning disabled!) find /i "262160" AVstate.txt>nul && set updatestatus=Antivirus out of date! find /i "262160" AVstate.txt>nul && set scanstatus=(On Access scanning disabled!) find /i "266240" AVstate.txt>nul && set updatestatus=Antivirus up to date! goto wmifinish :XPWMI @wmic /namespace:\\root\SecurityCenter PATH AntivirusProduct GET displayname >AVDisplayName.txt "%cd%\Other\nircmdc.exe" wait 500 type AVDisplayName.txt | findstr /v displayName >>prelimcheckup.txt @wmic /namespace:\\root\SecurityCenter PATH AntivirusProduct GET productUptoDate >AVupdatestatus.txt "%cd%\Other\nircmdc.exe" wait 500 @wmic /namespace:\\root\securitycenter PATH antivirusproduct GET onaccessscanningenabled>AVscanstatus.txt "%cd%\Other\nircmdc.exe" wait 500 if not exist AVupdatestatus.txt echo. WMIC error!>>prelimcheckup.txt && goto preantispy if not exist AVscanstatus.txt echo. WMIC error!>>prelimcheckup.txt && goto preantispy @Find /I "true" AVupdatestatus.txt>nul && set updatestatus=Antivirus up to date! @Find /I "false" AVupdatestatus.txt>nul && set updatestatus=Antivirus out of date! @find /i "false" AVscanstatus.txt>nul && set scanstatus=(On Access scanning disabled!) :wmifinish if "%updatestatus% %scanstatus%"==" " ( echo. WMI entry may not exist for antivirus; attempting automatic update.>>prelimcheckup.txt ) && ( goto autoupdate ) echo. %updatestatus% %scanstatus%>>prelimcheckup.txt @find /i "date" prelimcheckup.txt>nul || @echo. Error obtaining update status for antivirus! >>prelimcheckup.txt goto preantispy :autoupdate cls echo. echo. echo. echo. echo. echo. echo. echo. Attempting to update antivirus. cls if exist "%programfiles%\Avira\AntiVir Desktop\update.exe" ( "%programfiles%\Avira\AntiVir Desktop\update.exe" ) && ( echo. Avira successfully updated!>>prelimcheckup.txt "%cd%\Other\nircmdc.exe" wait 500 ) if exist "%programfiles%\AVAST Software\Avast\ashUpd.exe" ( "%programfiles%\AVAST Software\Avast\ashUpd.exe" ) && ( echo. avast! successfully updated!>>prelimcheckup.txt "%cd%\Other\nircmdc.exe" wait 500 ) if exist "%programfiles%\Microsoft Security Essentials\MpCmdRun.exe" ( "%programfiles%\Microsoft Security Essentials\MpCmdRun.exe" /SignatureUpdate ) && ( echo. Microsoft Security Essentials successfully updated!>>prelimcheckup.txt "%cd%\Other\nircmdc.exe" wait 500 ) if exist "%programfiles%\AVG\AVG2012\avgmfapx.exe" ( "%programfiles%\AVG\AVG2012\avgmfapx.exe" /update ) && ( echo. AVG2012 successfully updated!>>prelimcheckup.txt "%cd%\Other\nircmdc.exe" wait 500 ) echo. :preantispy cls echo. echo. echo. echo. echo. echo. echo. echo. ``Antivirus/Firewall Check Done!`` :antispy echo.`````````Anti-malware/Other Utilities Check:`````````>>prelimcheckup.txt FIND /I "spy" "install.txt" >prelimspycheck.txt FIND /I "Destroy 1.3" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt FIND /I "Destroy 1.4" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt FIND /I "Destroy 1.5" "prelimspycheck.txt">nul && echo. Out of date Spybot installed!>>prelimcheckup.txt FIND /I "Windows Defender" "install.txt" >>prelimspycheck.txt FIND /I "ad-aware" "install.txt" >nul && echo. Ad-Aware>>prelimcheckup.txt FIND /I "WinPatrol" "install.txt" >nul && echo. WinPatrol>>prelimcheckup.txt FIND /I "WinPatrol 2011" "install.txt" >nul && echo. WinPatrol 2011 (Outdated! Latest version is WinPatrol 2012)>>prelimcheckup.txt FIND /I "WinPatrol 2009" "install.txt">nul && echo. WinPatrol 2009 (Outdated! Latest version is WinPatrol 2012)>>prelimcheckup.txt FIND /I "WinPatrol 2008" "install.txt">nul && echo. WinPatrol 2008 (Outdated! Latest version is WinPatrol 2012)>>prelimcheckup.txt FIND /I "WinPatrol 2007" "install.txt" >nul && echo. WinPatrol 2007 (Outdated! Latest version is WinPatrol 2012)>>prelimcheckup.txt FIND /I "trendprotect" "install.txt" >>prelimspycheck.txt FIND /I "ThreatFire" "install.txt" >>prelimspycheck.txt FIND /I "Mamutu" "install.txt" >>prelimspycheck.txt FIND /I "web of trust" "install.txt" >>prelimspycheck.txt FIND /I "Finjan" "install.txt" >>prelimspycheck.txt FIND /I "siteadvisor" "install.txt" >>prelimspycheck.txt @FIND /I "RegProt" "hklmrun.txt">nul && echo. DiamondCS RegProt>>prelimspycheck.txt FIND /I "Norton Ghost" "install.txt" >>prelimspycheck.txt if exist "%systemdrive%\IE-SPYAD" @echo. IE SpyAd >>prelimspycheck.txt FIND /I "Secunia" "install.txt" >>prelimspycheck.txt @COPY /Y "%SystemRoot%\system32\drivers\etc\HOSTS" "hostcopy.txt" >nul FIND /I "MVPS" "hostcopy.txt" >>nul && echo. MVPS Hosts File >>prelimcheckup.txt FIND /I "BOClean" "install.txt" >>prelimspycheck.txt FIND /I "hosts" "install.txt" >>prelimspycheck.txt FIND /I "virustotal" "install.txt" >>prelimspycheck.txt FIND /I "Key Scrambler" "install.txt" >>prelimspycheck.txt FIND /I "WindowsCare" "install.txt" >>prelimspycheck.txt if exist "%windir%\gmer.exe" @echo. Gmer >>prelimspycheck.txt FIND /I "RegSupreme" "install.txt" >>prelimspycheck.txt FIND /I "Trojan Remover" "install.txt" >>prelimspycheck.txt FIND /I "Free Internet Window Washer" "install.txt" >>prelimspycheck.txt if exist "%userprofile%\Desktop\cwshredder.exe" @echo. CWShredder >>prelimspycheck.txt FIND /I "rootkit" "install.txt" >>prelimspycheck.txt FIND /I "Zemana" "install.txt" >>prelimspycheck.txt FIND /I "Malwarebytes Anti-Malware version 1.70.0.1100" "install.txt" >>prelimspycheck.txt && echo. Out of date Malwarebytes Anti-Malware installed!>>prelimspycheck.txt FIND /I "Malwarebytes Anti-Malware version 1.75.0.1300" "install.txt" >>prelimspycheck.txt FIND /I "HijackThis 1.99.1" "install.txt" >>prelimspycheck.txt && echo. Out of date HijackThis installed!>>prelimcheckup.txt FIND /I "HijackThis 2.0.2" "install.txt" >>prelimspycheck.txt && echo. Out of date HijackThis installed!>>prelimcheckup.txt FIND /I "HijackThis 2.0.3" "install.txt" >>prelimspycheck.txt && echo. Out of date HijackThis installed!>>prelimcheckup.txt FIND /I "HijackThis 2.0.4" "install.txt" >>prelimspycheck.txt && echo. Out of date HijackThis installed!>>prelimcheckup.txt FIND /I "HijackThis 2.0.5" "install.txt" >>prelimspycheck.txt FIND /I "runscanner" "install.txt" >>prelimspycheck.txt FIND /I "tuneup" "install.txt" >>prelimspycheck.txt FIND /I "Comodo Memory Firewall" "install.txt" >>prelimspycheck.txt FIND /I "cleaner" "install.txt" >>prelimspycheck.txt FIND /I "RegScanner" "install.txt" >>prelimspycheck.txt FIND /I "DriveSentry" "install.txt" >>prelimspycheck.txt FIND /V "SpywareBlaster" "prelimspycheck.txt" >prelimspycheck2.txt FIND /I "SpywareBlaster 4.1" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.1 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 4.2" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.2 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 4.3" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.3 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 4.4" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.4 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 4.5" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.5 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 4.6" "prelimspycheck2.txt">nul && echo SpywareBlaster 4.6 Out of Date!>>prelimspycheck.txt FIND /I "SpywareBlaster 5.0" "prelimspycheck2.txt" >>prelimspycheck2.txt :java @FIND /I "Java" "install.txt" >>prelimspycheck.txt || goto javanext @FIND /I "Java 7 Update 51" "prelimspycheck.txt" >nul || echo. Java version out of Date!>>prelimspycheck.txt :javanext @FOR /F "eol=- tokens=1-4* delims= " %%j in (prelimspycheck.txt) do @echo. %%j %%k %%l %%m %%n>>prelimcheckup.txt @FIND /I "Adobe Flash" install.txt>flashcheck.txt @FIND /I "Adobe Flash Player 6" "install.txt" >nul && echo. Adobe Flash Player 6 Flash Player out of Date!>>prelimcheckup.txt @FIND /I "Adobe Flash Player 7" "install.txt" >nul && echo. Adobe Flash Player 7 Flash Player out of Date!>>prelimcheckup.txt @FIND /I "Adobe Flash Player 8" "install.txt" >nul && echo. Adobe Flash Player 8 Flash Player out of Date!>>prelimcheckup.txt @FIND /I "Adobe Flash Player 9" "install.txt" >nul && echo. Adobe Flash Player 9 Flash Player out of Date!>>prelimcheckup.txt @FIND /I "Adobe Flash Player 10" "install.txt" >nul && echo. Adobe Flash Player 10 Flash Player out of Date!>>prelimcheckup.txt :flashnext if exist "%windir%\sysnative\cmd.exe" ( "%windir%\sysnative\cmd.exe" /c flashx64.bat ) else ( cmd.exe /c flashx64.bat ) :readernext FIND /I "Adobe Reader" install.txt>nul || goto adobenext FIND /I "Adobe Reader" install.txt>rc2.txt FIND /V /I "Spelling" rc2.txt>rc3.txt FIND /I "XI" rc3.txt>nul || set readercheck=Adobe Reader out of Date! FIND /I "Adobe Reader 5" "install.txt" >nul && echo. Adobe Reader 5 %readercheck%>>prelimcheckup.txt FIND /I "Adobe Reader 6" "install.txt" >nul && echo. Adobe Reader 6 %readercheck%>>prelimcheckup.txt FIND /I "Adobe Reader 7" "install.txt" >nul && echo. Adobe Reader 7 %readercheck%>>prelimcheckup.txt FIND /I "Adobe Reader 8" "install.txt" >nul && echo. Adobe Reader 8 %readercheck%>>prelimcheckup.txt FIND /I "Adobe Reader 9" "install.txt" >nul && echo. Adobe Reader 9 %readercheck%>>prelimcheckup.txt FIND /I "Adobe Reader XI" "rc2.txt">nul && echo. Adobe Reader XI>>prelimcheckup.txt && goto adobenext for /f "tokens=1-3 delims=( eol=-" %%a in (rc3.txt) do echo.%%b>rc4.txt for /f "tokens=1 delims=) eol=-" %%a in (rc4.txt) do echo.%%a>rc5.txt for /f "tokens=1-4 delims=. eol=-" %%a in (rc5.txt) do ( if "%%a" lss "11" echo. Adobe Reader %%a.%%b.%%c^ Adobe Reader out of Date!>>prelimcheckup.txt && goto adobenext echo. Adobe Reader XI (%%a.%%b.%%c^)>>prelimcheckup.txt ) :adobenext @find /i "Firefox" "install.txt">ff2.txt @for /f "tokens=1-3 eol=W delims= " %%a in (ff2.txt) do echo.%%c>ff3.txt @for /f "tokens=1-3 delims=. eol=-" %%a in (ff3.txt) do if "%%c"=="" goto FFskip2 @for /f "tokens=1-3 delims=. eol=-" %%a in (ff3.txt) do ( if "%%a" lss "27" echo. Mozilla Firefox %%a.%%b.%%c^ Firefox out of Date!>>prelimcheckup.txt && goto ffnext echo. Mozilla Firefox (%%a.%%b.%%c^)>>prelimcheckup.txt ) ) goto ffnext :FFskip2 @for /f "tokens=1-3 delims=. eol=-" %%a in (ff3.txt) do ( if /i %%a lss 25 echo. Mozilla Firefox %%a.%%b^ Firefox out of Date!>>prelimcheckup.txt && goto ffnext echo. Mozilla Firefox (%%a.%%b^)>>prelimcheckup.txt ) :ffnext find /i "Thunderbird" "install.txt">tb2.txt for /f "tokens=1-5 eol=- delims= " %%a in (tb2.txt) do echo.%%c>tb3.txt for /f "tokens=1-3 delims=. eol=-" %%a in (tb3.txt) do ( if /i "%%a" lss "17" echo. Mozilla Thunderbird %%a.%%b.%%c^ Thunderbird out of Date!>>prelimcheckup.txt && goto tbnext echo. Mozilla Thunderbird (%%a.%%b.%%c^)>>prelimcheckup.txt ) :tbnext if exist "%userprofile%\appdata\local\google\chrome\application" dir /b "%userprofile%\appdata\local\google\chrome\application">chrome.txt if exist "%programfiles%\Google\Chrome\Application" dir /b "%programfiles%\Google\Chrome\Application">chrome.txt if exist "%systemdrive%\program files (x86)\Google\Chrome\Application" dir /b "%systemdrive%\program files (x86)\Google\Chrome\Application">chrome.txt if not exist chrome.txt goto chromenext find /i /v "wow" chrome.txt>chrome2.txt find /i /v "master" chrome2.txt>chrome3.txt find /i /v "dictionaries" chrome3.txt>chrome4.txt find /i /v "chrome" chrome4.txt>chrome5.txt find /i /v "first" chrome5.txt>chrome6.txt find /i /v "debug" chrome6.txt>chrome7.txt for /f "tokens=1-5* eol=- delims=." %%a in (chrome7.txt) do ( if /i %%a lss 19 ( set "chromestatus=[/color]Out of date![/color]" ) echo. Google Chrome %%a.%%b.%%c.%%d %chromestatus%>>prelimcheckup.txt ) :chromenext cls echo. echo. echo. echo. echo. echo. echo. echo. ``Anti-malware/Other utilities Check Done!`` :processcheck echo. echo.````````Process Check: objlist.exe by Laurent```````` >>prelimcheckup.txt Find /I "ccSvcHst.exe" "process.txt" >nul && echo. Norton ccSvcHst.exe>>prelimcheckup.txt Find /V /I "ccSvcHst.exe" "process.txt">process2.txt if exist "%windir%\sysnative\cmd.exe" ( "%windir%\sysnative\cmd.exe" /c MSEx64.bat ) else ( cmd.exe /c MSEx64.bat ) FIND /I "msseces.exe" "process2.txt" >nul && echo. Microsoft Security Essentials msseces.exe>>prelimcheckup.txt Find /I "MsMpEng.exe" "process2.txt" >nul && echo. Windows Defender MSMpEng.exe>>prelimcheckup.txt Find /I "MSASCui.exe" "process2.txt">nul && echo. Windows Defender MSASCui.exe>>prelimcheckup.txt Find /I "AAWService.exe" "process2.txt">nul && echo. Ad-Aware AAWService.exe>>prelimcheckup.txt Find /I "AAWTray.exe" "process2.txt">nul && echo. Ad-Aware AAWTray.exe>>prelimcheckup.txt Find /I "Ad-Aware" "install.txt">nul || goto adawareskip Find /I "AAWService.exe" "prelimcheckup.txt">nul || echo. Ad-Aware AAWService.exe is disabled!>>prelimcheckup.txt Find /I "AAWTray.exe" "prelimcheckup.txt">nul || echo. Ad-Aware AAWTray.exe is disabled!>>prelimcheckup.txt :adawareskip Find /I "winpatrol.exe" "process2.txt">nul && echo. WinPatrol winpatrol.exe>>prelimcheckup.txt Find /I "WinPatrol" "install.txt">nul || goto winpatrolskip Find /I "winpatrol.exe" "prelimcheckup.txt">nul || echo. WinPatrol winpatrol.exe is disabled!>>prelimcheckup.txt :winpatrolskip FIND /I "egui.exe" "process2.txt">nul && echo. ESET NOD32 Antivirus egui.exe >>prelimcheckup.txt FIND /V /I "egui.exe" "process2.txt">process4.txt FIND /I "ekrn.exe" "process4.txt">nul && echo. ESET NOD32 Antivirus ekrn.exe >>prelimcheckup.txt FIND /V /I "ekrn.exe" "process4.txt">process5.txt FIND /I "MBAMservice" "process5.txt" >nul && echo. Malwarebytes Anti-Malware mbamservice.exe >>prelimcheckup.txt FIND /V /I "MBAMservice" "process5.txt">process6.txt FIND /I "MBAMgui" "process6.txt" >nul && echo. Malwarebytes Anti-Malware mbamgui.exe >>prelimcheckup.txt FIND /V /I "MBAMgui" "process6.txt">process7.txt FIND /I "mbam.exe" "process7.txt" >nul && echo. Malwarebytes Anti-Malware mbam.exe >>prelimcheckup.txt FIND /V /I "mbam.exe" "process7.txt">process8.txt FIND /I "Spybot" "process8.txt" >>prelimproccheck.txt && @FIND /I "teatimer" "prelimproccheck.txt">nul || echo. Spybot Teatimer.exe is disabled!>>prelimcheckup.txt Find /I "Spybot" "install.txt">nul || goto spybotskip "%cd%\other\SWreg.exe" query "HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects">BHO.txt find /I "53707962-6F74-2D53-2644-206D7942484F" BHO.txt>nul && echo Spybot SDHelper Enabled>>prelimproccheck.txt find /I "53707962-6F74-2D53-2644-206D7942484F" BHO.txt>nul || echo Spybot SDHelper is disabled!>>prelimproccheck.txt :spybotskip FIND /I "avgwdsvc.exe" "process8.txt">nul && echo. AVG avgwdsvc.exe>>prelimcheckup.txt FIND /V /I "avgwdsvc.exe" "process8.txt">process9.txt FIND /I "avgtray.exe" "process9.txt">nul && echo. AVG avgtray.exe>>prelimcheckup.txt FIND /V /I "avgtray.exe" "process9.txt">process10.txt FIND /I "avgrsx.exe" "process10.txt">nul && echo. AVG avgrsx.exe>>prelimcheckup.txt FIND /V /I "avgrsx.exe" "process10.txt">process11.txt FIND /I "avgnsx.exe" "process11.txt">nul && echo. AVG avgnsx.exe>>prelimcheckup.txt FIND /V /I "avgnsx.exe" "process11.txt">process12.txt FIND /I "avgemc.exe" "process12.txt">nul && echo. AVG avgemc.exe>>prelimcheckup.txt FIND /V /I "avgemc.exe" "process12.txt">process13.txt FIND /I "avgcsrvx.exe" "process13.txt">nul && echo. AVG avgemc.exe>>prelimcheckup.txt FIND /V /I "avgcsrvx.exe" "process13.txt">process14.txt FIND /I "avgnt.exe" "process14.txt">nul && echo. Avira Antivir avgnt.exe>>prelimcheckup.txt FIND /V /I "avgnt.exe" "process14.txt">process15.txt FIND /I "avguard.exe" "process15.txt">nul && echo. Avira Antivir avguard.exe>>prelimcheckup.txt FIND /V /I "avguard.exe" "process15.txt">process16.txt FIND /I "persfw.exe" "process16.txt">nul && echo. Kerio Personal Firewall persfw.exe End of life! >>prelimcheckup.txt FIND /V /I "persfw.exe" "process16.txt">process17.txt FIND /I "OAcat.exe" "process17.txt">nul && echo. Tall Emu Online Armor OAcat.exe>>prelimcheckup.txt FIND /V /I "OAcat.exe" "process17.txt">process18.txt FIND /I "oasrv.exe" "process18.txt">nul && echo. Tall Emu Online Armor oasrv.exe>>prelimcheckup.txt FIND /V /I "oasrv.exe" "process18.txt">process19.txt FIND /I "oaui.exe" "process19.txt">nul && echo. Tall Emu Online Armor oaui.exe>>prelimcheckup.txt FIND /V /I "oaui.exe" "process19.txt">process20.txt FIND /I "OAhlp.exe" "process20.txt">nul && echo. Tall Emu Online Armor OAhlp.exe>>prelimcheckup.txt FIND /V /I "OAhlp.exe" "process20.txt">process21.txt FIND /I "pccntmon.exe" "process21.txt">nul && echo. Trend Micro OfficeScan Client pccntmon.exe>>prelimcheckup.txt FIND /V /I "pccntmon.exe" "process21.txt">process22.txt FIND /I "aswUpdSv.exe" "process22.txt">nul && echo. Alwil Software Avast4 aswUpdSv.exe>>prelimcheckup.txt FIND /V /I "aswUpdSv.exe" "process22.txt">process23.txt FIND /I "ashServ.exe" "process23.txt">nul && echo. Alwil Software Avast4 ashServ.exe>>prelimcheckup.txt FIND /V /I "ashServ.exe" "process23.txt">process24.txt FIND /I "ashDisp.exe" "process24.txt">nul && echo. Alwil Software Avast4 ashDisp.exe>>prelimcheckup.txt FIND /V /I "ashDisp.exe" "process24.txt">process25.txt FIND /I "ashMaiSv.exe" "process25.txt">nul && echo. Alwil Software Avast4 ashMaiSv.exe>>prelimcheckup.txt FIND /V /I "ashMaiSv.exe" "process25.txt">process26.txt FIND /I "ashWebSv.exe" "process26.txt">nul && echo. Alwil Software Avast4 ashWebSv.exe>>prelimcheckup.txt FIND /V /I "ashWebSv.exe" "process26.txt">process27.txt FIND /I "TFTray.exe" "process27.txt">nul && echo. ThreatFire TFTray.exe>>prelimcheckup.txt FIND /V /I "TFTray.exe" "process27.txt">process28.txt FIND /I "TFService.exe" "process28.txt">nul && echo. ThreatFire TFService.exe>>prelimcheckup.txt FIND /V /I "TFService.exe" "process28.txt">process29.txt FIND /I "SbPFLnch.exe" "process29.txt">nul && echo. Sunbelt Software Personal Firewall SbPFLnch.exe End of life! >>prelimcheckup.txt FIND /V /I "SbPFLnch.exe" "process29.txt">process30.txt FIND /I "SbPFSvc.exe" "process30.txt">nul && echo. Sunbelt Software Personal Firewall SbPFSvc.exe End of life! >>prelimcheckup.txt FIND /V /I "SbPFSvc.exe" "process30.txt">process31.txt FIND /I "SbPFCl.exe" "process31.txt">nul && echo. Sunbelt Software Personal Firewall SbPFCl.exe End of life! >>prelimcheckup.txt FIND /V /I "SbPFCl.exe" "process31.txt">process32.txt FIND /I "cmdagent.exe" "process32.txt">nul && echo. Comodo Firewall cmdagent.exe>>prelimcheckup.txt FIND /V /I "cmdagent.exe" "process32.txt">process33.txt FIND /I "cfp.exe" "process33.txt">nul && echo. Comodo Firewall cfp.exe>>prelimcheckup.txt FIND /V /I "cfp.exe" "process33.txt">process34.txt FIND /I "PF6.exe" "process34.txt">nul && echo. Privatefirewall 6.1 PF6.exe>>prelimcheckup.txt FIND /V /I "PF6.exe" "process34.txt">process35.txt FIND /I "pfsvc.exe" "process35.txt">nul && echo. Privatefirewall 6.1 pfsvc.exe >>prelimcheckup.txt FIND /V /I "pfsvc.exe" "process35.txt">process36.txt FIND /I "virus" "process36.txt" >prelimproccheck.txt FIND /V /I "virus" "process36.txt" >process37.txt FIND /I "ESET" "process37.txt" >>prelimproccheck.txt FIND /V /I "ESET" "process37.txt" >process38.txt FIND /I "mal" "process38.txt" >>prelimproccheck.txt FIND /V /I "mal" "process38.txt" >process39.txt FIND /I "firewall" "process39.txt" >>prelimproccheck.txt FIND /V /I "firewall" "process39.txt" >process40.txt FIND /I "defend" "process40.txt" >>prelimproccheck.txt FIND /I "online" "process40.txt" >>prelimproccheck.txt FIND /I "avast" "process40.txt" >>prelimproccheck.txt FIND /I "Kaspersky" "process40.txt" >>prelimproccheck.txt FIND /I "patrol" "process40.txt" >>prelimproccheck.txt FIND /I "threat" "process40.txt" >>prelimproccheck.txt FIND /I "ZoneAlarm" "process40.txt" >>prelimproccheck.txt FIND /I "etrust" "process40.txt" >>prelimproccheck.txt FIND /I "trend" "process40.txt" >>prelimproccheck.txt FIND /I "iolo" "process40.txt" >>prelimproccheck.txt @FOR /F "eol=- tokens=3-5* delims=\" %%w in (prelimproccheck.txt) do @echo. %%w %%x %%y %%z>>prelimcheckup.txt FIND /V /I "horse" "prelimcheckup.txt" >"notcheckup.txt" FIND /V /I "oblivion" "notcheckup.txt" >"notcheckup2.txt" FIND /V /I "Uniblue" "notcheckup2.txt" >"notcheckup3.txt" FIND /V /I "Fujitsu" "notcheckup3.txt" >"notcheckup4.txt" FIND /V /I "CreativeSetup" "notcheckup4.txt" >"notcheckup5.txt" FIND /V /I "Booster" "notcheckup5.txt" >"notcheckup6.txt" FIND /V /I "scannercopy" "notcheckup6.txt" >"notcheckup7.txt" FIND /V /I "Ghostscript" "notcheckup7.txt" >"notcheckup8.txt" FIND /V /I "Microsoft Office" "notcheckup8.txt" >"notcheckup9.txt" FIND /V /I "clock" "notcheckup9.txt" >"notcheckup10.txt" FIND /V /I "gigalarm" "notcheckup10.txt" >"notcheckup11.txt" FIND /V /I "Recorder" "notcheckup11.txt" >"notcheckup12.txt" FIND /V /I "dell" "notcheckup12.txt" >"notcheckup13.txt" FIND /V /I "GameSpy" "notcheckup13.txt" >"notcheckup14.txt" FIND /V /I "Photo" "notcheckup14.txt" >"notcheckup15.txt" FIND /V /I "UltraISO" "notcheckup15.txt" >"notcheckup16.txt" FIND /V /I "Acer" "notcheckup16.txt" >"notcheckup17.txt" FIND /V /I "TRENDnet" "notcheckup17.txt" >"notcheckup18.txt" FIND /V /I "Nero" "notcheckup18.txt" >"notcheckup19.txt" FIND /V /I "LinkScanner" "notcheckup19.txt" >"notcheckup20.txt" FIND /V /I "iesetup" "notcheckup20.txt" >"notcheckup21.txt" FIND /V /I "Course" "notcheckup21.txt" >"notcheckup22.txt" FIND /V /I "Picture" "notcheckup22.txt" >"notcheckup23.txt" FIND /V /I "CS4" "notcheckup23.txt" >"notcheckup24.txt" FIND /V /I "OneCare Safety Scanner" "notcheckup24.txt" >"notcheckup25.txt" FIND /V /I "Java Auto Updater" "notcheckup25.txt" >"notcheckup26.txt" FIND /V /I "Mansion" "notcheckup26.txt" >"notcheckup27.txt" FIND /V /I "Sitemap" "notcheckup27.txt" >"notcheckup28.txt" FIND /V /I "VisualElementsManifest" "notcheckup28.txt" >"notcheckup29.txt" FIND /V /I "Strongvault" "notcheckup29.txt" >"notcheckup30.txt" FIND /V /I "Java Web Start" "notcheckup30.txt" >"notcheckup31.txt" FIND /V /I "SpyParty" "notcheckup31.txt" >"notcheckup32.txt" @FOR /F "eol=- tokens=* delims=" %%t in (notcheckup32.txt) do @echo %%t >>prelimcheckup2.txt cls echo. echo. echo. echo. echo. echo. echo. echo. ``Process Check Done!`` cls echo. echo. echo. echo. echo. echo. echo. echo. ``Performing System Health Check`` echo.`````````````````System Health check````````````````` >>prelimcheckup2.txt :FRAGMENTATIONCHECK if exist "%systemdrive%\program files (x86)" goto x64defrag find /I "Windows 7" prelimcheckup2.txt>nul && goto defrag7x86 find /I "Windows Vista" prelimcheckup2.txt>nul && goto defragVistax86 :defragXPx86 @Defrag.exe %systemdrive% /a >defragcheck.txt find /I "Total" defragcheck.txt>defragcheck2.txt @For /f "eol=- tokens=1-8* delims= " %%a in (defragcheck2.txt) do echo.%%h>defragcheck3.txt && set fragmentation=%%h @For /f "eol=- tokens=1-2 delims=%%" %%a in (defragcheck3.txt) do echo.%%a>defragcheck4.txt @For /f "eol=- tokens=*"if %%a in (defragcheck4.txt) do if %%a gtr 10 set fragstatus=Defragment your hard drive soon^! (Do NOT defrag if SSD^!) echo. Total Fragmentation on Drive %systemdrive%: %fragmentation% %fragstatus%>>prelimcheckup2.txt ) goto checkupopen :defragVistax86 @Defrag.exe %systemdrive% /a >defragcheck.txt find /I "Percent file fragmentation" defragcheck.txt>defragcheck2.txt @For /f "eol=- tokens=1-8* delims= " %%a in (defragcheck2.txt) do echo.%%e>defragcheck3.txt && set fragmentation=%%e @For /f "eol=- tokens=1-2* delims=%%" %%a in (defragcheck3.txt) do echo.%%a>defragcheck4.txt @For /f "eol=- tokens=*" %%a in (defragcheck4.txt) do if %%a gtr 10 set fragstatus=Defragment your hard drive soon^! (Do NOT defrag if SSD^!) echo. Total Fragmentation on Drive %systemdrive% %fragmentation% ^%% %fragstatus%>>prelimcheckup2.txt ) goto checkupopen :defrag7x86 @Defrag.exe %systemdrive% /a >defragcheck.txt find /I "Total fragmented space" defragcheck.txt>defragcheck2.txt @For /f "eol=- tokens=1-8* delims= " %%a in (defragcheck2.txt) do echo.%%e>defragcheck3.txt && set fragmentation=%%e @For /f "eol=- tokens=1-2* delims=%%" %%a in (defragcheck3.txt) do echo.%%a>defragcheck4.txt @For /f "eol=- tokens=*" %%a in (defragcheck4.txt) do if %%a gtr 10 set fragstatus=Defragment your hard drive soon^! (Do NOT defrag if SSD^!) echo. Total Fragmentation on Drive %systemdrive% %fragmentation% %fragstatus%>>prelimcheckup2.txt ) goto checkupopen :x64defrag find /I "Windows 7" prelimcheckup2.txt>nul && goto defrag7x64 :defragVistax64 "%windir%\sysnative\Defrag.exe" %systemdrive% /a >defragcheck.txt find /I "Percent file fragmentation" defragcheck.txt>defragcheck2.txt @For /f "eol=- tokens=1-8* delims= " %%a in (defragcheck2.txt) do echo.%%e>defragcheck3.txt && set fragmentation=%%e @For /f "eol=- tokens=1-2* delims=%%" %%a in (defragcheck3.txt) do echo.%%a>defragcheck4.txt @For /f "eol=- tokens=*" %%a in (defragcheck4.txt) do if %%a gtr 10 set fragstatus=Defragment your hard drive soon^! (Do NOT defrag if SSD^!) echo. Total Fragmentation on Drive %systemdrive% %fragmentation% ^%% %fragstatus%>>prelimcheckup2.txt ) goto checkupopen :defrag7x64 "%windir%\sysnative\Defrag.exe" %systemdrive% /a >defragcheck.txt find /I "Total" defragcheck.txt>defragcheck2.txt @For /f "eol=- tokens=1-8* delims= " %%a in (defragcheck2.txt) do echo.%%e>defragcheck3.txt && set fragmentation=%%e @For /f "eol=- tokens=1-2* delims=%%" %%a in (defragcheck3.txt) do echo.%%a>defragcheck4.txt @For /f "eol=- tokens=*" %%a in (defragcheck4.txt) do if %%a gtr 10 set fragstatus=Defragment your hard drive soon^! (Do NOT defrag if SSD^!) echo. Total Fragmentation on Drive %systemdrive% %fragmentation% %fragstatus%>>prelimcheckup2.txt ) :checkupopen @echo. cls echo. echo. echo. echo. echo. echo. echo. echo. Results have been copied to checkup.txt, which should open... now! echo.````````````````````End of Log`````````````````````` >>prelimcheckup2.txt "%cd%\Other\sed.exe" "$!N;/^\(.*\)\n\1$/!P;D" prelimcheckup2.txt>prelimcheckup3.txt "%cd%\Other\sed.exe" -n "G; s/\n/&&/; /^\([ -~]*\n\).*\n\1/d; s/\n//; h; P" prelimcheckup3.txt>checkup.txt :preend if exist "%programfiles%\Notepad++\notepad++.exe" ( "%programfiles%\Notepad++\notepad++.exe" checkup.txt ) else ( NOTEPAD checkup.txt ) :finalcleanup @if exist "install.txt" del "*.txt" :end |
13.03.2014, 08:43 | #6 |
/// the machine /// TB-Ausbilder | unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view Ignorier Securitycheck, das ist ne Zicke. Mach einfach weiter mit dem Rest
__________________ --> unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view |
13.03.2014, 19:01 | #7 |
| unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view ... und noch die frst.txt ... lg ruedi FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2014 02 Ran by BTA_AW- (administrator) on ASUSLAPTOPRUEDI on 13-03-2014 18:59:13 Running from G:\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\sched.exe (ABBYY) D:\Abby\ABBYY FineReader 11\NetworkLicenseServer.exe (ABBYY) D:\Abby\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe () D:\Sony Ericsson PC Suite\SupServ.exe () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (VMware, Inc.) D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avshadow.exe (Dropbox, Inc.) C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Swisscom) C:\Program Files (x86)\Swisscom\Quick Help\SwisscomQuickHelp.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (Apple Inc.) D:\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE (Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avwebg7.exe (Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Mozilla Corporation) D:\Mozilla\Firefox\firefox.exe (Mozilla Corporation) D:\Mozilla\Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Avira Operations GmbH & Co. KG) D:\avira\antivir desktop\avcenter.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] () HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.) HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.) HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.) HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation) HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2010-06-25] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS) HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-07-02] () HKLM-x32\...\Run: [IJNetworkScanUtility] - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [128608 2007-06-17] (CANON INC.) HKLM-x32\...\Run: [Ulead AutoDetector v2] - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe [95504 2007-08-02] (Ulead Systems, Inc.) HKLM-x32\...\Run: [KeePass 2 PreLoad] - D:\KeePass_Password_Safe_2\KeePass.exe [1960448 2013-04-05] (Dominik Reichl) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [468112 2011-07-25] (CANON INC.) HKLM-x32\...\Run: [Swisscom Quick Help] - C:\Program Files (x86)\Swisscom\Quick Help\SwisscomQuickHelp.exe [16668080 2013-10-02] (Swisscom) HKLM-x32\...\Run: [Bonus.SSR.FR11] - D:\Abby\ABBYY FineReader 11\Bonus.ScreenshotReader.exe [933640 2012-01-19] (ABBYY.) HKLM-x32\...\Run: [avgnt] - D:\Avira\AntiVir Desktop\avgnt.exe [689744 2014-03-06] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-30] (Google Inc.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.) HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\MountPoints2: {b5768a9b-0660-11e2-8ddb-bcaec5d1b9aa} - F:\Start.exe HKU\S-1-5-21-2957650136-178916342-3901743012-1000\...\MountPoints2: {cac55c9c-8b29-11e2-8d0d-bcaec5d1b9aa} - H:\DTVP_Launcher.exe Startup: C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\BTA_AW-\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk ShortcutTarget: Logitech . Produktregistrierung.lnk -> C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) DPF: HKLM-x32 {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} C:\Users\BTA_AW-\AppData\Local\Temp\f5tmp\f5tunsrv.cab DPF: HKLM-x32 {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\BTA-AD~1\AppData\Local\Temp\IXP000.TMP\InstallerControl.cab#-1,-1,-1,-1 DPF: HKLM-x32 {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\BTA-AD~1\AppData\Local\Temp\f5tmp\urxhost.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default FF SearchEngineOrder.1: Ask Search FF Homepage: hxxp://www.evwe.ch FF NetworkProxy: "gopher", "" FF NetworkProxy: "gopher_port", "" FF NetworkProxy: "no_proxies_on", "" FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nielsen/FirefoxTracker - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter3\FirefoxAddOns\npfirefoxtracker.dll No File FF Plugin-x32: @photodex.com/PhotodexPresenter - C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll ( ) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\searchplugins\webde-suche.xml FF Extension: Swisscom Quick Help - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{6A6114A5-EEF5-45F4-BCD1-B00A7B33E04B} [2012-03-02] FF Extension: F5 Networks Host Plugin - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{DBBB3167-6E81-400f-BBFD-BD8921726F52} [2013-03-07] FF Extension: PlugIn-Checker - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\jid0-c1av474BVPIHcGJfBp3GkhlhAa4@jetpack.xpi [2013-01-21] FF Extension: FireFTP - C:\Users\BTA_AW-\AppData\Roaming\Mozilla\Firefox\Profiles\tmbhns0h.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2012-01-10] FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter3\FirefoxAddOns\netsight@nielsen.xpi FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-27] FF StartMenuInternet: FIREFOX.EXE - D:\Mozilla\Firefox\firefox.exe Chrome: ======= CHR HomePage: hxxp://www.google.com CHR RestoreOnStartup: "sync": { "suppress_start" CHR DefaultSearchProvider: Web CHR DefaultSearchURL: hxxp://www.google.com CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoftî Windows Media Player Firefox Plugin) - D:\Mozilla\Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - D:\Mozilla\Firefox\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility for IJ) - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.1.7\\npsitesafety.dll No File CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File CHR Plugin: (Photodex Presenter Plugin) - C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll ( ) CHR Plugin: (Windows LiveàPhoto Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File CHR Plugin: (iTunes Application Detector) - D:\iTunes\Mozilla Plugins\npitunes.dll () CHR Extension: (Angry Birds) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2013-11-20] CHR Extension: (Google Docs) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-04] CHR Extension: (Google Drive) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-04] CHR Extension: (Media View) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbaaiomfhenjhdipickmlehebkdcjick [2014-02-27] CHR Extension: (YouTube) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-04] CHR Extension: (Webexp Enhanced) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\bppabjgmhimmgdcnomenfdljlfekjpbo [2013-12-20] CHR Extension: (Google-Suche) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-04] CHR Extension: (Logitech Smooth Scrolling) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-02-27] CHR Extension: (FTP Free) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehdgcfaoankkonoiichmblcfijkomfbn [2013-06-04] CHR Extension: (Media Viewer) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\makliajhfiphjkjildjcahgnoimipiag [2014-02-23] CHR Extension: (Google Wallet) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30] CHR Extension: (Google Mail) - C:\Users\BTA_AW-\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-04] CHR HKLM-x32\...\Chrome\Extension: [bbaaiomfhenjhdipickmlehebkdcjick] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha1870\ch\MediaViewV1alpha1870.crx [2013-06-04] CHR HKLM-x32\...\Chrome\Extension: [bppabjgmhimmgdcnomenfdljlfekjpbo] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha335\ch\WebexpEnhancedV1alpha335.crx [2013-06-04] CHR HKLM-x32\...\Chrome\Extension: [makliajhfiphjkjildjcahgnoimipiag] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1471\ch\MediaViewerV1alpha1471.crx [2013-06-04] ==================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Professional.11.0; D:\Abby\ABBYY FineReader 11\NetworkLicenseServer.exe [818952 2011-12-22] (ABBYY) R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; D:\Abby\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2010-02-01] (ABBYY) R2 AntiVirMailService; D:\Avira\AntiVir Desktop\avmailc7.exe [910416 2014-03-06] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; D:\Avira\AntiVir Desktop\sched.exe [440400 2014-03-06] (Avira Operations GmbH & Co. KG) R2 AntiVirService; D:\Avira\AntiVir Desktop\avguard.exe [440400 2014-03-06] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; D:\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-03-06] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 OMSI download service; D:\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] () R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] () R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () R2 vmware-converter-agent; D:\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [423576 2012-10-15] (VMware, Inc.) R2 vmware-converter-server; D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [423576 2012-10-15] (VMware, Inc.) R2 vmware-converter-worker; D:\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [423576 2012-10-15] (VMware, Inc.) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-12] (Avira Operations GmbH & Co. KG) S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [74352 2011-03-15] (VMware, Inc.) R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527872 2007-11-08] (PixArt Imaging Inc.) S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-01-14] (RapidSolution Software AG) R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-01-14] (RapidSolution Software AG) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation) R3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2008-01-09] (Sony Ericsson Mobile Communications) R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] () R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] () U3 tmlwf; U3 tmwfp; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-12 06:50 - 2014-03-12 06:26 - 00987442 _____ () C:\Users\BTA_AW-\Desktop\SecurityCheck.exe 2014-03-12 06:12 - 2014-03-12 06:12 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2014-03-10 12:10 - 2014-03-10 12:39 - 00000000 ____D () C:\AdwCleaner 2014-03-09 23:57 - 2014-03-09 23:57 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-09 23:57 - 2014-03-09 23:57 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-09 23:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-06 20:50 - 2014-03-06 20:50 - 00002702 _____ () C:\Users\BTA_AW-\.recently-used.xbel 2014-03-05 12:25 - 2014-03-05 12:25 - 00001449 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-03-05 12:24 - 2014-03-05 12:25 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-03-05 12:24 - 2014-03-05 12:25 - 00000000 ____D () C:\Program Files\iTunes 2014-03-05 12:24 - 2014-03-05 12:24 - 00000000 ____D () C:\Program Files\iPod 2014-03-05 12:18 - 2014-03-05 12:18 - 00001851 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-03-05 12:18 - 2014-03-05 12:18 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-03-04 00:20 - 2014-03-13 18:59 - 00000000 ____D () C:\FRST 2014-03-04 00:16 - 2014-03-10 13:21 - 00000000 ____D () C:\Users\BTA_AW-\Desktop\Logs_TrBo 2014-03-04 00:04 - 2014-03-04 00:04 - 00000000 _____ () C:\Users\BTA_AW-\defogger_reenable 2014-03-03 20:54 - 2014-03-03 21:05 - 00921632 _____ () C:\PA7302.DAT 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Windows\PixArt 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files (x86)\PixArt 2014-03-03 20:49 - 2008-04-11 19:10 - 00000566 _____ () C:\Windows\SysWOW64\SP7302.ini 2014-03-03 20:49 - 2007-11-20 17:58 - 00055296 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\Remove.exe 2014-03-03 20:49 - 2007-11-08 10:29 - 00527872 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS 2014-03-03 20:49 - 2007-11-02 11:07 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_071029.dll 2014-03-03 20:49 - 2007-10-30 17:48 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax 2014-03-03 20:49 - 2007-03-21 11:25 - 00000291 _____ () C:\Windows\SysWOW64\Remover.ini 2014-03-03 20:49 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll 2014-03-03 20:46 - 2014-03-03 20:46 - 00000000 ____D () C:\Users\Public\Documents\USB_CAM 2014-03-03 07:18 - 2014-03-03 07:18 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Skype 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\Public\Documents\Logishrd 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logitech 2014-02-27 23:25 - 2014-02-27 23:25 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Leadertech 2014-02-27 23:24 - 2014-02-27 23:26 - 00000860 _____ () C:\Windows\LkmdfCoInst.log 2014-02-27 23:24 - 2014-02-27 23:25 - 00007290 _____ () C:\Windows\LDPINST.LOG 2014-02-27 23:24 - 2014-02-27 23:24 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-02-27 23:23 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logishrd 2014-02-27 23:23 - 2014-02-27 23:25 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-02-27 23:23 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Logitech 2014-02-27 23:20 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logitech 2014-02-27 23:20 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logishrd 2014-02-27 23:09 - 2014-03-10 06:45 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1 2014-02-27 23:09 - 2014-02-27 23:09 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-25 07:19 - 2014-03-10 00:33 - 00000000 ____D () C:\Program Files (x86)\LPT 2014-02-25 07:16 - 2014-02-25 07:16 - 00001564 _____ () C:\Users\Public\Desktop\Google SketchUp 8.lnk 2014-02-25 07:14 - 2014-02-25 07:14 - 47054016 _____ (Google Inc.) C:\Users\BTA_AW-\Desktop\GoogleSketchUpWDE_8.0.4811.exe 2014-02-23 23:09 - 2014-03-10 06:45 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-13 23:28 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-13 23:28 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-13 23:27 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-13 23:27 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-13 23:27 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-13 23:27 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-13 23:27 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-13 23:27 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-13 23:27 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-13 23:27 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-13 23:27 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-13 23:27 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-13 23:27 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-13 23:27 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-13 23:27 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-13 23:27 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-13 23:27 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-13 23:27 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-13 23:27 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-13 23:27 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-13 23:27 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-13 23:27 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-13 23:27 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-13 23:27 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-13 23:27 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-13 23:27 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-13 23:27 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-13 23:27 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-13 23:27 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-13 23:27 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-13 23:27 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-13 23:27 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-13 23:27 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-13 23:27 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-13 23:27 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-13 23:27 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-13 23:27 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-13 23:27 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-13 23:27 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-13 23:27 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-13 23:27 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-13 22:49 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-13 22:49 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-13 22:49 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-13 22:49 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-13 22:49 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-13 22:49 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-13 22:49 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-13 22:49 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-13 22:49 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-13 22:49 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-13 22:49 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-13 22:49 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-13 22:49 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-13 22:49 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-13 22:49 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-13 22:49 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-13 22:49 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-13 22:49 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-13 22:49 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll ==================== One Month Modified Files and Folders ======= 2014-03-13 18:59 - 2014-03-04 00:20 - 00000000 ____D () C:\FRST 2014-03-13 18:44 - 2011-11-30 00:50 - 00000000 ____D () C:\Users\BTA_AW-\Documents\Outlook-Dateien 2014-03-13 18:41 - 2012-09-20 01:06 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-13 18:41 - 2012-09-20 01:06 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-13 18:33 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-13 18:33 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-13 18:26 - 2013-08-15 16:15 - 00000000 ___RD () C:\Users\BTA_AW-\Dropbox 2014-03-13 18:26 - 2013-01-11 12:10 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Dropbox 2014-03-13 18:26 - 2011-12-29 22:51 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Skype 2014-03-13 18:25 - 2014-01-31 09:32 - 00004070 _____ () C:\Windows\setupact.log 2014-03-13 18:25 - 2013-06-16 13:18 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2014-03-13 18:25 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-13 18:24 - 2014-02-05 14:37 - 00142390 _____ () C:\Windows\PFRO.log 2014-03-13 00:14 - 2011-01-30 22:59 - 01996289 _____ () C:\Windows\WindowsUpdate.log 2014-03-12 23:15 - 2012-08-17 19:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-12 06:26 - 2014-03-12 06:50 - 00987442 _____ () C:\Users\BTA_AW-\Desktop\SecurityCheck.exe 2014-03-12 06:12 - 2014-03-12 06:12 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2014-03-12 06:12 - 2012-08-17 19:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-12 06:12 - 2012-04-02 06:15 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-12 06:12 - 2011-06-08 16:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-11 17:28 - 2009-08-04 10:51 - 00708030 _____ () C:\Windows\system32\perfh007.dat 2014-03-11 17:28 - 2009-08-04 10:51 - 00153336 _____ () C:\Windows\system32\perfc007.dat 2014-03-11 17:28 - 2009-07-14 06:13 - 01642960 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-10 13:21 - 2014-03-04 00:16 - 00000000 ____D () C:\Users\BTA_AW-\Desktop\Logs_TrBo 2014-03-10 12:39 - 2014-03-10 12:10 - 00000000 ____D () C:\AdwCleaner 2014-03-10 06:45 - 2014-02-27 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewV1 2014-03-10 06:45 - 2014-02-23 23:09 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-03-10 00:33 - 2014-02-25 07:19 - 00000000 ____D () C:\Program Files (x86)\LPT 2014-03-09 23:57 - 2014-03-09 23:57 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-09 23:57 - 2014-03-09 23:57 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-07 15:47 - 2011-10-01 08:15 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\XnView 2014-03-06 20:50 - 2014-03-06 20:50 - 00002702 _____ () C:\Users\BTA_AW-\.recently-used.xbel 2014-03-06 20:50 - 2011-10-04 21:28 - 00000000 ____D () C:\Users\BTA_AW-\.gimp-2.6 2014-03-06 20:50 - 2011-03-23 14:16 - 00000000 ____D () C:\Users\BTA_AW- 2014-03-06 20:42 - 2011-10-04 21:31 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\gtk-2.0 2014-03-05 12:25 - 2014-03-05 12:25 - 00001449 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-03-05 12:25 - 2014-03-05 12:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-03-05 12:25 - 2014-03-05 12:24 - 00000000 ____D () C:\Program Files\iTunes 2014-03-05 12:24 - 2014-03-05 12:24 - 00000000 ____D () C:\Program Files\iPod 2014-03-05 12:18 - 2014-03-05 12:18 - 00001851 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-03-05 12:18 - 2014-03-05 12:18 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-03-05 12:16 - 2013-01-15 23:02 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-03-04 07:16 - 2011-01-30 23:48 - 00003308 _____ () C:\Windows\system32\AutoRunFilter.ini 2014-03-04 07:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-03-04 00:04 - 2014-03-04 00:04 - 00000000 _____ () C:\Users\BTA_AW-\defogger_reenable 2014-03-03 21:10 - 2009-07-14 03:34 - 00000761 _____ () C:\Windows\win.ini 2014-03-03 21:05 - 2014-03-03 20:54 - 00921632 _____ () C:\PA7302.DAT 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Windows\PixArt 2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files (x86)\PixArt 2014-03-03 20:49 - 2011-01-30 23:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-03-03 20:46 - 2014-03-03 20:46 - 00000000 ____D () C:\Users\Public\Documents\USB_CAM 2014-03-03 07:18 - 2014-03-03 07:18 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-03 07:18 - 2014-03-03 07:18 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Local\Skype 2014-03-03 07:18 - 2011-12-29 22:51 - 00000000 ____D () C:\ProgramData\Skype 2014-02-28 17:21 - 2011-01-30 23:48 - 00002498 _____ () C:\Windows\system32\ServiceFilter.ini 2014-02-27 23:30 - 2011-03-23 14:17 - 00000000 ___RD () C:\Users\BTA_AW-\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\Users\Public\Documents\Logishrd 2014-02-27 23:27 - 2014-02-27 23:27 - 00000000 ____D () C:\ProgramData\Logitech 2014-02-27 23:27 - 2014-02-27 23:23 - 00000000 ____D () C:\ProgramData\Logishrd 2014-02-27 23:27 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logitech 2014-02-27 23:26 - 2014-02-27 23:24 - 00000860 _____ () C:\Windows\LkmdfCoInst.log 2014-02-27 23:25 - 2014-02-27 23:25 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Leadertech 2014-02-27 23:25 - 2014-02-27 23:24 - 00007290 _____ () C:\Windows\LDPINST.LOG 2014-02-27 23:25 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-02-27 23:24 - 2014-02-27 23:24 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-02-27 23:23 - 2014-02-27 23:23 - 00000000 ____D () C:\Program Files\Logitech 2014-02-27 23:20 - 2014-02-27 23:20 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Logishrd 2014-02-27 23:09 - 2014-02-27 23:09 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-02-27 23:09 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-02-27 23:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-02-27 18:58 - 2011-03-25 08:08 - 01617240 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-25 07:24 - 2013-06-03 16:28 - 00000000 ____D () C:\Users\BTA_AW-\AppData\Roaming\Google 2014-02-25 07:20 - 2011-01-30 23:18 - 00000000 ____D () C:\ProgramData\Google 2014-02-25 07:16 - 2014-02-25 07:16 - 00001564 _____ () C:\Users\Public\Desktop\Google SketchUp 8.lnk 2014-02-25 07:14 - 2014-02-25 07:14 - 47054016 _____ (Google Inc.) C:\Users\BTA_AW-\Desktop\GoogleSketchUpWDE_8.0.4811.exe 2014-02-17 12:50 - 2013-08-14 12:43 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 12:42 - 2011-03-25 11:10 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-14 07:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-13 23:40 - 2011-03-24 16:05 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-12 18:36 - 2012-05-11 13:01 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-02-12 18:36 - 2012-05-11 13:01 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore Files to move or delete: ==================== C:\ProgramData\hpe8111.dll C:\ProgramData\PKP_DLes.DAT C:\ProgramData\PKP_DLet.DAT C:\ProgramData\PKP_DLev.DAT Some content of TEMP: ==================== C:\Users\BTA-User\AppData\Local\Temp\avgnt.exe C:\Users\BTA_AW-\AppData\Local\Temp\avgnt.exe C:\Users\BTA_AW-\AppData\Local\Temp\Installer.exe C:\Users\BTA_AW-\AppData\Local\Temp\LMkRstPt.exe C:\Users\BTA_AW-\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-10 07:21 ==================== End Of Log ============================ |
14.03.2014, 12:31 | #8 |
/// the machine /// TB-Ausbilder | unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
14.03.2014, 17:12 | #9 |
| unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view hatte grad noch etwas lange zum starten, kann aber sein dass es wegen win-updates war. soll ich die andern beiden pc's im netzwerk auch säubern, wie soll ich dabei vorgehen? herzlichen dank für deine hilfe!! Lg ruedi |
15.03.2014, 11:55 | #10 |
/// the machine /// TB-Ausbilder | unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view poste von den andern einfach mal FRST logfiles. Für hier: Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu unerwünschte Toolbar und Werbung in Firefox und IE, Snap.Do, better surf, media view |
amonetize, antivir, avira, better surf, bonjour, browser, canon, converter, desktop, entfernen, error, excel, fehler, firefox, flash player, google, help, home, homepage, installation, media view, mozilla, registry, rundll, secure search, security, sketchup, smartbar, snap.do, svchost.exe, system, unerwünschte werbung, usb, vtoolbarupdater, werbung |