| |
| |||||||
Log-Analyse und Auswertung: Pc langsamer/PUP viren bei jedem scan/bluescreens abundzuWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
01.06.2014, 17:17
| #1 |
| |  Pc langsamer/PUP viren bei jedem scan/bluescreens abundzu Hallo, habe folgendes Problem. Mein Computer wird immer langsamer und hängt sich des öfteren auf. Außerdem steht jetzt unten rechts , dass die Echtheit meiner Windows-Kopie noch nicht bestätigt wurde. Hängt das mit Viren zusammen? Die Bluescreen kommen meistens beim Start vom PC, dass heißt ich brauch öfters mal , mehrere Versuche den PC zu starten. Zudem friert der Bildschirm manchmal ein. Habe schon Malwarebytes und Avira durchscannen lassen . Haben beide Malware gefunden und in Quarantäne gesetzt. Seitdem findet Malwarebytes keine Malware mehr, jedoch taucht bei jedem Scan PUP.optional viren auf. Hier die jeweiligen Logfiles: FRST: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-06-2014 Ran by Aleksandar (administrator) on MEINPC on 01-06-2014 15:49:24 Running from C:\Users\Aleksandar\Downloads Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 7 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (ROCCAT GmbH) C:\Program Files\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Spotify Ltd) C:\Users\Aleksandar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe (pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe (TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737360 2014-04-29] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [RoccatKoneXTD] => C:\Program Files\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [552960 2013-07-30] (ROCCAT GmbH) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12017368 2013-10-24] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Policies\Explorer: [AllowLegacyWebView] 1 HKLM\...\Policies\Explorer: [AllowUnhashedWebView] 1 HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1803384891-385149007-3569804851-1000\...\Run: [Spotify Web Helper] => C:\Users\Aleksandar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-31] (Spotify Ltd) HKU\S-1-5-21-1803384891-385149007-3569804851-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21432 2012-08-07] () IFEO: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\kies.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\kies_2.3.2.12064_10_1.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\ntunecmd.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\nvcplui.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\nvprofile.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\setup.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\silverlight.configuration.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\skype.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" IFEO\spotify.exe: [Debugger] "C:\Program Files\TuneUp Utilities 2014\TUAutoReactivator32.exe" ==================== Internet (Whitelisted) ==================== ProxyServer: 13.7.9.139:80 HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?ch_id=sk27211&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ru.redirect.wrapper.services.alawar.com/startpage.php?lang=de&wspv=2.0&locale=de&pid=10360&country=DE URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File SearchScopes: HKLM - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825 SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825 SearchScopes: HKLM - {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKCU - DefaultScope {DCDBBF03-BC10-457D-911F-EFB0321D22BE} URL = ${SRCH_SCP_URL} SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=382E001D607F778C&affID=121564&tsp=4986 SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=a44d921b-fc45-4e75-934b-7e07c11d4e96&apn_sauid=37AEC6BB-7A0C-4B20-B457-3D50E6F5D31B SearchScopes: HKCU - {4327FABE-3C22-4689-8DBF-D226CF777FE9} URL = hxxp://www.searchplusnetwork.com/?sp=vit4&q={searchTerms} SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?ch_id=sk27211&q={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825 SearchScopes: HKCU - {BE28C22E-F666-424d-B5FD-125C4AFEE34E} URL = hxxp://search.myheritage.com?orig=ds&q={searchTerms} SearchScopes: HKCU - {DCDBBF03-BC10-457D-911F-EFB0321D22BE} URL = ${SRCH_SCP_URL} BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File Toolbar: HKLM - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - No File Toolbar: HKCU - No Name - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No File DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1381932464491 DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Winsock: Catalog9 01 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 02 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 03 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 04 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 05 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 06 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 18 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Winsock: Catalog9 19 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll [268832] (NVIDIA) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2 FireFox: ======== FF ProfilePath: C:\Users\Aleksandar\AppData\Roaming\Mozilla\Firefox\Profiles\7llg43ue.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1206147.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF user.js: detected! => C:\Users\Aleksandar\AppData\Roaming\Mozilla\Firefox\Profiles\7llg43ue.default\user.js FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Adobe PDF Viewer XI - C:\Users\Aleksandar\AppData\Roaming\Mozilla\Firefox\Profiles\7llg43ue.default\Extensions\adobepdfviewerxi@mozilla.org.xpi [2013-06-23] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-05-21] FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-02-21] Chrome: ======= CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll () CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) CHR Plugin: (DivX Plus Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll No File CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Java(TM) Platform SE 7 U45) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1206147.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Extension: (Google Docs) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-25] CHR Extension: (Google Drive) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-25] CHR Extension: (YouTube) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-25] CHR Extension: (Adblock Plus) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-25] CHR Extension: (Google-Suche) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-25] CHR Extension: (BrowseToolE0191) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngnjhfpfhadncgafgbneeljaginimmmk [2014-04-25] CHR Extension: (Google Wallet) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-25] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-04-25] CHR Extension: (Google Mail) - C:\Users\Aleksandar\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-25] CHR HKLM\...\Chrome\Extension: [bmbpbcpokffodhpcdjaoopolhdlbconi] - C:\Users\ALEKSA~1\AppData\Local\Temp\tbch.crx [2014-04-25] CHR HKLM\...\Chrome\Extension: [fealnpfjifonchkodiffbdkfaipmpkhe] - C:\Users\ALEKSA~1\AppData\Local\Temp\tbch.crx [2014-04-25] CHR HKLM\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\ALEKSA~1\AppData\Local\Temp\crxA806.tmp [2014-04-25] CHR HKLM\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\Aleksandar\AppData\Local\CRE\ngnjhfpfhadncgafgbneeljaginimmmk.crx [2012-08-14] CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] CHR HKLM\...\Chrome\Extension: [ofahndfepeaeelmhdkjiihmofnokhmik] - C:\Users\Aleksandar\AppData\Local\CRE\ofahndfepeaeelmhdkjiihmofnokhmik.crx [2011-12-12] CHR HKCU\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\Aleksandar\AppData\Local\CRE\ngnjhfpfhadncgafgbneeljaginimmmk.crx [2012-08-14] CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Aleksandar\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-10-08] CHR HKCU\...\Chrome\Extension: [ofahndfepeaeelmhdkjiihmofnokhmik] - C:\Users\Aleksandar\AppData\Local\CRE\ofahndfepeaeelmhdkjiihmofnokhmik.crx [2012-10-08] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-04-29] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1040464 2014-04-29] (Avira Operations GmbH & Co. KG) S3 Boonty Games; C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe [69120 2011-06-07] (BOONTY) S4 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [387616 2009-08-10] () S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation) S3 npggsvc; C:\Windows\system32\GameMon.des [4032992 2010-09-29] (INCA Internet Co., Ltd.) S4 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [178720 2009-08-10] () S4 nTuneService; C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe [192832 2011-09-19] (NVIDIA) R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH) R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1739576 2013-10-12] (TuneUp Software) S3 xsherlock; C:\Windows\system32\xsherlock.xem [666720 2012-11-11] (Wellbia.com Co., Ltd.) ==================== Drivers (Whitelisted) ==================== S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-19] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG) R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () S3 HabuFltr; C:\Windows\System32\drivers\habu.sys [27776 2006-10-23] (Razer (Asia-Pacific) Pte Ltd) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-01] (Malwarebytes Corporation) S3 MotioninJoyXFilter; C:\Windows\System32\DRIVERS\MijXfilt.sys [95304 2011-11-10] (MotioninJoy) S3 SCREAMINGBDRIVER; C:\Windows\System32\drivers\ScreamingBAudio.sys [34384 2009-11-26] (Screaming Bee LLC) R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-06] (Duplex Secure Ltd.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-06] (Avira GmbH) S3 TIEHDUSB; C:\Windows\System32\drivers\tiehdusb.sys [49536 2004-02-04] (Texas Instruments Incorporated) R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-09-18] (TuneUp Software) S3 uisp; C:\Windows\System32\Drivers\usbicp.sys [14592 2005-12-21] (Motorola) R3 WmBEnum; C:\Windows\System32\drivers\WmBEnum.sys [22856 2010-04-28] (Logitech Inc.) S3 WmFilter; C:\Windows\System32\drivers\WmFilter.sys [37704 2010-04-27] (Logitech Inc.) S3 WmHidLo; C:\Windows\System32\drivers\WmHidLo.sys [31816 2010-04-28] (Logitech Inc.) S3 WmVirHid; C:\Windows\System32\drivers\WmVirHid.sys [15048 2010-04-28] (Logitech Inc.) R3 WmXlCore; C:\Windows\System32\drivers\WmXlCore.sys [66632 2010-04-28] (Logitech Inc.) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x32.sys [X] S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [X] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X] S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X] S3 taphss6; system32\DRIVERS\taphss6.sys [X] S3 vtany; \??\C:\Windows\vtany.sys [X] S3 XDva349; \??\C:\Windows\system32\XDva349.sys [X] S3 XDva352; \??\C:\Windows\system32\XDva352.sys [X] S3 XDva370; \??\C:\Windows\system32\XDva370.sys [X] S3 XDva375; \??\C:\Windows\system32\XDva375.sys [X] S3 XDva391; \??\C:\Windows\system32\XDva391.sys [X] S3 XDva397; \??\C:\Windows\system32\XDva397.sys [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-01 15:49 - 2014-06-01 15:49 - 00025387 _____ () C:\Users\Aleksandar\Downloads\FRST.txt 2014-06-01 15:48 - 2014-06-01 15:49 - 00000000 ____D () C:\FRST 2014-06-01 15:48 - 2014-06-01 15:48 - 01057792 _____ (Farbar) C:\Users\Aleksandar\Downloads\FRST.exe 2014-06-01 15:41 - 2014-06-01 15:42 - 00000642 _____ () C:\Users\Aleksandar\Desktop\defogger_disable.log 2014-06-01 15:41 - 2014-06-01 15:42 - 00000020 _____ () C:\Users\Aleksandar\defogger_reenable 2014-06-01 15:40 - 2014-06-01 15:40 - 00050477 _____ () C:\Users\Aleksandar\Downloads\Defogger.exe 2014-05-31 20:59 - 2014-05-31 20:59 - 00001165 _____ () C:\Users\Aleksandar\Desktop\g.txt 2014-05-31 19:20 - 2014-05-31 19:24 - 00000000 ____D () C:\142e96473fea9ebe8be080dda6 2014-05-31 19:06 - 2014-05-31 19:06 - 00000000 ____D () C:\Windows\CheckSur 2014-05-31 19:05 - 2014-05-31 19:05 - 151879843 _____ () C:\Users\Aleksandar\Downloads\Windows6.0-KB947821-v34-x86.msu 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ___RD () C:\Program Files\Skype 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-05-31 17:47 - 2013-11-13 02:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-05-31 17:39 - 2014-04-29 15:10 - 03627520 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-31 17:39 - 2014-04-29 13:42 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-31 17:39 - 2014-02-27 19:24 - 01177600 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00671232 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-05-31 17:39 - 2014-02-27 19:24 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 06119424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-31 17:39 - 2014-02-27 19:23 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-05-31 17:39 - 2014-02-27 18:01 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-05-31 17:39 - 2014-02-07 12:38 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-05-31 17:39 - 2014-02-03 12:37 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-05-31 17:39 - 2013-12-13 04:13 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-31 17:39 - 2013-12-05 04:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-05-31 17:34 - 2014-02-06 03:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-05-31 17:29 - 2014-01-30 09:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-05-31 14:04 - 2014-06-01 15:00 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-31 14:04 - 2014-05-31 14:04 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 14:04 - 2014-05-31 14:04 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-05-31 14:04 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-31 14:04 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-31 14:04 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-31 03:40 - 2014-05-31 03:40 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-05-30 16:57 - 2014-05-30 16:57 - 00135216 _____ () C:\Windows\Minidump\Mini053014-01.dmp 2014-05-19 21:36 - 2014-05-19 21:36 - 00155600 _____ () C:\Windows\Minidump\Mini051914-03.dmp 2014-05-19 02:22 - 2014-05-19 02:22 - 00131072 _____ () C:\Windows\Minidump\Mini051914-02.dmp 2014-05-19 01:55 - 2014-05-19 01:55 - 00156848 _____ () C:\Windows\Minidump\Mini051914-01.dmp 2014-05-18 12:31 - 2014-05-18 12:31 - 00151520 _____ () C:\Windows\Minidump\Mini051814-04.dmp 2014-05-18 12:29 - 2014-05-18 12:29 - 00000000 __SHD () C:\found.007 2014-05-18 12:24 - 2014-05-18 12:24 - 00150800 _____ () C:\Windows\Minidump\Mini051814-03.dmp 2014-05-18 12:18 - 2014-05-18 12:19 - 00135216 _____ () C:\Windows\Minidump\Mini051814-02.dmp 2014-05-18 12:17 - 2014-05-18 12:17 - 00158936 _____ () C:\Windows\Minidump\Mini051814-01.dmp 2014-05-16 10:17 - 2014-05-16 10:17 - 00150800 _____ () C:\Windows\Minidump\Mini051614-05.dmp 2014-05-16 10:14 - 2014-05-16 10:14 - 00000000 _____ () C:\Windows\Minidump\Mini051614-04.dmp 2014-05-16 10:13 - 2014-05-16 10:13 - 00000000 _____ () C:\Windows\Minidump\Mini051614-03.dmp 2014-05-16 10:11 - 2014-05-16 10:11 - 00000000 _____ () C:\Windows\Minidump\Mini051614-02.dmp 2014-05-16 10:10 - 2014-05-16 10:10 - 00000000 _____ () C:\Windows\Minidump\Mini051614-01.dmp 2014-05-16 10:09 - 2014-05-30 17:04 - 266038759 _____ () C:\Windows\MEMORY.DMP ==================== One Month Modified Files and Folders ======= 2014-06-01 15:50 - 2010-06-02 20:29 - 00000428 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{23FB4D51-F66B-48B3-8D19-26C197F5C150}.job 2014-06-01 15:49 - 2014-06-01 15:49 - 00025387 _____ () C:\Users\Aleksandar\Downloads\FRST.txt 2014-06-01 15:49 - 2014-06-01 15:48 - 00000000 ____D () C:\FRST 2014-06-01 15:49 - 2010-06-01 21:09 - 00000000 ____D () C:\Users\Aleksandar\AppData\Local\Temp 2014-06-01 15:48 - 2014-06-01 15:48 - 01057792 _____ (Farbar) C:\Users\Aleksandar\Downloads\FRST.exe 2014-06-01 15:44 - 2014-04-25 03:37 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-06-01 15:44 - 2014-04-25 03:33 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-01 15:44 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-01 15:44 - 2006-11-02 14:47 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-01 15:44 - 2006-11-02 14:47 - 00004784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-01 15:43 - 2010-06-05 17:25 - 00000012 _____ () C:\Windows\bthservsdp.dat 2014-06-01 15:43 - 2006-11-02 15:01 - 00032586 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-06-01 15:43 - 2006-11-02 14:52 - 01294355 _____ () C:\Windows\WindowsUpdate.log 2014-06-01 15:42 - 2014-06-01 15:41 - 00000642 _____ () C:\Users\Aleksandar\Desktop\defogger_disable.log 2014-06-01 15:42 - 2014-06-01 15:41 - 00000020 _____ () C:\Users\Aleksandar\defogger_reenable 2014-06-01 15:41 - 2010-06-01 21:09 - 00000000 ____D () C:\Users\Aleksandar 2014-06-01 15:40 - 2014-06-01 15:40 - 00050477 _____ () C:\Users\Aleksandar\Downloads\Defogger.exe 2014-06-01 15:40 - 2013-07-04 19:55 - 00000000 ____D () C:\Users\Aleksandar\AppData\Roaming\OpenCandy 2014-06-01 15:38 - 2013-07-04 19:38 - 00000302 _____ () C:\Windows\Tasks\DSite.job 2014-06-01 15:00 - 2014-05-31 14:04 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-01 14:59 - 2014-04-25 03:33 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-01 11:43 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-06-01 02:46 - 2013-10-17 02:06 - 00000000 ____D () C:\Users\Aleksandar\AppData\Local\PMB Files 2014-06-01 02:08 - 2013-09-15 00:33 - 00000000 ____D () C:\Users\Aleksandar\AppData\Local\Spotify 2014-06-01 02:08 - 2013-09-15 00:32 - 00000000 ____D () C:\Users\Aleksandar\AppData\Roaming\Spotify 2014-05-31 20:59 - 2014-05-31 20:59 - 00001165 _____ () C:\Users\Aleksandar\Desktop\g.txt 2014-05-31 19:24 - 2014-05-31 19:20 - 00000000 ____D () C:\142e96473fea9ebe8be080dda6 2014-05-31 19:06 - 2014-05-31 19:06 - 00000000 ____D () C:\Windows\CheckSur 2014-05-31 19:05 - 2014-05-31 19:05 - 151879843 _____ () C:\Users\Aleksandar\Downloads\Windows6.0-KB947821-v34-x86.msu 2014-05-31 19:00 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache 2014-05-31 18:44 - 2014-02-14 12:25 - 03687624 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-05-31 18:42 - 2010-06-02 20:44 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ___RD () C:\Program Files\Skype 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-05-31 18:12 - 2014-05-31 18:12 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-05-31 18:12 - 2010-06-02 21:19 - 00000000 ____D () C:\ProgramData\Skype 2014-05-31 17:56 - 2013-09-12 02:56 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-31 17:51 - 2010-10-01 16:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-05-31 17:49 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\de-DE 2014-05-31 14:54 - 2013-07-25 06:58 - 00000000 ____D () C:\Users\Aleksandar\Desktop\I DONT KNOW WHAT THIS IS 2014-05-31 14:13 - 2012-04-28 00:06 - 00000000 ____D () C:\Users\Aleksandar\AppData\Roaming\loadtbs 2014-05-31 14:04 - 2014-05-31 14:04 - 00000899 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 14:04 - 2014-05-31 14:04 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-05-31 14:04 - 2013-10-16 00:36 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-31 03:40 - 2014-05-31 03:40 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-05-30 22:04 - 2014-04-25 03:33 - 00001963 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-30 17:04 - 2014-05-16 10:09 - 266038759 _____ () C:\Windows\MEMORY.DMP 2014-05-30 17:04 - 2010-07-03 11:16 - 00000000 ____D () C:\Windows\Minidump 2014-05-30 17:04 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\LogFiles 2014-05-30 17:00 - 2012-10-04 23:33 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-05-30 17:00 - 2011-07-31 14:17 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-05-30 16:57 - 2014-05-30 16:57 - 00135216 _____ () C:\Windows\Minidump\Mini053014-01.dmp 2014-05-30 16:54 - 2010-12-23 03:56 - 00000000 ____D () C:\Users\Aleksandar\AppData\Local\CrashDumps 2014-05-30 16:53 - 2014-03-14 00:00 - 00006346 _____ () C:\Windows\setupact.log 2014-05-30 16:53 - 2010-06-07 10:19 - 00246784 _____ () C:\Users\Aleksandar\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-05-19 21:36 - 2014-05-19 21:36 - 00155600 _____ () C:\Windows\Minidump\Mini051914-03.dmp 2014-05-19 02:22 - 2014-05-19 02:22 - 00131072 _____ () C:\Windows\Minidump\Mini051914-02.dmp 2014-05-19 01:55 - 2014-05-19 01:55 - 00156848 _____ () C:\Windows\Minidump\Mini051914-01.dmp 2014-05-18 12:31 - 2014-05-18 12:31 - 00151520 _____ () C:\Windows\Minidump\Mini051814-04.dmp 2014-05-18 12:29 - 2014-05-18 12:29 - 00000000 __SHD () C:\found.007 2014-05-18 12:24 - 2014-05-18 12:24 - 00150800 _____ () C:\Windows\Minidump\Mini051814-03.dmp 2014-05-18 12:19 - 2014-05-18 12:18 - 00135216 _____ () C:\Windows\Minidump\Mini051814-02.dmp 2014-05-18 12:17 - 2014-05-18 12:17 - 00158936 _____ () C:\Windows\Minidump\Mini051814-01.dmp 2014-05-18 12:16 - 2012-03-07 20:37 - 00000000 ____D () C:\ProgramData\TEMP 2014-05-16 10:17 - 2014-05-16 10:17 - 00150800 _____ () C:\Windows\Minidump\Mini051614-05.dmp 2014-05-16 10:14 - 2014-05-16 10:14 - 00000000 _____ () C:\Windows\Minidump\Mini051614-04.dmp 2014-05-16 10:13 - 2014-05-16 10:13 - 00000000 _____ () C:\Windows\Minidump\Mini051614-03.dmp 2014-05-16 10:11 - 2014-05-16 10:11 - 00000000 _____ () C:\Windows\Minidump\Mini051614-02.dmp 2014-05-16 10:10 - 2014-05-16 10:10 - 00000000 _____ () C:\Windows\Minidump\Mini051614-01.dmp 2014-05-12 07:26 - 2014-05-31 14:04 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-31 14:04 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:25 - 2014-05-31 14:04 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-09 18:15 - 2010-06-05 16:46 - 00023028 _____ () C:\Users\Aleksandar\AppData\Roaming\wklnhst.dat 2014-05-08 00:38 - 2013-07-28 00:38 - 00000040 _____ () C:\Users\Aleksandar\AppData\Roaming\WB.CFG 2014-05-07 18:23 - 2013-10-17 02:06 - 00000000 ____D () C:\ProgramData\PMB Files Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.3804.dll Some content of TEMP: ==================== C:\Users\Aleksandar\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-06-01 15:51 ==================== End Of Log ============================ Addition: Additional scan result of Farbar Recovery Scan Tool (x86) Version:01-06-2014 Ran by Aleksandar at 2014-06-01 15:50:18 Running from C:\Users\Aleksandar\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 3DMark06 (HKLM\...\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}) (Version: 1.2.1 - Futuremark Corporation) Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated) Adobe AIR (Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated) Adobe Community Help (Version: 3.0.0 - Adobe Systems Incorporated) Hidden Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.9.900.152 - Adobe Systems Incorporated) Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated) Adobe Media Player (Version: 0.0.0 - Adobe Systems Incorporated) Hidden Adobe Photoshop CS5 (HKLM\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated) Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.6.147 - Adobe Systems, Inc.) AdobeColorCommonSetRGB (Version: 2.0 - Adobe Systems Incorporated) Hidden Akamai NetSession Interface (HKCU\...\Akamai) (Version: - ) Apple Application Support (HKLM\...\{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}) (Version: 2.3.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Asami's Sushi Shop (HKLM\...\BFG-Asami's Sushi Shop) (Version: - ) Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.614 - Avira) AviSynth 2.5 (HKLM\...\AviSynth) (Version: - ) Big Fish: Game Manager (HKLM\...\BFGC) (Version: 3.2.0.6 - ) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) Cake Mania: Lights, Camera, Action! (HKLM\...\BFG-Cake Mania - Lights, Camera, Action) (Version: - ) Canon MP Navigator EX 2.0 (HKLM\...\MP Navigator EX 2.0) (Version: - ) Canon MP240 series Benutzerregistrierung (HKLM\...\Canon MP240 series Benutzerregistrierung) (Version: - ) Canon MP240 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP240_series) (Version: - ) Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - ) Canon Utilities My Printer (HKLM\...\CanonMyPrinter) (Version: - ) Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version: - ) Counter-Strike: Source (HKLM\...\Steam App 240) (Version: - Valve) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden Deutschland Spielt - Spiele Post (HKLM\...\Deutschland Spielt - Spiele Post) (Version: 1.0.3.0 - INTENIUM GmbH) DEUTSCHLAND SPIELT GAME CENTER (HKLM\...\DSGPlayer) (Version: 1.0.0.46 - INTENIUM GmbH) DivX-Setup (HKLM\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC) Dream Inn: Driftwood (HKLM\...\BFG-Dream Inn - Driftwood) (Version: - ) Druid Kingdom (HKLM\...\BFG-Druid Kingdom) (Version: - ) Fraps (remove only) (HKLM\...\Fraps) (Version: - ) Free YouTube to MP3 Converter version 3.12.27.225 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.27.225 - DVDVideoSoft Ltd.) Fröhlicher Koch 2 (HKLM\...\BFG-Froehlicher Koch 2) (Version: - ) Futuremark SystemInfo (HKLM\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation) GameSpy Arcade (HKLM\...\GameSpy Arcade) (Version: - ) Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.) Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden ICQ7.6 (HKLM\...\{7644E42D-B096-457F-8B5B-901238FC81AE}) (Version: 7.6 - ICQ) iTunes (HKLM\...\{268278CF-FB69-4D98-B70E-BFEC1CDCA225}) (Version: 11.0.2.26 - Apple Inc.) Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java DB 10.5.3.0 (HKLM\...\{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}) (Version: 10.5.3.0 - Sun Microsystems, Inc) Java(TM) 6 Update 22 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle) Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle) JDownloader (HKLM\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt)) Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden League of Legends (HKLM\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (Version: 1.3 - Riot Games) Hidden League of Legends (Version: 3.0.1 - Riot Games ) Hidden Logitech Gaming Software 5.10 (HKLM\...\{60D32CDC-E3BE-4578-BA10-29322307CDDC}) (Version: 5.10.127 - Logitech) LOLReplay (HKLM\...\LOLReplay) (Version: 0.8.1.4 - www.leaguereplays.com) Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - ) Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{887868A2-D6DE-3255-AA92-AA0B5A59B874}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Works (HKLM\...\{B26E3B0D-C2FA-4370-B068-7C476766F029}) (Version: 08.04.0702 - Microsoft Corporation) Microsoft Works 6-9 Converter (HKLM\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) Microsoft XNA Framework Redistributable 3.1 (HKLM\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation) Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden MOAI: Erschaffe deinen Traum (HKLM\...\BFG-MOAI - Erschaffe deinen Traum) (Version: - ) Monument Builder: Freiheitsstatue (HKLM\...\BFG-Monument Builder - Freiheitsstatue) (Version: - ) Monument Builders: Notre Dame de Paris (HKLM\...\BFG-Monument Builders - Notre Dame de Paris) (Version: - ) MotioninJoy ds3 driver version 0.6.0005 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.6.00005 - www.motioninjoy.com) Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NVIDIA 3D Vision Controller Driver (Version: 270.61 - NVIDIA Corporation) Hidden NVIDIA 3D Vision Controller-Treiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 332.21 - NVIDIA Corporation) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10 - NVIDIA Corporation) NVIDIA ForceWare Network Access Manager (HKLM\...\InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.7316 - NVIDIA Corporation) NVIDIA ForceWare Network Access Manager (Version: 1.00.7316 - NVIDIA Corporation) Hidden NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.21 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Performance (HKLM\...\InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}) (Version: 6.5 - NVIDIA Corporation) NVIDIA Performance (Version: 6.5 - NVIDIA Corporation) Hidden NVIDIA System Monitor (HKLM\...\InstallShield_{E9CFBE78-ED91-4FCF-9E6F-210E477E527D}) (Version: 6.5 - NVIDIA Corporation) NVIDIA System Monitor (Version: 6.5 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden OpenAL (HKLM\...\OpenAL) (Version: - ) OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation) Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.) PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH) PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge) QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.) ROCCAT Kone XTD Mouse Driver (HKLM\...\{7133137D-DF48-4522-AD88-13C82B7D0A63}) (Version: - Roccat GmbH) Royal Envoy: Campaign for the Crown (HKLM\...\BFG-Royal Envoy - Campaign for the Crown) (Version: - ) Royal Envoy: Campaign for the Crown Sammleredition (HKLM\...\BFG-Royal Envoy - Campaign for the Crown Sammleredition) (Version: - ) Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12064_10 - Samsung Electronics Co., Ltd.) Samsung Kies (Version: 2.3.2.12064_10 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.6.0 - SAMSUNG Electronics Co., Ltd.) Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) SpeedFan (remove only) (HKLM\...\SpeedFan) (Version: - ) Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated) Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB) StarCraft II (HKLM\...\StarCraft II) (Version: 1.5.2.22875 - Blizzard Entertainment) Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - ) TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: - TeamSpeak Systems GmbH) TI Connect 1.6 (HKLM\...\{A8B94669-8654-4126-BD28-D0D2412CDED6}) (Version: 1.6 - Texas Instruments Inc) TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.143 - TuneUp Software) Hidden TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities) (Version: 14.0.1000.143 - TuneUp Software) TuneUp Utilities 2014 (Version: 14.0.1000.143 - TuneUp Software) Hidden TuneUp Utilities Language Pack (en-GB) (Version: 9.0.2000.17 - TuneUp Software) Hidden TVersity Codec Pack 1.7 (HKLM\...\TVersity Codec Pack) (Version: 1.7 - TVersity Inc.) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939v3) (Version: 3 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM\...\{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2836939v3) (Version: 3 - Microsoft Corporation) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden Virtual DJ - Atomix Productions (HKLM\...\Virtual DJ - Atomix Productions) (Version: - ) Vista Codec Package (HKLM\...\{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}) (Version: 5.7.6 - Shark007) VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN) Warcraft III (HKLM\...\Warcraft III) (Version: - ) Warcraft III: All Products (HKCU\...\Warcraft III) (Version: - ) Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation) Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation) Windows Mobile-Gerätecenter: Treiberupdate (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation) WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - ) World of Warcraft (HKLM\...\World of Warcraft) (Version: 4.2.0.14480 - Blizzard Entertainment) ==================== Restore Points ========================= 14-04-2014 23:58:29 Windows Update 18-04-2014 23:41:53 Windows Update 23-04-2014 00:11:33 Windows Update 31-05-2014 15:48:22 Windows Update 31-05-2014 17:06:07 Windows Update 31-05-2014 17:19:52 Windows Update 31-05-2014 17:25:14 Windows Update 31-05-2014 17:27:44 Windows Update 01-06-2014 01:00:13 Windows Update ==================== Hosts content: ========================== 2006-11-02 12:23 - 2011-08-19 18:36 - 00436574 ____N C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost 127.0.0.1 activate.adobe.com 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 123haustiereundmehr.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {2580705A-EAE8-470C-B33C-93FF0268ED56} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation) Task: {2D85128A-4C26-47B2-B3A4-59A9F2131F9B} - System32\Tasks\QtraxPlayer => C:\Program Files\Microsoft Silverlight\sllauncher.exe [2014-02-13] (Microsoft Corporation) Task: {304399FF-2FDC-4D79-88FA-C47F661ADB1D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1803384891-385149007-3569804851-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation) Task: {4A33298C-22B3-4137-B73F-F22B49F321DE} - System32\Tasks\{FF2D308B-3F1B-41AE-960C-11A0892D4489} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.) Task: {57976026-FA68-4DC1-BA62-FA1FC8073EB1} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {6BAA977B-952A-474E-9BF1-73DB170F08EA} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-07-29] () Task: {6D25889B-F21B-45C4-A491-72A291B1B58E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-25] (Google Inc.) Task: {7D5B0F08-FE2C-44F7-8AED-B658B9CC2B1C} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe Task: {83DA08E0-4B08-49AE-8189-95E1698AB003} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation) Task: {9D3C379A-A770-4A2B-87C4-4549711BBE74} - System32\Tasks\Google Updater and Installer => C:\Users\Aleksandar\AppData\Local\Google\Update\GoogleUpdate.exe Task: {AE632219-DB66-4885-8FA9-D5C4EC3920F2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {AF087011-7FC6-42D4-874D-C4830B43A49F} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2013\OneClick.exe Task: {B2C39152-9BF7-46C7-911A-CEF891D74D09} - System32\Tasks\DSite => C:\Users\ALEKSA~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {B8106E92-5AC8-4B73-A628-E59EC90F1FDB} - System32\Tasks\AdobeAAMUpdater-1.0-MEINPC-Aleksandar => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated) Task: {BA10405E-DE34-4850-85D6-F65357EC7BF3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1803384891-385149007-3569804851-1000Core => C:\Users\Aleksandar\AppData\Local\Google\Update\GoogleUpdate.exe Task: {C322CE64-63C7-4E16-AA1B-698BC8C24E85} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {C3FD8C8C-E172-48B6-ACB2-05496AF7F21B} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Aleksandar => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation) Task: {CD660D23-A080-4B6E-95D0-542A2F71E202} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation) Task: {D5A923FB-92F7-4842-86CF-080611A9315A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-30] (Adobe Systems Incorporated) Task: {DE5C8A12-465F-45B2-8E78-59E5F1B9C190} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-25] (Google Inc.) Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2010-06-03] () Task: {ED714919-6829-4F46-92C7-1AF8F2D149EF} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {F874CE23-4D3E-4274-8AF2-3CA6598A2DB5} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1803384891-385149007-3569804851-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DSite.job => C:\Users\ALEKSA~1\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\User_Feed_Synchronization-{23FB4D51-F66B-48B3-8D19-26C197F5C150}.job => C:\Windows\system32\msfeedssync.exe ==================== Loaded Modules (whitelisted) ============= 2010-06-03 07:26 - 2008-09-16 21:18 - 00132608 _____ () C:\Program Files\WinRAR\rarext.dll 2013-11-16 04:39 - 2012-06-17 12:20 - 00061440 _____ () C:\Program Files\ROCCAT\Kone XTD Mouse\hiddriver.dll 2013-10-12 03:29 - 2013-10-12 03:29 - 00501560 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll 2014-05-30 22:02 - 2014-05-14 01:40 - 04217672 _____ () C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll 2014-05-30 22:03 - 2014-05-14 01:40 - 00414536 _____ () C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll 2014-05-30 22:02 - 2014-05-14 01:40 - 01732424 _____ () C:\Program Files\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\Aleksandar:zylomtest AlternateDataStreams: C:\Users\Aleksandar:zylomtr{00013KEU-UKQE-K6V0-70L9-2A8RJ1B4CVCV} AlternateDataStreams: C:\Users\Aleksandar:zylomtr{00013KEU-UKQE-K6V0-70L9-2A8RJ1B4CVLK} AlternateDataStreams: C:\Users\Aleksandar:zylomtr{000HQ7FF-AD7A-3FG1-J24H-293SB52ICVVE} AlternateDataStreams: C:\Users\Aleksandar:zylomtr{000HQ7FF-AD7A-3FG1-J24H-293SB52ICVVS} AlternateDataStreams: C:\Users\Aleksandar:zylomtr{000HQ7FF-AD7A-3FG2-7CIS-27D9QT4MMVVB} AlternateDataStreams: C:\Users\Aleksandar:zylomtr{000HQ7FF-AD7A-3FG6-4USB-27FMR9LIOVUC} AlternateDataStreams: C:\ProgramData\TEMP:01312928 AlternateDataStreams: C:\ProgramData\TEMP:014BC3B4 AlternateDataStreams: C:\ProgramData\TEMP:0860D6D6 AlternateDataStreams: C:\ProgramData\TEMP:0915A718 AlternateDataStreams: C:\ProgramData\TEMP:0D52F295 AlternateDataStreams: C:\ProgramData\TEMP:10D98D98 AlternateDataStreams: C:\ProgramData\TEMP:12A012A1 AlternateDataStreams: C:\ProgramData\TEMP:178093AE AlternateDataStreams: C:\ProgramData\TEMP:1B3549F2 AlternateDataStreams: C:\ProgramData\TEMP:1CE87230 AlternateDataStreams: C:\ProgramData\TEMP:258D2F8B AlternateDataStreams: C:\ProgramData\TEMP:2C399CCA AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F AlternateDataStreams: C:\ProgramData\TEMP:2F5A06FD AlternateDataStreams: C:\ProgramData\TEMP:36FFA2FB AlternateDataStreams: C:\ProgramData\TEMP:3815BC84 AlternateDataStreams: C:\ProgramData\TEMP:393F7B1E AlternateDataStreams: C:\ProgramData\TEMP:3A4C8FE7 AlternateDataStreams: C:\ProgramData\TEMP:3B07E6F4 AlternateDataStreams: C:\ProgramData\TEMP:413E2927 AlternateDataStreams: C:\ProgramData\TEMP:432EC713 AlternateDataStreams: C:\ProgramData\TEMP:490BCC52 AlternateDataStreams: C:\ProgramData\TEMP:4C16B46B AlternateDataStreams: C:\ProgramData\TEMP:517B507A AlternateDataStreams: C:\ProgramData\TEMP:57173DB4 AlternateDataStreams: C:\ProgramData\TEMP:5C3ED5BB AlternateDataStreams: C:\ProgramData\TEMP:5DB4FD98 AlternateDataStreams: C:\ProgramData\TEMP:60E0AB2A AlternateDataStreams: C:\ProgramData\TEMP:61B54B15 AlternateDataStreams: C:\ProgramData\TEMP:6677D85A AlternateDataStreams: C:\ProgramData\TEMP:67842DB7 AlternateDataStreams: C:\ProgramData\TEMP:6B251180 AlternateDataStreams: C:\ProgramData\TEMP:6C049F97 AlternateDataStreams: C:\ProgramData\TEMP:6DDFD746 AlternateDataStreams: C:\ProgramData\TEMP:6FD36C4B AlternateDataStreams: C:\ProgramData\TEMP:79C6A9CE AlternateDataStreams: C:\ProgramData\TEMP:7BB584AA AlternateDataStreams: C:\ProgramData\TEMP:7E4E56EA AlternateDataStreams: C:\ProgramData\TEMP:7ECD9621 AlternateDataStreams: C:\ProgramData\TEMP:84FA02E7 AlternateDataStreams: C:\ProgramData\TEMP:896FF808 AlternateDataStreams: C:\ProgramData\TEMP:8AC20936 AlternateDataStreams: C:\ProgramData\TEMP:8C12CFCD AlternateDataStreams: C:\ProgramData\TEMP:902C848D AlternateDataStreams: C:\ProgramData\TEMP:969C0C96 AlternateDataStreams: C:\ProgramData\TEMP:97995ED4 AlternateDataStreams: C:\ProgramData\TEMP:9B2BD056 AlternateDataStreams: C:\ProgramData\TEMP:9D03192E AlternateDataStreams: C:\ProgramData\TEMP:A2B3764A AlternateDataStreams: C:\ProgramData\TEMP:A69FAA24 AlternateDataStreams: C:\ProgramData\TEMP:AE9351E0 AlternateDataStreams: C:\ProgramData\TEMP:B093E177 AlternateDataStreams: C:\ProgramData\TEMP:B1E64E47 AlternateDataStreams: C:\ProgramData\TEMP:B3942462 AlternateDataStreams: C:\ProgramData\TEMP:B722BCE5 AlternateDataStreams: C:\ProgramData\TEMP:BDF08FAF AlternateDataStreams: C:\ProgramData\TEMP:C43C957E AlternateDataStreams: C:\ProgramData\TEMP:C458CC0A AlternateDataStreams: C:\ProgramData\TEMP:C98828D3 AlternateDataStreams: C:\ProgramData\TEMP:CFF6B3FF AlternateDataStreams: C:\ProgramData\TEMP  01ACC06AlternateDataStreams: C:\ProgramData\TEMP 02FBAECAlternateDataStreams: C:\ProgramData\TEMP 0D17155AlternateDataStreams: C:\ProgramData\TEMP 61EB62DAlternateDataStreams: C:\ProgramData\TEMP:E1D818F7 AlternateDataStreams: C:\ProgramData\TEMP:E5BA9ADD AlternateDataStreams: C:\ProgramData\TEMP:E9900C74 AlternateDataStreams: C:\ProgramData\TEMP:EC0279DC AlternateDataStreams: C:\ProgramData\TEMP:F0762150 AlternateDataStreams: C:\ProgramData\TEMP:F1F936DF AlternateDataStreams: C:\ProgramData\TEMP:F2327E82 AlternateDataStreams: C:\ProgramData\TEMP:F3591DDB AlternateDataStreams: C:\ProgramData\TEMP:F5FC5DCE AlternateDataStreams: C:\ProgramData\TEMP:FD786DCA AlternateDataStreams: C:\ProgramData\TEMP:FEE00EB9 ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon MSCONFIG\startupreg: Google Update => "C:\Users\Aleksandar\AppData\Local\Google\Update\GoogleUpdate.exe" /c MSCONFIG\startupreg: KiesPDLR => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe MSCONFIG\startupreg: KiesPreload => C:\Program Files\Samsung\Kies\Kies.exe /preload MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe MSCONFIG\startupreg: Spiele Post => C:\Program Files\OXXOGames\GPlayer\GameCenterNotifier.exe MSCONFIG\startupreg: Spotify => "C:\Users\Aleksandar\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Aleksandar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" MSCONFIG\startupreg: SymphonyPreLoad => "C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.standard.launcher.win32.x86_3.0.1.20120110-2000\IBM Lotus Symphony" -nogui -nosplash MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide MSCONFIG\startupreg: Windows Mobile Device Center => %windir%\WindowsMobile\wmdc.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (06/01/2014 03:44:26 PM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier2\eventsystem2.cpp38180070005 Error: (06/01/2014 03:44:26 PM) (Source: Winlogon) (EventID: 4103) (User: ) Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000. Error: (06/01/2014 11:18:39 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: :16 Error: (06/01/2014 11:16:37 AM) (Source: Software Licensing Service) (EventID: 8198) (User: ) Description: Die Lizenzaktivierung (SLUINotify.dll) ist mit folgendem Fehlercode fehlgeschlagen: 0x80070057 Error: (06/01/2014 11:13:06 AM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier2\eventsystem2.cpp38180070005 Error: (06/01/2014 11:13:06 AM) (Source: Winlogon) (EventID: 4103) (User: ) Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000. Error: (06/01/2014 03:02:55 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: @:딸:軃坄16 Error: (06/01/2014 03:02:54 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: <16 Error: (06/01/2014 03:02:53 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: >16 Error: (06/01/2014 03:02:12 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: -Ä+㫑榽遈ကWindows Workflow Foundation 4.0.0.016 System errors: ============= Error: (06/01/2014 03:45:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (06/01/2014 03:44:18 PM) (Source: Dhcpv6) (EventID: 1000) (User: ) Description: Die Lease dieses Computers zu der IP-Adresse * ¯¯ über die Netzwerkkarte mit der Netzwerkadresse 001D607F778C ist verloren gegangen. Error: (06/01/2014 11:13:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (06/01/2014 11:12:43 AM) (Source: Dhcpv6) (EventID: 1000) (User: ) Description: Die Lease dieses Computers zu der IP-Adresse * ¯¯ über die Netzwerkkarte mit der Netzwerkadresse 001D607F778C ist verloren gegangen. Error: (05/31/2014 08:11:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Error: (05/31/2014 08:11:17 PM) (Source: Dhcpv6) (EventID: 1000) (User: ) Description: Die Lease dieses Computers zu der IP-Adresse * ¯¯ über die Netzwerkkarte mit der Netzwerkadresse 001D607F778C ist verloren gegangen. Error: (05/31/2014 08:04:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: 0x80070643Hotfix für Windows (KB947821){6B4D384B-D56B-4C36-8BB8-7E45D3A5CE59}501 Error: (05/31/2014 07:24:22 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: 0x80070643Hotfix für Windows (KB947821){6B4D384B-D56B-4C36-8BB8-7E45D3A5CE59}501 Error: (05/31/2014 07:19:44 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: 0x80070643Hotfix für Windows (KB947821){6B4D384B-D56B-4C36-8BB8-7E45D3A5CE59}501 Error: (05/31/2014 06:44:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Parallel port driver%%1058 Microsoft Office Sessions: ========================= Error: (06/01/2014 03:44:26 PM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier2\eventsystem2.cpp38180070005 Error: (06/01/2014 03:44:26 PM) (Source: Winlogon) (EventID: 4103) (User: ) Description: 0x000000000x00000001 Error: (06/01/2014 11:18:39 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: :16 Error: (06/01/2014 11:16:37 AM) (Source: Software Licensing Service) (EventID: 8198) (User: ) Description: 0x80070057 Error: (06/01/2014 11:13:06 AM) (Source: EventSystem) (EventID: 4609) (User: ) Description: d:\longhorn\com\complus\src\events\tier2\eventsystem2.cpp38180070005 Error: (06/01/2014 11:13:06 AM) (Source: Winlogon) (EventID: 4103) (User: ) Description: 0x000000000x00000001 Error: (06/01/2014 03:02:55 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: @:딸:軃坄16 Error: (06/01/2014 03:02:54 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: <16 Error: (06/01/2014 03:02:53 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: >16 Error: (06/01/2014 03:02:12 AM) (Source: LoadPerf) (EventID: 3002) (User: ) Description: -Ä+㫑榽遈ကWindows Workflow Foundation 4.0.0.016 CodeIntegrity Errors: =================================== Date: 2014-06-01 15:50:11.627 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:11.456 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:11.268 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:11.081 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:10.910 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:10.754 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:10.598 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:10.410 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:10.083 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-06-01 15:50:09.911 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 48% Total physical RAM: 3069.83 MB Available physical RAM: 1583.6 MB Total Pagefile: 6378.51 MB Available Pagefile: 4702.66 MB Total Virtual: 3071.88 MB Available Virtual: 2907.36 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:335.35 GB) (Free:80.67 GB) NTFS ==>[Drive with boot components (obtained from BCD)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 335 GB) (Disk ID: C975C4A7) Partition 1: (Active) - (Size=335 GB) - (Type=07 NTFS) ==================== End Of Log ============================ defogger: defogger_disable by jpshortstuff (23.02.10.1) Log created at 15:41 on 01/06/2014 (Aleksandar) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... Unable to read sptd.sys SPTD -> Disabled (Service running -> reboot required) -=E.O.F=- gmer: GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-06-01 16:52:47 Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\00000066 ST336032 rev.3.AA 335,35GB Running: Gmer-19357.exe; Driver: C:\Users\ALEKSA~1\AppData\Local\Temp\uwldypog.sys ---- System - GMER 2.1 ---- SSDT C9B9552E ZwCreateSection SSDT C9B95538 ZwRequestWaitReplyPort SSDT C9B95533 ZwSetContextThread SSDT C9B9553D ZwSetSecurityObject SSDT C9B95542 ZwSystemDebugControl SSDT C9B954CF ZwTerminateProcess INT 0x51 ? C341EA50 INT 0x52 ? C51C4550 INT 0x61 ? C51C4CD0 INT 0x62 ? C51C4050 INT 0x71 ? C341E050 INT 0x72 ? C51C4A50 INT 0x82 ? C341E2D0 INT 0x92 ? C341E550 INT 0xA2 ? C341E7D0 INT 0xA3 ? C7F0CCD0 INT 0xB1 ? C341ECD0 ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!KeSetEvent + 215 E38E6860 4 Bytes [2E, 55, B9, C9] .text ntkrnlpa.exe!KeSetEvent + 539 E38E6B84 4 Bytes [38, 55, B9, C9] {CMP [EBP-0x47], DL; LEAVE } .text ntkrnlpa.exe!KeSetEvent + 56D E38E6BB8 4 Bytes [33, 55, B9, C9] {XOR EDX, [EBP-0x47]; LEAVE } .text ntkrnlpa.exe!KeSetEvent + 5D1 E38E6C1C 4 Bytes [3D, 55, B9, C9] .text ntkrnlpa.exe!KeSetEvent + 619 E38E6C64 4 Bytes [42, 55, B9, C9] .text ... ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtCreateFile + 6 772F426A 4 Bytes [28, 90, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtCreateFile + B 772F426F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtMapViewOfSection + 6 772F49BA 4 Bytes [28, 93, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtMapViewOfSection + B 772F49BF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenFile + 6 772F4A4A 4 Bytes [68, 90, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenFile + B 772F4A4F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcess + 6 772F4ACA 4 Bytes [A8, 91, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcess + B 772F4ACF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcessToken + 6 772F4ADA 4 Bytes CALL 76303770 C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcessToken + B 772F4ADF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcessTokenEx + 6 772F4AEA 4 Bytes [A8, 92, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenProcessTokenEx + B 772F4AEF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThread + 6 772F4B3A 4 Bytes [68, 91, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThread + B 772F4B3F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThreadToken + 6 772F4B4A 4 Bytes [68, 92, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThreadToken + B 772F4B4F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThreadTokenEx + 6 772F4B5A 4 Bytes CALL 763037F1 C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtOpenThreadTokenEx + B 772F4B5F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtQueryAttributesFile + 6 772F4BEA 4 Bytes [A8, 90, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtQueryAttributesFile + B 772F4BEF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtQueryFullAttributesFile + 6 772F4C9A 4 Bytes CALL 7630392F C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtQueryFullAttributesFile + B 772F4C9F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtSetInformationFile + 6 772F517A 4 Bytes [28, 91, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtSetInformationFile + B 772F517F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtSetInformationThread + 6 772F51CA 4 Bytes [28, 92, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtSetInformationThread + B 772F51CF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtUnmapViewOfSection + 6 772F546A 4 Bytes [68, 93, EC, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1716] ntdll.dll!NtUnmapViewOfSection + B 772F546F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3812] ntdll.dll!NtMapViewOfSection + 6 772F49BA 4 Bytes [18, 10, D9, 66] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3812] ntdll.dll!NtMapViewOfSection + B 772F49BF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtCreateFile + 6 772F426A 4 Bytes [28, 58, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtCreateFile + B 772F426F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtMapViewOfSection + 6 772F49BA 4 Bytes [28, 5B, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtMapViewOfSection + B 772F49BF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenFile + 6 772F4A4A 4 Bytes [68, 58, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenFile + B 772F4A4F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcess + 6 772F4ACA 4 Bytes [A8, 59, DF, 00] {TEST AL, 0x59; FILD WORD [EAX]} .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcess + B 772F4ACF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcessToken + 6 772F4ADA 4 Bytes CALL 76302A38 C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcessToken + B 772F4ADF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcessTokenEx + 6 772F4AEA 4 Bytes [A8, 5A, DF, 00] {TEST AL, 0x5a; FILD WORD [EAX]} .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenProcessTokenEx + B 772F4AEF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThread + 6 772F4B3A 4 Bytes [68, 59, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThread + B 772F4B3F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThreadToken + 6 772F4B4A 4 Bytes [68, 5A, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThreadToken + B 772F4B4F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThreadTokenEx + 6 772F4B5A 4 Bytes CALL 76302AB9 C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtOpenThreadTokenEx + B 772F4B5F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtQueryAttributesFile + 6 772F4BEA 4 Bytes [A8, 58, DF, 00] {TEST AL, 0x58; FILD WORD [EAX]} .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtQueryAttributesFile + B 772F4BEF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtQueryFullAttributesFile + 6 772F4C9A 4 Bytes CALL 76302BF7 C:\Windows\system32\GDI32.dll .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtQueryFullAttributesFile + B 772F4C9F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtSetInformationFile + 6 772F517A 4 Bytes [28, 59, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtSetInformationFile + B 772F517F 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtSetInformationThread + 6 772F51CA 4 Bytes [28, 5A, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtSetInformationThread + B 772F51CF 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtUnmapViewOfSection + 6 772F546A 4 Bytes [68, 5B, DF, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[3912] ntdll.dll!NtUnmapViewOfSection + B 772F546F 1 Byte [E2] ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18012300 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18012300@001dfd75b50e 0x66 0xD5 0x8F 0x22 ... Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18012300@00247dd729d4 0x79 0x2B 0xAD 0x9E ... Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000d18012300@bc476023c388 0xF1 0x5B 0x8A 0x85 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x36 0x10 0x57 0xDE ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8B 0xD2 0x86 0xAE ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x06 0x64 0x52 0x79 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x24 0x9D 0x61 0x38 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x21 0x5D 0x8D 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d18012300 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d18012300@001dfd75b50e 0x66 0xD5 0x8F 0x22 ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d18012300@00247dd729d4 0x79 0x2B 0xAD 0x9E ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000d18012300@bc476023c388 0xF1 0x5B 0x8A 0x85 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x36 0x10 0x57 0xDE ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8B 0xD2 0x86 0xAE ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x06 0x64 0x52 0x79 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x24 0x9D 0x61 0x38 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x21 0x5D 0x8D 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18012300 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18012300@001dfd75b50e 0x66 0xD5 0x8F 0x22 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18012300@00247dd729d4 0x79 0x2B 0xAD 0x9E ... Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000d18012300@bc476023c388 0xF1 0x5B 0x8A 0x85 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x36 0x10 0x57 0xDE ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8B 0xD2 0x86 0xAE ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x06 0x64 0x52 0x79 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x24 0x9D 0x61 0x38 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x21 0x5D 0x8D 0x00 ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\933448FAA8F23954183BF9C44530C8E4\Usage@WinMailFeat 1153499146 ---- EOF - GMER 2.1 ---- Malwarebytes: Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 01.06.2014 Suchlauf-Zeit: 17:33:13 Logdatei: MAM.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.06.01.05 Rootkit Datenbank: v2014.05.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Aleksandar Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 287095 Verstrichene Zeit: 17 Min, 59 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 8 PUP.Optional.OpenCandy, C:\Users\Aleksandar\AppData\Roaming\OpenCandy, , [0e3bc5ae1c5f1224a20cb2c8ff03a858], PUP.Optional.OpenCandy, C:\Users\Aleksandar\AppData\Roaming\OpenCandy\9E9B9B6A1E5647529601033EB7A5F990, , [0e3bc5ae1c5f1224a20cb2c8ff03a858], PUP.Optional.OpenCandy, C:\Users\Aleksandar\AppData\Roaming\OpenCandy\B00AAA62EE6E40BC83016C0A52DC3220, , [0e3bc5ae1c5f1224a20cb2c8ff03a858], PUP.Optional.Wajam.A, C:\Users\Aleksandar\AppData\Local\Wajam, , [7ecbf281e99245f1241d007e69994fb1], PUP.Optional.Wajam.A, C:\Users\Aleksandar\AppData\Local\Wajam\Chrome, , [7ecbf281e99245f1241d007e69994fb1], PUP.Optional.Softonic.A, C:\Users\Aleksandar\AppData\Local\Temp\mt_ffx\Softonic, , [4207d2a188f3bb7b380bb5cd56ac649c], PUP.Optional.Softonic.A, C:\Users\Aleksandar\AppData\Local\Temp\mt_ffx\Softonic\Softonic, , [4207d2a188f3bb7b380bb5cd56ac649c], PUP.Optional.Softonic.A, C:\Users\Aleksandar\AppData\Local\Temp\mt_ffx\Softonic\Softonic\1.8.21.14, , [4207d2a188f3bb7b380bb5cd56ac649c], Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) |
Baum-Darstellung