| |
| |||||||
Log-Analyse und Auswertung: ScanTrack macht Probleme :/Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
11.06.2014, 17:58
| #1 |
| |  ScanTrack macht Probleme :/ Hallo, ich habe folgendes Problem, ich habe vor kurzem ausersehen scantrack heruntergeladen und anscheinend installiert nun macht es aber diverse Probleme wie mir übertrieben viele Ads zu öffnen was das surfen fast unmöglich macht . ich habe eure schritte soweit es geht befolgt und mir die programme "defogger" "frst" und "gmer" heruntergeladen. hier die logs frst: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-06-2014 01
Ran by lenovo (administrator) on LENOVO-PC on 11-06-2014 18:20:36
Running from C:\Users\lenovo\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Fuyu LIMITED) C:\ProgramData\WindowsProtectManger\wprotectmanager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\ScanTack\updateScanTack.exe
() C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerofa.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe
() C:\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe
() C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2991856 2013-02-21] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-05-05] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Diamondback] => C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe [226816 2009-10-09] ()
HKLM-x32\...\RunOnce: [upfst_de_37.exe] - C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe -runonce [3268600 2014-06-06] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-21-1545926792-3371853682-890327128-1003\...\Run: [Browser Infrastructure Helper] => C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.exe [20760 2014-04-23] (Smartbar)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\PROGRA~2\SupTab\SEARCH~2.DLL File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpVFn36cGa_0q8n8QslwcAnngLpFpN0-aJ_ZXQ5j6BOHzEGt2QOsQvuN64uE6DfTy_m9tmQfJouBkHWzXS31BNtay0Gp9Lp8vvg,
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvoGn8gtqTfzRepcJ_g,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvoGn8gtqTfzRepcJ_g,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
BHO: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: ScanTack - {d332cff8-358e-4c9e-8af3-a08872ef22c1} - C:\Program Files (x86)\ScanTack\D12017C3-82E3-4D6D-B5D3-0C74A5F97D83.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-24]
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-03-12]
CHR Extension: (Logitech SetPoint) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd [2014-02-24]
CHR Extension: (Google Wallet) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-20]
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2014-02-24]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-06-10]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
S2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [33048 2014-04-23] ()
S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-25] (Microsoft Corporation)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
R2 Update ScanTack; C:\Program Files (x86)\ScanTack\updateScanTack.exe [317728 2014-06-11] ()
R2 Util ScanTack; C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe [317728 2014-06-11] ()
R2 WindowsProtectManger; C:\ProgramData\WindowsProtectManger\wprotectmanager.exe [573344 2014-06-10] (Fuyu LIMITED)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197376 2009-10-16] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [61112 2014-06-09] (StdLib)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [61112 2014-06-09] (StdLib)
S3 ALSysIO; \??\C:\Users\lenovo\AppData\Local\Temp\ALSysIO64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-11 18:20 - 2014-06-11 18:21 - 00019627 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:20 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 17:52 - 2014-06-11 17:52 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Smartbar
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\LPT
2014-06-11 17:42 - 2014-06-09 12:09 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-11 03:26 - 2014-06-09 12:10 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-10 15:23 - 00000368 _____ () C:\windows\PFRO.log
2014-06-10 07:46 - 2014-06-11 17:54 - 00000000 ____D () C:\Program Files (x86)\ScanTack
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\SupTab
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-10 07:45 - 2014-06-10 07:45 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\qone8
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:56 - 2014-06-10 01:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:41 - 2014-06-09 23:42 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2007-03-20 19:05 - 00073728 _____ (Razer Inc.) C:\windows\SysWOW64\Diamondback.cpl
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:54 - 2014-06-09 22:54 - 00000000 ____D () C:\Users\lenovo\AppData\Local\freeSOFTtoday
2014-06-09 22:22 - 2014-06-11 17:40 - 00000280 _____ () C:\windows\setupact.log
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 00:30 - 2014-06-11 17:50 - 00000000 ____D () C:\Users\lenovo\AppData\Local\fst_de_37
2014-06-09 00:30 - 2014-06-10 07:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-09 00:30 - 2014-06-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 21:35 - 2014-06-04 21:36 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:34 - 2014-06-04 21:39 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-05 07:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:50 - 2014-06-04 20:55 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:49 - 2014-06-04 22:31 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:19 - 2014-06-04 20:25 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:35 - 2014-06-04 21:36 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 18:33 - 2014-06-11 18:17 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-04 18:33 - 2014-06-10 20:22 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-04 18:33 - 2014-06-04 18:36 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 19:45 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:54 - 2014-05-27 15:57 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
==================== One Month Modified Files and Folders =======
2014-06-11 18:21 - 2014-06-11 18:20 - 00019627 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:21 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Temp
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:20 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:18 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 18:17 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-11 18:13 - 2009-07-14 04:34 - 00000715 _____ () C:\windows\win.ini
2014-06-11 18:11 - 2014-04-20 11:41 - 00000284 _____ () C:\windows\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05}.job
2014-06-11 18:11 - 2010-05-05 18:26 - 00497091 _____ () C:\FaceProv.log
2014-06-11 17:54 - 2014-06-10 07:46 - 00000000 ____D () C:\Program Files (x86)\ScanTack
2014-06-11 17:52 - 2014-06-11 17:52 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Smartbar
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\LPT
2014-06-11 17:50 - 2014-06-09 00:30 - 00000000 ____D () C:\Users\lenovo\AppData\Local\fst_de_37
2014-06-11 17:50 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 17:49 - 2014-02-20 21:07 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-11 17:49 - 2014-02-20 21:07 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-11 17:48 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-11 17:48 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-11 17:44 - 2010-05-05 17:23 - 00345524 _____ () C:\windows\WindowsUpdate.log
2014-06-11 17:41 - 2010-05-05 18:13 - 00000000 ____D () C:\ProgramData\VeriFace
2014-06-11 17:40 - 2014-06-09 22:22 - 00000280 _____ () C:\windows\setupact.log
2014-06-11 17:40 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-11 05:25 - 2014-04-20 11:43 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-10 20:22 - 2014-06-04 18:33 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-10 15:23 - 00000368 _____ () C:\windows\PFRO.log
2014-06-10 07:47 - 2014-06-09 00:30 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\SupTab
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-10 07:45 - 2014-06-10 07:45 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\qone8
2014-06-10 01:05 - 2014-06-09 23:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:49 - 2010-05-05 09:06 - 00690574 _____ () C:\windows\system32\perfh007.dat
2014-06-09 23:49 - 2010-05-05 09:06 - 00143916 _____ () C:\windows\system32\perfc007.dat
2014-06-09 23:49 - 2009-07-14 07:13 - 01603176 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-09 23:42 - 2014-06-09 23:41 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2010-05-05 17:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:54 - 2014-06-09 22:54 - 00000000 ____D () C:\Users\lenovo\AppData\Local\freeSOFTtoday
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 22:22 - 2014-03-23 01:53 - 00000000 ____D () C:\windows\Minidump
2014-06-09 12:10 - 2014-06-11 03:26 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-09 12:09 - 2014-06-11 17:42 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-09 00:30 - 2014-06-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-05 07:09 - 2014-06-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-05 07:09 - 2014-02-20 23:54 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Winamp
2014-06-05 07:09 - 2010-05-05 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-06-05 07:09 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 23:23 - 2010-05-05 17:39 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-04 22:31 - 2014-06-04 20:49 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 21:39 - 2014-06-04 21:34 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:36 - 2014-06-04 21:35 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:36 - 2014-06-04 18:35 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-04 20:50 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:25 - 2014-06-04 20:19 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 19:45 - 2014-06-04 18:30 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:38 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-04 18:36 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:04 - 2014-04-24 17:26 - 00000000 ____D () C:\Users\lenovo\Tracing
2014-06-03 01:03 - 2009-07-29 09:00 - 00000000 ____D () C:\windows\Panther
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:57 - 2014-05-27 15:54 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
Some content of TEMP:
====================
C:\Users\lenovo\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 01:58
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-06-2014 01
Ran by lenovo at 2014-06-11 18:21:45
Running from C:\Users\lenovo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
AMD Catalyst Install Manager (HKLM\...\{FAF03106-1653-15E1-3C0C-E7AE4FAE6EBF}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2010.0302.2233.40412 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.62 - Conexant)
Lenovo EasyCamera (HKLM\...\Lenovo EasyCamera) (Version: 5.8.0.12 - Silicon Motion)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Logitech SetPoint 6.52 (HKLM\...\sp6) (Version: 6.52.74 - Logitech)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{86177DAE-38B1-49DD-912E-35CB703AB779}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
06-06-2014 22:00:00 Geplanter Prüfpunkt
09-06-2014 21:40:55 Installed Razer Diamondback
09-06-2014 21:42:08 Gerätetreiber-Paketinstallation: Razer Eingabegeräte (Human Interface Devices)
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {42936927-C026-4AF0-ADCA-FDFCBE85599D} - System32\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05} => C:\Program Files\V-bates\PrefHelper.exe
Task: {62E0D1B6-E032-477B-9911-28B974D68262} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {668D5013-3AD0-484A-A197-FE30C8A2F58E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-20] (Adobe Systems Incorporated)
Task: {716EDE60-7769-4D29-BC22-1EC1EF3C36D7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {876CE199-EBAC-4220-BD74-488EEE73FDCC} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {B7697EE0-7C0B-4890-B04C-25CEFB45DF8E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {E4FA0B9D-58EC-42AC-BFA3-50E227FD05D0} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {EE16750A-A44A-4EA6-8082-741E1A5FB7FC} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-05-05 18:13 - 2010-05-05 18:13 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2010-05-05 18:13 - 2010-05-05 18:13 - 00622592 _____ () C:\windows\system32\SimpleExt.dll
2014-06-10 07:03 - 2014-06-11 03:29 - 00317728 _____ () C:\Program Files (x86)\ScanTack\updateScanTack.exe
2014-06-10 15:24 - 2014-06-11 03:24 - 00317728 _____ () C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe
2014-06-09 00:30 - 2014-06-06 11:18 - 03268600 _____ () C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2014-06-09 23:41 - 2009-10-09 20:11 - 00226816 _____ () C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
2014-06-11 03:26 - 2014-06-09 12:09 - 00287008 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe
2010-05-05 17:42 - 2010-05-05 17:42 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00012568 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe
2014-06-11 03:26 - 2014-06-11 01:16 - 00096544 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe
2010-05-05 18:13 - 2010-05-05 18:13 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libcef.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libglesv2.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libegl.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00022296 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\lrcnt.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00059672 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\sppsm.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00016664 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00051480 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\srut.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00165656 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-06-11 17:55 - 2014-06-11 01:16 - 00183584 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTackBAApp.dll
2010-05-05 17:50 - 2009-06-05 18:37 - 00260096 _____ () C:\windows\system32\370prop.ax
2014-05-21 03:11 - 2014-05-14 01:40 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/11/2014 05:40:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b7e6
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 06:53:12 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (06/10/2014 06:51:44 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (06/10/2014 03:24:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b48e
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x1118
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x15a8
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0x80000001
Fehleroffset: 0x0009b699
ID des fehlerhaften Prozesses: 0x1d64
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x145c
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:46:58 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm majfst.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1ca0
Startzeit: 01cf846ea2c65991
Endzeit: 31
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-0VV1A.tmp\majfst.tmp
Berichts-ID:
Error: (06/10/2014 07:46:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm package_scantack_installer_multilang.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1208
Startzeit: 01cf846f38917f6a
Endzeit: 32
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-NKJSG.tmp\package_scantack_installer_multilang.tmp
Berichts-ID:
System errors:
=============
Error: (06/11/2014 05:41:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 03:24:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:23:58 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 10.06.2014 um 07:57:09 unerwartet heruntergefahren.
Error: (06/10/2014 07:46:19 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Search Protect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 3836.2 MB
Available physical RAM: 2237.24 MB
Total Pagefile: 7670.55 MB
Available Pagefile: 5621.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:254.14 GB) (Free:30.09 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:0.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: F63AC172)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=254 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-11 18:48:34
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545032B9A300 rev.PBEOC64G 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\lenovo\AppData\Local\Temp\pxdirpog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
---- Processes - GMER 2.1 ----
Process C:\ProgramData\WindowsProtectManger\wprotectmanager.exe (*** suspicious ***) @ C:\ProgramData\WindowsProtectManger\wprotectmanager.exe [1604] (WindowsProtectManger Service/Fuyu LIMITED)(2014-06-10 05:46:17) 0000000000840000
Process C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe [3332](2014-06-08 22:30:40) 0000000000b00000
Process C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe (*** suspicious ***) @ C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe [3744] (Battle.net Update Agent/Blizzard Entertainment)(2014-06-04 16:30:49) 00000000011b0000
Process C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:14) 0000000000e20000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\lrcnt.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:14) 0000000072eb0000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\MouseKeyboardActivityMonitor.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392] (MouseKeyboardActivityMonitor/Mouse and Keyboard Hooks .NET)(2014-04-23 10:54:20) 0000000072ec0000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\sppsm.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:18) 0000000063510000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:02) 0000000062790000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\srut.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:34) 0000000062940000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:58) 0000000063800000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)
---- EOF - GMER 2.1 ----
 MfG shadowface aka kevin |
|
11.06.2014, 18:59
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | ScanTrack macht Probleme :/ Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
11.06.2014, 20:30
| #3 |
| | ScanTrack macht Probleme :/ Ähm ja meinst du sowas :
__________________Code:
ATTFilter Die Datei 'C:\Users\lenovo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OEF0YXF7\Setup[2].exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen9' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50999c98.qua' verschoben!
|
|
11.06.2014, 20:38
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.06.2014, 21:22
| #5 |
| | ScanTrack macht Probleme :/Code:
ATTFilter ComboFix 14-06-10.01 - lenovo 11.06.2014 21:54:49.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3836.2600 [GMT 2:00]
ausgeführt von:: c:\users\lenovo\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Packer.exe.lnk
c:\users\lenovo\AppData\Local\nsb7556.tmp
c:\windows\IsUn0407.exe
c:\windows\s.bat
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-11 bis 2014-06-11 ))))))))))))))))))))))))))))))
.
.
2014-06-11 20:02 . 2014-06-11 20:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-11 16:20 . 2014-06-11 16:22 -------- d-----w- C:\FRST
2014-06-11 15:52 . 2014-06-11 15:52 -------- d-----w- c:\program files (x86)\LPT
2014-06-11 15:51 . 2014-06-11 15:51 -------- d-----w- c:\users\lenovo\AppData\Local\LPT
2014-06-11 15:51 . 2014-06-11 15:51 -------- d-----w- c:\users\lenovo\AppData\Local\Smartbar
2014-06-11 15:42 . 2014-06-09 10:09 61112 ----a-w- c:\windows\system32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-11 01:26 . 2014-06-09 10:10 61112 ----a-w- c:\windows\system32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-10 15:29 . 2014-06-10 15:29 -------- d-----w- c:\program files (x86)\TeamSpeak 3 Client
2014-06-10 05:46 . 2014-06-11 15:54 -------- d-----w- c:\program files (x86)\ScanTack
2014-06-10 05:46 . 2014-06-10 05:46 -------- d-----w- c:\programdata\WindowsProtectManger
2014-06-10 05:46 . 2014-06-10 05:46 -------- d-----w- c:\users\lenovo\AppData\Roaming\SupTab
2014-06-10 05:46 . 2014-06-10 05:46 -------- d-----w- c:\programdata\IePluginServices
2014-06-10 05:45 . 2014-06-10 05:45 -------- d-----w- c:\users\lenovo\AppData\Roaming\qone8
2014-06-09 21:56 . 2014-06-09 23:05 -------- d-----w- c:\program files (x86)\World of Warcraft Public Test
2014-06-09 21:41 . 2007-03-20 17:05 73728 ----a-w- c:\windows\SysWow64\Diamondback.cpl
2014-06-09 21:41 . 2014-06-09 21:41 -------- d-----w- c:\program files (x86)\Razer
2014-06-09 21:40 . 2014-06-09 21:40 -------- d-----w- c:\users\lenovo\AppData\Roaming\InstallShield
2014-06-09 20:54 . 2014-06-09 20:54 -------- d-----w- c:\users\lenovo\AppData\Local\freeSOFTtoday
2014-06-08 22:30 . 2014-06-11 19:46 -------- d-----w- c:\users\lenovo\AppData\Local\fst_de_37
2014-06-04 19:18 . 2014-06-04 19:18 -------- d-----w- c:\programdata\ATI
2014-06-04 18:54 . 2014-06-04 18:54 -------- d-----w- c:\programdata\AMD
2014-06-04 18:51 . 2014-06-04 18:51 -------- d-----w- c:\programdata\Package Cache
2014-06-04 18:50 . 2014-06-04 18:55 -------- d-----w- c:\program files\ATI Technologies
2014-06-04 18:47 . 2014-06-04 18:47 -------- d-----w- C:\AMD
2014-06-04 16:35 . 2014-06-04 19:36 -------- d-----w- c:\program files (x86)\World of Warcraft
2014-06-04 16:33 . 2014-06-04 16:33 -------- d-----w- c:\users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 16:33 . 2014-06-11 19:42 -------- d-----w- c:\users\lenovo\AppData\Local\Battle.net
2014-06-04 16:33 . 2014-06-04 16:36 -------- d-----w- c:\users\lenovo\AppData\Roaming\Battle.net
2014-06-04 16:33 . 2014-06-10 18:22 -------- d-----w- c:\program files (x86)\Battle.net
2014-06-04 16:33 . 2014-06-09 21:58 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2014-06-04 16:33 . 2014-06-04 16:33 -------- d-----w- c:\programdata\Blizzard Entertainment
2014-06-04 16:30 . 2014-06-04 17:45 -------- d-----w- c:\programdata\Battle.net
2014-06-02 23:02 . 2014-06-02 23:02 -------- d-----w- c:\program files\CCleaner
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-04 01:40 . 2014-05-04 01:41 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-29 08:44 . 2014-02-25 17:22 130584 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-04-29 08:43 . 2014-02-25 17:22 112080 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-04-20 09:43 . 2014-04-20 09:43 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-20 09:43 . 2014-04-20 09:43 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-18 00:07 . 2014-02-23 22:27 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2014-02-13 12:20 3057808 --sha-r- c:\windows\SysWOW64\avcodec-lav-55.dll
2014-02-13 12:20 98960 --sha-r- c:\windows\SysWOW64\avfilter-lav-3.dll
2014-02-13 12:20 539280 --sha-r- c:\windows\SysWOW64\avformat-lav-55.dll
2009-09-27 07:39 415744 --sh--w- c:\windows\SysWOW64\avisynth.dll
2014-02-13 12:20 59536 --sha-r- c:\windows\SysWOW64\avresample-lav-1.dll
2005-07-14 10:31 32256 --sh--w- c:\windows\SysWOW64\AVSredirect.dll
2014-02-13 12:20 180368 --sha-r- c:\windows\SysWOW64\avutil-lav-52.dll
2004-02-22 08:11 764416 --sh--w- c:\windows\SysWOW64\devil.dll
2014-02-13 12:20 122512 --sha-r- c:\windows\SysWOW64\HLaudio.dll
2014-02-13 12:20 202384 --sha-r- c:\windows\SysWOW64\HLsplit.dll
2014-02-13 12:20 313520 --sha-r- c:\windows\SysWOW64\HLvideo.dll
2004-01-24 22:00 70656 --sh--w- c:\windows\SysWOW64\i420vfw.dll
2014-02-13 12:20 152720 --sha-r- c:\windows\SysWOW64\IntelQuickSyncDecoder.dll
2014-02-13 12:20 110224 --sha-r- c:\windows\SysWOW64\libbluray.dll
2011-02-11 08:26 112128 --sha-r- c:\windows\SysWOW64\OptimFROG.dll
2014-02-13 12:20 109200 --sha-r- c:\windows\SysWOW64\swscale-lav-2.dll
2012-10-05 17:54 188416 --sha-r- c:\windows\SysWOW64\winDCE32.dll
2004-01-24 22:00 70656 --sh--w- c:\windows\SysWOW64\yv12vfw.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2009-06-10 21:23 278864 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Browser Infrastructure Helper"="c:\users\lenovo\AppData\Local\Smartbar\Application\Smartbar.exe" [2014-04-23 20760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-02 98304]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2010-05-05 3122528]
"UCam_Menu"="c:\program files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"YouCam Mirror Tray icon"="c:\program files (x86)\Lenovo\YouCam\YouCamTray.exe" [2009-12-22 167008]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-05-27 737872]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Diamondback"="c:\program files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe" [2009-10-09 226816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"upfst_de_37.exe"="c:\users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe" [2014-06-06 3268600]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files (x86)\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 IePluginServices;IePlugin Services;c:\programdata\IePluginServices\PluginService.exe;c:\programdata\IePluginServices\PluginService.exe [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]
R2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe;c:\windows\SYSNATIVE\IgrsSvcs.exe [x]
R2 WindowsProtectManger;WindowsProtectManger Service;c:\programdata\WindowsProtectManger\wprotectmanager.exe;c:\programdata\WindowsProtectManger\wprotectmanager.exe [x]
R3 ALSysIO;ALSysIO;c:\users\lenovo\AppData\Local\Temp\ALSysIO64.sys;c:\users\lenovo\AppData\Local\Temp\ALSysIO64.sys [x]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys;c:\windows\SYSNATIVE\drivers\WDBridge.sys [x]
R3 IGRS;IGRS;c:\program files (x86)\Lenovo\ReadyComm\common\IGRS.exe;c:\program files (x86)\Lenovo\ReadyComm\common\IGRS.exe [x]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe;c:\program files\Lenovo\ReadyComm\AppSvc.exe [x]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe;c:\windows\SYSNATIVE\IgrsSvcs.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
S1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64;{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64;c:\windows\system32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys;c:\windows\SYSNATIVE\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [x]
S1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64;{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64;c:\windows\system32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys;c:\windows\SYSNATIVE\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 LPTSystemUpdater;LPT System Updater Service;c:\program files (x86)\LPT\srpts.exe;c:\program files (x86)\LPT\srpts.exe [x]
S2 Update ScanTack;Update ScanTack;c:\program files (x86)\ScanTack\updateScanTack.exe;c:\program files (x86)\ScanTack\updateScanTack.exe [x]
S2 Util ScanTack;Util ScanTack;c:\program files (x86)\ScanTack\bin\utilScanTack.exe;c:\program files (x86)\ScanTack\bin\utilScanTack.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys;c:\windows\SYSNATIVE\DRIVERS\SMIksdrv.sys [x]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys;c:\windows\SYSNATIVE\DRIVERS\WDMirror.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
<NO NAME> REG_SZ
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-21 00:50 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-20 09:43]
.
2014-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20 19:06]
.
2014-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20 19:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2010-05-05 16:13 1502720 ----a-w- c:\windows\System32\IcnOvrly.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2010-03-10 520760]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2009-12-17 4367808]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6988736]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-02-21 2991856]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpVFn36cGa_0q8n8QslwcAnngLpFpN0-aJ_ZXQ5j6BOHzEGt2QOsQvuN64uE6DfTy_m9tmQfJouBkHWzXS31BNtay0Gp9Lp8vvg,
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
mDefault_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
mStart Page = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
uSearchAssistant = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - c:\program files (x86)\SupTab\SupTab.dll
BHO-{d332cff8-358e-4c9e-8af3-a08872ef22c1} - c:\program files (x86)\ScanTack\D12017C3-82E3-4D6D-B5D3-0C74A5F97D83.dll
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-11 22:04:50
ComboFix-quarantined-files.txt 2014-06-11 20:04
.
Vor Suchlauf: 10 Verzeichnis(se), 32.704.065.536 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 32.227.057.664 Bytes frei
.
- - End Of File - - 1F58BB1754445733549EAC92D5839F80
A36C5E4F47E84449FF07ED3517B43A31
|
|
11.06.2014, 21:57
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> ScanTrack macht Probleme :/ |
|
11.06.2014, 22:35
| #7 |
| | ScanTrack macht Probleme :/ AdwCleaner: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 11/06/2014 um 23:13:10
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : lenovo - LENOVO-PC
# Gestartet von : C:\Users\lenovo\Desktop\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : IePluginServices
Dienst Gelöscht : LPTSystemUpdater
[#] Dienst Gelöscht : Update ScanTack
[#] Dienst Gelöscht : Util ScanTack
[#] Dienst Gelöscht : WindowsProtectManger
***** [ Dateien / Ordner ] *****
[!] Ordner Gelöscht : C:\ProgramData\IePluginServices
[!] Ordner Gelöscht : C:\ProgramData\WindowsProtectManger
[!] Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications
[!] Ordner Gelöscht : C:\Program Files (x86)\LPT
[!] Ordner Gelöscht : C:\Program Files (x86)\ScanTack
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Local\Freesofttoday
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Local\LPT
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Local\SearchProtect
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Local\Smartbar
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Local\fst_de_37
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Roaming\qone8
[!] Ordner Gelöscht : C:\Users\lenovo\AppData\Roaming\SupTab
Datei Gelöscht : C:\Users\lenovo\AppData\Roaming\aps.uninstall.scan.results
Datei Gelöscht : C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\lenovo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\lenovo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\lenovo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Kevin - Chrome.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\InstallManagerR_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\InstallManagerR_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\package_qone8_installer_multilang_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\package_qone8_installer_multilang_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_Setup302_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_Setup302_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wpm_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wpm_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D332CFF8-358E-4C9E-8AF3-A08872EF22C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D332CFF8-358E-4C9E-8AF3-A08872EF22C1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\FreeSoftToday
Schlüssel Gelöscht : HKCU\Software\ScanTack
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\blockAndSurf
Schlüssel Gelöscht : HKLM\Software\qone8Software
Schlüssel Gelöscht : HKLM\Software\ScanTack
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\Tutorials
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : HKLM\Software\Wpm
***** [ Browser ] *****
-\\ Internet Explorer v8.0.7600.16385
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Google Chrome v35.0.1916.153
[ Datei : C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [12269 octets] - [11/06/2014 23:12:19]
AdwCleaner[S0].txt - [9408 octets] - [11/06/2014 23:13:10]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9468 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by lenovo on 11.06.2014 at 23:18:28,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.06.2014 at 23:26:54,50
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-06-2014 01
Ran by lenovo (administrator) on LENOVO-PC on 11-06-2014 23:27:52
Running from C:\Users\lenovo\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerofa.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2991856 2013-02-21] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-05-05] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Diamondback] => C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe [226816 2009-10-09] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-24]
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-03-12]
CHR Extension: (Logitech SetPoint) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd [2014-02-24]
CHR Extension: (Google Wallet) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-20]
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2014-02-24]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-25] (Microsoft Corporation)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197376 2009-10-16] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [61112 2014-06-09] (StdLib)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [61112 2014-06-09] (StdLib)
S3 ALSysIO; \??\C:\Users\lenovo\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-11 23:26 - 2014-06-11 23:26 - 00000698 _____ () C:\Users\lenovo\Desktop\JRT.txt
2014-06-11 23:18 - 2014-06-11 23:18 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 23:17 - 2014-06-11 23:17 - 01016261 _____ (Thisisu) C:\Users\lenovo\Desktop\JRT.exe
2014-06-11 23:12 - 2014-06-11 23:13 - 00000000 ____D () C:\AdwCleaner
2014-06-11 23:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\SysWOW64\sqlite3.dll
2014-06-11 23:11 - 2014-06-11 23:11 - 01333465 _____ () C:\Users\lenovo\Desktop\adwcleaner_3.212.exe
2014-06-11 22:04 - 2014-06-11 22:04 - 00021024 _____ () C:\ComboFix.txt
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-11 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-11 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-11 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-11 21:50 - 2014-06-11 22:04 - 00000000 ____D () C:\Qoobox
2014-06-11 21:49 - 2014-06-11 22:03 - 00000000 ____D () C:\windows\erdnt
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-11 21:47 - 2014-06-11 21:47 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-11 21:40 - 2014-06-11 21:40 - 05205915 ____R (Swearware) C:\Users\lenovo\Desktop\ComboFix.exe
2014-06-11 18:55 - 2014-06-11 18:55 - 00047312 _____ () C:\Users\lenovo\Documents\gmer.txt
2014-06-11 18:27 - 2014-06-11 18:27 - 00380416 _____ () C:\Users\lenovo\Desktop\Gmer-19357.exe
2014-06-11 18:21 - 2014-06-11 18:22 - 00018630 _____ () C:\Users\lenovo\Desktop\Addition.txt
2014-06-11 18:20 - 2014-06-11 23:27 - 00012272 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:20 - 2014-06-11 23:27 - 00000000 ____D () C:\FRST
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 17:42 - 2014-06-09 12:09 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-11 03:26 - 2014-06-09 12:10 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-11 23:15 - 00001130 _____ () C:\windows\PFRO.log
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:56 - 2014-06-10 01:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:41 - 2014-06-09 23:42 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2007-03-20 19:05 - 00073728 _____ (Razer Inc.) C:\windows\SysWOW64\Diamondback.cpl
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:22 - 2014-06-11 23:15 - 00000448 _____ () C:\windows\setupact.log
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 00:30 - 2014-06-10 07:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 21:35 - 2014-06-04 21:36 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:34 - 2014-06-04 21:39 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-05 07:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:50 - 2014-06-04 20:55 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:49 - 2014-06-04 22:31 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:19 - 2014-06-04 20:25 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:35 - 2014-06-04 21:36 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 18:33 - 2014-06-11 21:42 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-04 18:33 - 2014-06-10 20:22 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-04 18:33 - 2014-06-04 18:36 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 19:45 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:54 - 2014-05-27 15:57 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
==================== One Month Modified Files and Folders =======
2014-06-11 23:28 - 2014-06-11 18:20 - 00012272 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 23:28 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Temp
2014-06-11 23:27 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-11 23:26 - 2014-06-11 23:26 - 00000698 _____ () C:\Users\lenovo\Desktop\JRT.txt
2014-06-11 23:25 - 2014-04-20 11:43 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-11 23:24 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-11 23:24 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-11 23:18 - 2014-06-11 23:18 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 23:17 - 2014-06-11 23:17 - 01016261 _____ (Thisisu) C:\Users\lenovo\Desktop\JRT.exe
2014-06-11 23:15 - 2014-06-10 15:23 - 00001130 _____ () C:\windows\PFRO.log
2014-06-11 23:15 - 2014-06-09 22:22 - 00000448 _____ () C:\windows\setupact.log
2014-06-11 23:15 - 2014-02-20 21:07 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-11 23:15 - 2010-05-05 18:26 - 00509052 _____ () C:\FaceProv.log
2014-06-11 23:15 - 2010-05-05 18:13 - 00000000 ____D () C:\ProgramData\VeriFace
2014-06-11 23:15 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-11 23:14 - 2010-05-05 17:23 - 00353396 _____ () C:\windows\WindowsUpdate.log
2014-06-11 23:13 - 2014-06-11 23:12 - 00000000 ____D () C:\AdwCleaner
2014-06-11 23:13 - 2014-02-20 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-11 23:11 - 2014-06-11 23:11 - 01333465 _____ () C:\Users\lenovo\Desktop\adwcleaner_3.212.exe
2014-06-11 22:52 - 2014-02-20 21:07 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-11 22:04 - 2014-06-11 22:04 - 00021024 _____ () C:\ComboFix.txt
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 21:50 - 00000000 ____D () C:\Qoobox
2014-06-11 22:04 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-06-11 22:03 - 2014-06-11 21:49 - 00000000 ____D () C:\windows\erdnt
2014-06-11 22:02 - 2009-07-14 04:34 - 00000215 _____ () C:\windows\system.ini
2014-06-11 22:01 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-11 21:47 - 2014-06-11 21:47 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-11 21:42 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-11 21:40 - 2014-06-11 21:40 - 05205915 ____R (Swearware) C:\Users\lenovo\Desktop\ComboFix.exe
2014-06-11 18:55 - 2014-06-11 18:55 - 00047312 _____ () C:\Users\lenovo\Documents\gmer.txt
2014-06-11 18:27 - 2014-06-11 18:27 - 00380416 _____ () C:\Users\lenovo\Desktop\Gmer-19357.exe
2014-06-11 18:22 - 2014-06-11 18:21 - 00018630 _____ () C:\Users\lenovo\Desktop\Addition.txt
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:18 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 18:13 - 2009-07-14 04:34 - 00000715 _____ () C:\windows\win.ini
2014-06-10 20:22 - 2014-06-04 18:33 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 07:47 - 2014-06-09 00:30 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-10 01:05 - 2014-06-09 23:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:49 - 2010-05-05 09:06 - 00690574 _____ () C:\windows\system32\perfh007.dat
2014-06-09 23:49 - 2010-05-05 09:06 - 00143916 _____ () C:\windows\system32\perfc007.dat
2014-06-09 23:49 - 2009-07-14 07:13 - 01603176 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-09 23:42 - 2014-06-09 23:41 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2010-05-05 17:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 22:22 - 2014-03-23 01:53 - 00000000 ____D () C:\windows\Minidump
2014-06-09 12:10 - 2014-06-11 03:26 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-09 12:09 - 2014-06-11 17:42 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-05 07:09 - 2014-06-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-05 07:09 - 2014-02-20 23:54 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Winamp
2014-06-05 07:09 - 2010-05-05 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-06-05 07:09 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 23:23 - 2010-05-05 17:39 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-04 22:31 - 2014-06-04 20:49 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 21:39 - 2014-06-04 21:34 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:36 - 2014-06-04 21:35 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:36 - 2014-06-04 18:35 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-04 20:50 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:25 - 2014-06-04 20:19 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 19:45 - 2014-06-04 18:30 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:38 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-04 18:36 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:04 - 2014-04-24 17:26 - 00000000 ____D () C:\Users\lenovo\Tracing
2014-06-03 01:03 - 2009-07-29 09:00 - 00000000 ____D () C:\windows\Panther
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:57 - 2014-05-27 15:54 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
Some content of TEMP:
====================
C:\Users\lenovo\AppData\Local\Temp\avgnt.exe
C:\Users\lenovo\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 01:58
==================== End Of Log ============================
Und nochmal die Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-06-2014 01
Ran by lenovo at 2014-06-11 18:21:45
Running from C:\Users\lenovo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
AMD Catalyst Install Manager (HKLM\...\{FAF03106-1653-15E1-3C0C-E7AE4FAE6EBF}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2010.0302.2233.40412 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.62 - Conexant)
Lenovo EasyCamera (HKLM\...\Lenovo EasyCamera) (Version: 5.8.0.12 - Silicon Motion)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Logitech SetPoint 6.52 (HKLM\...\sp6) (Version: 6.52.74 - Logitech)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{86177DAE-38B1-49DD-912E-35CB703AB779}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
06-06-2014 22:00:00 Geplanter Prüfpunkt
09-06-2014 21:40:55 Installed Razer Diamondback
09-06-2014 21:42:08 Gerätetreiber-Paketinstallation: Razer Eingabegeräte (Human Interface Devices)
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {42936927-C026-4AF0-ADCA-FDFCBE85599D} - System32\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05} => C:\Program Files\V-bates\PrefHelper.exe
Task: {62E0D1B6-E032-477B-9911-28B974D68262} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {668D5013-3AD0-484A-A197-FE30C8A2F58E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-20] (Adobe Systems Incorporated)
Task: {716EDE60-7769-4D29-BC22-1EC1EF3C36D7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {876CE199-EBAC-4220-BD74-488EEE73FDCC} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {B7697EE0-7C0B-4890-B04C-25CEFB45DF8E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {E4FA0B9D-58EC-42AC-BFA3-50E227FD05D0} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {EE16750A-A44A-4EA6-8082-741E1A5FB7FC} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-05-05 18:13 - 2010-05-05 18:13 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2010-05-05 18:13 - 2010-05-05 18:13 - 00622592 _____ () C:\windows\system32\SimpleExt.dll
2014-06-10 07:03 - 2014-06-11 03:29 - 00317728 _____ () C:\Program Files (x86)\ScanTack\updateScanTack.exe
2014-06-10 15:24 - 2014-06-11 03:24 - 00317728 _____ () C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe
2014-06-09 00:30 - 2014-06-06 11:18 - 03268600 _____ () C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2014-06-09 23:41 - 2009-10-09 20:11 - 00226816 _____ () C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
2014-06-11 03:26 - 2014-06-09 12:09 - 00287008 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe
2010-05-05 17:42 - 2010-05-05 17:42 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00012568 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe
2014-06-11 03:26 - 2014-06-11 01:16 - 00096544 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe
2010-05-05 18:13 - 2010-05-05 18:13 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libcef.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libglesv2.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libegl.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00022296 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\lrcnt.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00059672 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\sppsm.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00016664 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00051480 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\srut.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00165656 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-06-11 17:55 - 2014-06-11 01:16 - 00183584 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTackBAApp.dll
2010-05-05 17:50 - 2009-06-05 18:37 - 00260096 _____ () C:\windows\system32\370prop.ax
2014-05-21 03:11 - 2014-05-14 01:40 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/11/2014 05:40:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b7e6
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 06:53:12 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (06/10/2014 06:51:44 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (06/10/2014 03:24:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b48e
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x1118
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x15a8
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0x80000001
Fehleroffset: 0x0009b699
ID des fehlerhaften Prozesses: 0x1d64
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x145c
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:46:58 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm majfst.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1ca0
Startzeit: 01cf846ea2c65991
Endzeit: 31
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-0VV1A.tmp\majfst.tmp
Berichts-ID:
Error: (06/10/2014 07:46:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm package_scantack_installer_multilang.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1208
Startzeit: 01cf846f38917f6a
Endzeit: 32
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-NKJSG.tmp\package_scantack_installer_multilang.tmp
Berichts-ID:
System errors:
=============
Error: (06/11/2014 05:41:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 03:24:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:23:58 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 10.06.2014 um 07:57:09 unerwartet heruntergefahren.
Error: (06/10/2014 07:46:19 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Search Protect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 3836.2 MB
Available physical RAM: 2237.24 MB
Total Pagefile: 7670.55 MB
Available Pagefile: 5621.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:254.14 GB) (Free:30.09 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:0.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: F63AC172)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=254 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
|
|
12.06.2014, 10:55
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [61112 2014-06-09] (StdLib)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [61112 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
C:\Program Files (x86)\ScanTack
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.06.2014, 13:20
| #9 |
| | ScanTrack macht Probleme :/ Hier der Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-06-2014 01
Ran by lenovo at 2014-06-12 14:16:31 Run:1
Running from C:\Users\lenovo\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [61112 2014-06-09] (StdLib)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [61112 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
C:\Program Files (x86)\ScanTack
*****************
C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64 => Service stopped successfully.
{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64 => Service deleted successfully.
{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64 => Service stopped successfully.
{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64 => Service deleted successfully.
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys => Moved successfully.
C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys => Moved successfully.
"C:\Program Files (x86)\ScanTack" => File/Directory not found.
The system needed a reboot.
==== End of Fixlog ====
|
|
12.06.2014, 14:49
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
12.06.2014, 17:28
| #11 |
| | ScanTrack macht Probleme :/ Hier sind die logs FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-06-2014 01
Ran by lenovo (administrator) on LENOVO-PC on 12-06-2014 18:19:25
Running from C:\Users\lenovo\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerofa.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2991856 2013-02-21] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-05-05] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Diamondback] => C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe [226816 2009-10-09] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-24]
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-03-12]
CHR Extension: (Logitech SetPoint) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd [2014-02-24]
CHR Extension: (Google Wallet) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-20]
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2014-02-24]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-25] (Microsoft Corporation)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197376 2009-10-16] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
S3 ALSysIO; \??\C:\Users\lenovo\AppData\Local\Temp\ALSysIO64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-11 23:26 - 2014-06-11 23:26 - 00000698 _____ () C:\Users\lenovo\Desktop\JRT.txt
2014-06-11 23:18 - 2014-06-11 23:18 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 23:17 - 2014-06-11 23:17 - 01016261 _____ (Thisisu) C:\Users\lenovo\Desktop\JRT.exe
2014-06-11 23:12 - 2014-06-11 23:13 - 00000000 ____D () C:\AdwCleaner
2014-06-11 23:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\SysWOW64\sqlite3.dll
2014-06-11 23:11 - 2014-06-11 23:11 - 01333465 _____ () C:\Users\lenovo\Desktop\adwcleaner_3.212.exe
2014-06-11 22:04 - 2014-06-11 22:04 - 00021024 _____ () C:\ComboFix.txt
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-11 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-11 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-11 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-11 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-11 21:50 - 2014-06-11 22:04 - 00000000 ____D () C:\Qoobox
2014-06-11 21:49 - 2014-06-11 22:03 - 00000000 ____D () C:\windows\erdnt
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-11 21:47 - 2014-06-11 21:47 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-11 21:40 - 2014-06-11 21:40 - 05205915 ____R (Swearware) C:\Users\lenovo\Desktop\ComboFix.exe
2014-06-11 18:55 - 2014-06-11 18:55 - 00047312 _____ () C:\Users\lenovo\Documents\gmer.txt
2014-06-11 18:27 - 2014-06-11 18:27 - 00380416 _____ () C:\Users\lenovo\Desktop\Gmer-19357.exe
2014-06-11 18:21 - 2014-06-11 18:22 - 00018630 _____ () C:\Users\lenovo\Desktop\Addition.txt
2014-06-11 18:20 - 2014-06-12 18:20 - 00012087 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:20 - 2014-06-12 18:19 - 00000000 ____D () C:\FRST
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-11 23:15 - 00001130 _____ () C:\windows\PFRO.log
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:56 - 2014-06-10 01:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:41 - 2014-06-09 23:42 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2007-03-20 19:05 - 00073728 _____ (Razer Inc.) C:\windows\SysWOW64\Diamondback.cpl
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:22 - 2014-06-12 14:17 - 00000560 _____ () C:\windows\setupact.log
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 00:30 - 2014-06-12 14:19 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 21:35 - 2014-06-04 21:36 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:34 - 2014-06-04 21:39 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-05 07:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:50 - 2014-06-04 20:55 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:49 - 2014-06-04 22:31 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:19 - 2014-06-04 20:25 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:35 - 2014-06-04 21:36 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 18:33 - 2014-06-11 21:42 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-04 18:33 - 2014-06-10 20:22 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-04 18:33 - 2014-06-04 18:36 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 19:45 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:54 - 2014-05-27 15:57 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
==================== One Month Modified Files and Folders =======
2014-06-12 18:20 - 2014-06-11 18:20 - 00012087 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-12 18:20 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Temp
2014-06-12 18:19 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-12 17:49 - 2014-02-20 21:07 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-12 17:49 - 2014-02-20 21:07 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-12 17:25 - 2014-04-20 11:43 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-12 14:26 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 14:26 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 14:22 - 2010-05-05 17:23 - 00361143 _____ () C:\windows\WindowsUpdate.log
2014-06-12 14:19 - 2014-06-09 00:30 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-12 14:18 - 2010-05-05 18:26 - 00520416 _____ () C:\FaceProv.log
2014-06-12 14:18 - 2010-05-05 18:13 - 00000000 ____D () C:\ProgramData\VeriFace
2014-06-12 14:18 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-12 14:17 - 2014-06-09 22:22 - 00000560 _____ () C:\windows\setupact.log
2014-06-12 14:16 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-11 23:26 - 2014-06-11 23:26 - 00000698 _____ () C:\Users\lenovo\Desktop\JRT.txt
2014-06-11 23:18 - 2014-06-11 23:18 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 23:17 - 2014-06-11 23:17 - 01016261 _____ (Thisisu) C:\Users\lenovo\Desktop\JRT.exe
2014-06-11 23:15 - 2014-06-10 15:23 - 00001130 _____ () C:\windows\PFRO.log
2014-06-11 23:13 - 2014-06-11 23:12 - 00000000 ____D () C:\AdwCleaner
2014-06-11 23:13 - 2014-02-20 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-11 23:11 - 2014-06-11 23:11 - 01333465 _____ () C:\Users\lenovo\Desktop\adwcleaner_3.212.exe
2014-06-11 22:04 - 2014-06-11 22:04 - 00021024 _____ () C:\ComboFix.txt
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 22:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-11 22:04 - 2014-06-11 21:50 - 00000000 ____D () C:\Qoobox
2014-06-11 22:04 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-06-11 22:03 - 2014-06-11 21:49 - 00000000 ____D () C:\windows\erdnt
2014-06-11 22:02 - 2009-07-14 04:34 - 00000215 _____ () C:\windows\system.ini
2014-06-11 22:01 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 21:49 - 2014-06-11 21:49 - 00000000 ___RD () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-11 21:47 - 2014-06-11 21:47 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-11 21:42 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-11 21:40 - 2014-06-11 21:40 - 05205915 ____R (Swearware) C:\Users\lenovo\Desktop\ComboFix.exe
2014-06-11 18:55 - 2014-06-11 18:55 - 00047312 _____ () C:\Users\lenovo\Documents\gmer.txt
2014-06-11 18:27 - 2014-06-11 18:27 - 00380416 _____ () C:\Users\lenovo\Desktop\Gmer-19357.exe
2014-06-11 18:22 - 2014-06-11 18:21 - 00018630 _____ () C:\Users\lenovo\Desktop\Addition.txt
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:18 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 18:13 - 2009-07-14 04:34 - 00000715 _____ () C:\windows\win.ini
2014-06-10 20:22 - 2014-06-04 18:33 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 01:05 - 2014-06-09 23:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:49 - 2010-05-05 09:06 - 00690574 _____ () C:\windows\system32\perfh007.dat
2014-06-09 23:49 - 2010-05-05 09:06 - 00143916 _____ () C:\windows\system32\perfc007.dat
2014-06-09 23:49 - 2009-07-14 07:13 - 01603176 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-09 23:42 - 2014-06-09 23:41 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2010-05-05 17:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 22:22 - 2014-03-23 01:53 - 00000000 ____D () C:\windows\Minidump
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-05 07:09 - 2014-06-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-05 07:09 - 2014-02-20 23:54 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Winamp
2014-06-05 07:09 - 2010-05-05 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-06-05 07:09 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 23:23 - 2010-05-05 17:39 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-04 22:31 - 2014-06-04 20:49 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 21:39 - 2014-06-04 21:34 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:36 - 2014-06-04 21:35 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:36 - 2014-06-04 18:35 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-04 20:50 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:25 - 2014-06-04 20:19 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 19:45 - 2014-06-04 18:30 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:38 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-04 18:36 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:04 - 2014-04-24 17:26 - 00000000 ____D () C:\Users\lenovo\Tracing
2014-06-03 01:03 - 2009-07-29 09:00 - 00000000 ____D () C:\windows\Panther
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:57 - 2014-05-27 15:54 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
Some content of TEMP:
====================
C:\Users\lenovo\AppData\Local\Temp\avgnt.exe
C:\Users\lenovo\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 01:58
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-06-2014 01
Ran by lenovo at 2014-06-12 18:20:38
Running from C:\Users\lenovo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
AMD Catalyst Install Manager (HKLM\...\{FAF03106-1653-15E1-3C0C-E7AE4FAE6EBF}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2010.0302.2233.40412 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.62 - Conexant)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Lenovo EasyCamera (HKLM\...\Lenovo EasyCamera) (Version: 5.8.0.12 - Silicon Motion)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Logitech SetPoint 6.52 (HKLM\...\sp6) (Version: 6.52.74 - Logitech)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{86177DAE-38B1-49DD-912E-35CB703AB779}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
06-06-2014 22:00:00 Geplanter Prüfpunkt
09-06-2014 21:40:55 Installed Razer Diamondback
09-06-2014 21:42:08 Gerätetreiber-Paketinstallation: Razer Eingabegeräte (Human Interface Devices)
11-06-2014 19:51:22 ComboFix created restore point
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-06-11 22:02 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {62E0D1B6-E032-477B-9911-28B974D68262} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {668D5013-3AD0-484A-A197-FE30C8A2F58E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-20] (Adobe Systems Incorporated)
Task: {716EDE60-7769-4D29-BC22-1EC1EF3C36D7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {B7697EE0-7C0B-4890-B04C-25CEFB45DF8E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-05-05 18:13 - 2010-05-05 18:13 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2010-05-05 18:13 - 2010-05-05 18:13 - 00622592 _____ () C:\windows\system32\SimpleExt.dll
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2014-06-09 23:41 - 2009-10-09 20:11 - 00226816 _____ () C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
2010-05-05 17:42 - 2010-05-05 17:42 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-05-05 18:13 - 2010-05-05 18:13 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2010-05-05 17:50 - 2009-06-05 18:37 - 00260096 _____ () C:\windows\system32\370prop.ax
2014-06-11 22:52 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-11 22:52 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-11 22:52 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-11 22:52 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-11 22:52 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/12/2014 03:10:05 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (06/12/2014 03:09:29 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (06/12/2014 03:08:03 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
System errors:
=============
Error: (06/12/2014 02:18:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/12/2014 02:18:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/12/2014 02:12:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/12/2014 02:12:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-06-11 22:01:32.089
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-11 22:01:32.073
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 33%
Total physical RAM: 3836.2 MB
Available physical RAM: 2554.36 MB
Total Pagefile: 7670.55 MB
Available Pagefile: 5901.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:254.14 GB) (Free:28.64 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:0.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: F63AC172)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=254 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
|
|
13.06.2014, 10:27
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Okay, dann jetzt Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.06.2014, 18:00
| #13 |
| | ScanTrack macht Probleme :/ Ok. Habe das jetzt alles gemacht, allerdings hat bei bei dem Malwarebytes mein Antivir wegen nem registry-block irgendwie alarm geschlagen. Aber hier nun die logs. Mbam: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 13.06.2014 Suchlauf-Zeit: 15:04:58 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.06.13.05 Rootkit Datenbank: v2014.06.02.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 CPU: x64 Dateisystem: NTFS Benutzer: lenovo Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 271362 Verstrichene Zeit: 19 Min, 34 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 PUP.Optional.FreeSoftToday.A, HKLM\SOFTWARE\WOW6432NODE\FST\fst_de_37, In Quarantäne, [03f62255e29940f63709970bf2104eb2], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 1 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[41b867102754f145690fee87c53f7e82] Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.SnapDo.A, C:\Windows\Installer\a5c09.msi, In Quarantäne, [48b17ff8116a999d1a2999edce3328d8], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=8c8eedf1e2b3184998579b32e559c3a6
# engine=18702
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-13 03:55:51
# local_time=2014-06-13 05:55:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 9643246 154304801 0 0
# scanned=142259
# found=49
# cleaned=0
# scan_time=8489
sh=51709AA00ACA72837AF0E1FA61A458E125FF6867 ft=1 fh=47db414701f38526 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbs.dll.vir"
sh=CF4DB5CE7006F8D49D1BD041F5D85482E7EA6327 ft=1 fh=e7d937339ddb948c vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\updateScanTack.exe.vir"
sh=A084A93E58644CABFABF5C62D7ACD6A213FBB062 ft=1 fh=f91d2b28c4a3c2db vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe.vir"
sh=DEEF47788DFC69239775BA995D2463D3DCD40135 ft=1 fh=7aeb6164ef5f49e4 vn="Variante von Win64/BrowseFox.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe.vir"
sh=0D7135F44CB63815E0FE9DDF6237E8D2D8816438 ft=1 fh=72b4dd76e02414ef vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\bin\ScanTackBAApp.dll.vir"
sh=CF4DB5CE7006F8D49D1BD041F5D85482E7EA6327 ft=1 fh=e7d937339ddb948c vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\bin\utilScanTack.exe.vir"
sh=D7D965F634A4650F2DF3EBD824A5F79D9C482F9F ft=1 fh=d6601a881125236f vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ScanTack\bin\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}.dll.vir"
sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=3F06B50C5CD73976711AC63C7FA1D3A2502DAC85 ft=1 fh=7612c4ddc3f495f3 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe.vir"
sh=26F72F1DD3FCF9F7CBE1CD5ADE1EE4EAF53F7198 ft=1 fh=51f7f3e1388c262e vn="Win32/InstallMonetizer.AX evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\fst_de_37\Download\majfst.exe.vir"
sh=51709AA00ACA72837AF0E1FA61A458E125FF6867 ft=1 fh=47db414701f38526 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\LPT\srbs.dll.vir"
sh=90D617042236ECEECA6281D4AA409AC2462F1D45 ft=1 fh=cbe4a92e457220a6 vn="Variante von MSIL/Toolbar.Linkury.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\BrowserHelper.exe.vir"
sh=2C5A5DCCFA2C7A761A055779E2183F75EE5ADC1F ft=1 fh=11efb147a594a3b4 vn="Variante von Win32/Toolbar.Linkury.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.exe.vir"
sh=02FD6AE390BF39CCBA030E3B30809907D1714A2E ft=1 fh=b4c7b90a363c8707 vn="Variante von Win32/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll.vir"
sh=973CB7FFE5935CFEAB40748A3A82EFEBBC8DB5AC ft=1 fh=963d448465dfce92 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll.vir"
sh=973CB7FFE5935CFEAB40748A3A82EFEBBC8DB5AC ft=1 fh=963d448465dfce92 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll.vir"
sh=FE14FB13C3E87B1B4D5B1D9B4AE4FB824FBDF1A4 ft=1 fh=03f5383ec359c58f vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=FE14FB13C3E87B1B4D5B1D9B4AE4FB824FBDF1A4 ft=1 fh=03f5383ec359c58f vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=96EB8021F9452FF9488654422285E3BC3E88ADBC ft=1 fh=a2a34a7c21965425 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe.vir"
sh=51709AA00ACA72837AF0E1FA61A458E125FF6867 ft=1 fh=47db414701f38526 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\srbs.dll.vir"
sh=FFA29462419BB5F68627B32D0223CB91A0D7AADD ft=1 fh=f37a614dc756caa9 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=743A688D6D964EE3338CF0D393DB7424BA33B110 ft=1 fh=5ff37a8cbf598d20 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=8482444939D080F36716309408D0E228D4BEA98F ft=1 fh=bdaab2a66f11dc5b vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=63712052A353D759DF80D926C40D3801195C2613 ft=1 fh=e3ce1d777f544045 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=FAB39A2B29147472E022212931FD90781C1C8A7C ft=1 fh=f2b01a9acb1fbcb6 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=5367796B2A4F3EDD29B630637097274440758940 ft=1 fh=a38fde601776f903 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=BA8871127FB23B24A8963B6A5992DED58259E590 ft=1 fh=65df87dcc97c6ea8 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=4B9D59EFA89F628628CE74083961743D56E460C7 ft=1 fh=8e9074b2b2075a48 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=7290509DD9B7F8DCFA781334EBEFF3E5D4C58C5C ft=1 fh=0aae782d31fb93bd vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=32602D4077332EE0F75304C87434755510F768FD ft=1 fh=4d22cbd3b33f2e9e vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=A5517659524BFD05ABEF457FE26F1D0E80D3EF85 ft=1 fh=af4585d56f4a69b5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=71CCADAAF795894CF3E4C21388091FBB99AC811E ft=1 fh=e914faad78993ba3 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=A7A2E08FBFDF53F6487F997282726AFBA2D1BE6D ft=1 fh=372c94dd255ca241 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=6EC26F6CF4D7A7AFC71024730F7E25098D043D95 ft=1 fh=5dde4b05fb6068ec vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=2C0BBB1E1F7E1ECEBB3DFE9CF92847598322B6CB ft=1 fh=838192228873b77d vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=04425ABDF2E2F90CD68481EB49D9D3724D3A9895 ft=1 fh=36eea6a241280446 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\lenovo\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll.vir"
sh=249C9D47BFEE287E5B1E2D0946F0AA3AD95BA31D ft=1 fh=cf581cbe610824c6 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\lenovo\AppData\Local\nsb7556.tmp.vir"
sh=30EF281C81897B394B1B7EC2F2DEC8BD0F79C867 ft=0 fh=0000000000000000 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\a5c0f.msi"
sh=2CE1C3A47EFF2DDC673EAD149CE11E75BF2354C7 ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2011-06-26 190001\Backup Files 2011-06-26 190001\Backup files 1.zip"
sh=57BE72E3C6F2830BEEFD30DA5441BED73A059A17 ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2011-12-25 190000\Backup Files 2011-12-25 190000\Backup files 1.zip"
sh=357DA2AD7A954EB31CECFBC1C572D389E555CF5A ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2011-12-25 190000\Backup Files 2011-12-25 190000\Backup files 2.zip"
sh=C03F8EE2DD5CEFB92CDA605F1CADB25C48EB51A1 ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-02-19 190001\Backup Files 2012-02-19 190001\Backup files 2.zip"
sh=1E6547F870ED2ED45287E0C81AF287647CFDE63A ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-04-29 190001\Backup Files 2012-04-29 190001\Backup files 2.zip"
sh=344B0BF9E32D926481E192AFBBBFFA9482B9C253 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-04-29 190001\Backup Files 2012-04-29 200632\Backup files 1.zip"
sh=879E5D2232AA08B327F41471D7B41FF9D6C68C2D ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-07-15 190000\Backup Files 2012-07-15 190000\Backup files 2.zip"
sh=21842DF8F76E983789163ED315289B9D44B9C65F ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-09-23 210838\Backup Files 2012-09-23 210838\Backup files 1.zip"
sh=288593C1A371BDD19D96E7E2F2F6D6D2B35CD3EC ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2012-11-25 190001\Backup Files 2012-11-25 190001\Backup files 1.zip"
sh=F3DA596E2A6642579FCE098A5BA9DEA96A91647D ft=0 fh=0000000000000000 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="D:\VOLLER-PC\Backup Set 2013-01-27 195235\Backup Files 2013-01-27 195235\Backup files 1.zip"
|
|
13.06.2014, 19:45
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ScanTrack macht Probleme :/ Avira am besten deinstallieren, es gibt eh bessere Produkte, dann den Scan mit Malwarebytes wiederholen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
17.06.2014, 14:52
| #15 |
| | ScanTrack macht Probleme :/ ähm iwie bekomm ich das mit antivir deinstallieren net so ganz hin :/ |
|
Linear-Darstellung
