| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Internet langsam / Computer lahmtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
10.07.2014, 14:50
| #1 |
| |  Windows 7: Internet langsam / Computer lahmt Hallo Trojaner-Board, mein Problem liegt darin, dass ich vor kurzem, ich weiß nicht warum, ein sehr (!) langsames Internet hatte. Meiner Familie geht es nicht so, diese haben alle einen normalen Internetzugriff. Ich habe mir auf den Verdacht daraufhin sofort Kaspersky (da mein altes Virenprogramm abgelaufen war) als Demo gedownloadet und den Computer überprüft. Ergebnis: 0 Schädlinge Nun ist meine Frage, ob ich da nicht noch irgendwie tiefer reingehen muss. Ich befürchte nämlich stark, dass dahinter ein Virus steht. Hier die entsprechenden Logs sind als Dateianhang vorhanden. Ich bitte um eure Hilfe Mit freundlichen Grüßen NickHilfe. |
|
10.07.2014, 14:52
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Internet langsam / Computer lahmt Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
10.07.2014, 16:53
| #3 |
| | Windows 7: Internet langsam / Computer lahmt Natürlich.
__________________Hier sind die anderen Codes. defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:41 on 08/07/2014 (Nick)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014 01
Ran by Nick (administrator) on LAUCH on 08-07-2014 20:42:41
Running from C:\Users\Nick\Desktop\Trojaner-Board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Avid Technology, Inc.) C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(M-Audio) C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\Bluetooth Headset Helper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-05-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-05-25] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-05-25] (Lenovo)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-05-25] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DigidesignMMERefresh] => C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [286720 2007-06-29] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2013-10-23] (ROCCAT GmbH)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816272 2014-06-23] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [ESL Wire] => C:\Program Files\EslWire\wire.exe [4253696 2013-07-09] (Turtle Entertainment GmbH)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [GoogleChromeAutoLaunch_B9D48092DF53DE2F032C3C1B28E5E1A1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [39712 2014-06-10] (Overwolf LTD)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()
ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ie
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=58&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&q={searchTerms}&SSPV=SP21511B_sp_ie
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=58&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&q={searchTerms}&SSPV=SP21511B_sp_ie
SearchScopes: HKCU - {2B65D609-89B6-43A7-A527-C618C5AFDD77} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A010DE714&p={SearchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE487
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE487
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Nick\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-30]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-06-29]
Chrome:
=======
CHR HomePage: hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ch
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: mcafee
CHR DefaultSearchProvider: McAfee
CHR DefaultSearchURL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A210DE714&p={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Kaspersky Protection) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-06-29]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-06-29]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-06-29]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-06-29]
CHR Extension: (Virtual Keyboard) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-06-29]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-21]
CHR Extension: (Google Wallet) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (MySearchDial) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2014-06-29]
CHR Extension: (Anti-Banner) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-06-29]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Nick\AppData\Local\mysearchdial-speeddial.crx [2013-11-28]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Nick\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-29]
CHR HKCU\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Nick\AppData\Local\mysearchdial-speeddial.crx [2013-11-28]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [2013-11-28]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Nick\AppData\Local\mysearchdial-speeddial.crx [2013-11-28]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-06-17]
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-06-29] (Kaspersky Lab ZAO)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
S4 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-02-13] (Lenovo (Beijing) Limited)
R2 DigiRefresh; C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.) [File not signed]
S3 digiSPTIService; C:\Program Files (x86)\Digidesign\Pro Tools\digiSPTIService.exe [159744 2011-03-04] (Avid Technology, Inc.) [File not signed]
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-15] (LogMeIn, Inc.)
R2 MobilePreIIAudioDevMon; C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe [1923592 2010-06-21] (M-Audio)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [976672 2014-06-10] (Overwolf LTD)
R2 PaceLicenseDServices; C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [2647552 2010-11-08] (PACE Anti-Piracy, Inc.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-10] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [215128 2013-05-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
==================== Drivers (Whitelisted) ====================
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S3 Ctafiltv; C:\Windows\System32\drivers\Ctafiltv.sys [24064 2008-08-14] (Creative Technology Ltd.)
S4 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
S4 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2012-09-04] (<Turtle Entertainment>)
S2 hwpsgt; C:\Windows\SysWOW64\DRIVERS\hwpsgt.sys [137344 2013-09-21] () [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-06-29] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-06-29] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-06-29] (Kaspersky Lab ZAO)
S2 lemsgt; C:\Windows\SysWOW64\DRIVERS\lemsgt.sys [9472 2013-09-21] () [File not signed]
S3 MAUSBMOBILEPREII; C:\Windows\System32\DRIVERS\MAudioMobilePreII.sys [484360 2010-06-21] (M-Audio)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VCSVADHWSer; C:\Windows\System32\DRIVERS\vcsvad.sys [21504 2008-12-26] (Avnex) [File not signed]
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc;
U4 bdselfpr;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-08 20:42 - 2014-07-08 20:42 - 00000000 ____D () C:\FRST
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:40 - 2014-07-08 20:42 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:31 - 2014-06-29 23:33 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:10 - 2014-06-29 23:26 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 18:11 - 2014-06-29 23:36 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:09 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-07-08 19:48 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-29 18:07 - 2014-06-29 23:03 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 18:07 - 2014-06-29 23:03 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:09 - 2014-06-29 17:45 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 14:14 - 2014-06-29 15:34 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-07-08 18:57 - 00000896 _____ () C:\Windows\setupact.log
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2014-07-03 17:26 - 00716460 _____ () C:\Windows\PFRO.log
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-25 19:07 - 2014-06-25 19:11 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:16 - 2014-06-25 18:17 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:39 - 2014-06-22 14:40 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-18 00:29 - 2014-06-29 23:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:53 - 2014-06-15 18:54 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:50 - 2014-06-15 18:52 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
2014-06-13 14:27 - 2014-06-18 10:35 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-06-13 14:27 - 2014-06-13 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!
2014-06-12 01:58 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 01:58 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 01:58 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 01:58 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 01:58 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 01:58 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 01:58 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 01:58 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 01:58 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 01:58 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 01:58 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 01:58 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 01:58 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 01:58 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 01:58 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 01:58 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 01:58 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 01:58 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 01:58 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 01:58 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 01:58 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 01:58 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-12 01:58 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 01:58 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 01:58 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-12 01:58 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 01:58 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 01:58 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 01:58 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 01:58 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 01:58 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 01:58 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 01:58 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-12 01:58 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 01:58 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 01:58 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 01:58 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 01:58 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 01:58 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 01:58 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 01:58 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 01:58 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 01:58 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 01:58 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-12 01:58 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 01:58 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 01:58 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 01:58 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 01:58 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 01:58 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 01:58 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 01:58 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-12 01:55 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 01:55 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 01:55 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 01:55 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 01:55 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 01:55 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 01:55 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 01:55 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 01:55 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 01:55 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 01:55 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 01:55 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-12 01:50 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 01:50 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-10 13:04 - 2014-06-10 13:04 - 00279379 _____ () C:\Users\Nick\Downloads\VirtualAudioCable409.zip
2014-06-10 13:02 - 2014-06-10 13:02 - 00961360 _____ (Chip Digital GmbH) C:\Users\Nick\Downloads\Virtual Audio Cable - CHIP-Installer.exe
2014-06-09 02:06 - 2014-06-09 02:07 - 00000000 ____D () C:\Users\Nick\AppData\Local\{59207876-E84C-49FC-9F84-0EA6B0E3B779}
2014-06-08 21:27 - 2014-06-08 21:27 - 00000000 ____D () C:\Program Files\RdDrv001
2014-06-08 15:19 - 2014-06-08 15:19 - 00000419 _____ () C:\Users\Nick\Downloads\listen-dsl.pls
==================== One Month Modified Files and Folders =======
2014-07-08 20:43 - 2014-05-21 18:43 - 00005120 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Lauch-Nick Lauch
2014-07-08 20:42 - 2014-07-08 20:42 - 00000000 ____D () C:\FRST
2014-07-08 20:42 - 2014-07-08 20:40 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:41 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick
2014-07-08 20:30 - 2013-11-28 13:30 - 00000288 _____ () C:\Windows\Tasks\MySearchDial.job
2014-07-08 20:14 - 2012-09-14 23:31 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-08 20:14 - 2012-09-14 23:31 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-08 20:12 - 2012-06-09 18:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-08 19:54 - 2012-05-25 16:26 - 01123794 _____ () C:\Windows\WindowsUpdate.log
2014-07-08 19:52 - 2014-03-27 23:07 - 00008704 ___SH () C:\Users\Nick\Thumbs.db
2014-07-08 19:48 - 2014-06-29 18:07 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-07-08 19:15 - 2014-03-25 21:23 - 00000000 ____D () C:\Users\Nick\AppData\Local\CrashDumps
2014-07-08 19:14 - 2012-06-22 08:03 - 00000000 ____D () C:\Users\Nick\AppData\Local\LogMeIn Hamachi
2014-07-08 19:14 - 2012-06-12 15:03 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype
2014-07-08 19:07 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-08 19:07 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-08 19:01 - 2013-10-19 00:02 - 00000000 ____D () C:\Users\Nick\AppData\Local\Overwolf
2014-07-08 19:00 - 2012-09-08 16:10 - 00000000 ____D () C:\Users\Nick\AppData\Local\ESL Wire Game Client
2014-07-08 18:59 - 2012-05-25 17:06 - 00000000 ____D () C:\ProgramData\VeriFace
2014-07-08 18:58 - 2012-06-08 16:37 - 02247989 _____ () C:\FaceProv.log
2014-07-08 18:58 - 2012-05-25 17:11 - 00418338 _____ () C:\Windows\system32\fastboot.set
2014-07-08 18:57 - 2014-06-29 13:57 - 00000896 _____ () C:\Windows\setupact.log
2014-07-08 18:57 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-07-07 20:30 - 2012-05-26 02:14 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-07-07 20:30 - 2012-05-26 02:14 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-07-07 20:30 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-07 19:54 - 2013-11-01 18:11 - 00000000 ____D () C:\Program Files\Recuva
2014-07-06 18:16 - 2014-04-08 18:58 - 00000000 ____D () C:\Users\Nick\Desktop\Schule
2014-07-03 17:26 - 2014-06-29 13:56 - 00716460 _____ () C:\Windows\PFRO.log
2014-07-01 21:26 - 2014-03-29 10:04 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft
2014-07-01 19:28 - 2012-06-14 09:55 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TS3Client
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-18 00:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-29 23:43 - 2012-06-08 21:07 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Mozilla
2014-06-29 23:36 - 2014-06-29 18:11 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 23:33 - 2014-06-29 23:31 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:33 - 2009-07-14 04:34 - 00000439 _____ () C:\Windows\win.ini
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:26 - 2014-06-29 23:10 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 23:03 - 2014-06-29 18:07 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 23:03 - 2014-06-29 18:07 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 23:03 - 2013-06-10 12:27 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2014-06-29 23:03 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-06-29 23:03 - 2013-05-06 09:22 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-06-29 20:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-06-29 17:47 - 2013-02-11 17:33 - 00000000 ____D () C:\Program Files\McAfee
2014-06-29 17:45 - 2014-06-29 17:09 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 16:26 - 2014-03-22 21:33 - 00000000 ____D () C:\ProgramData\Norton
2014-06-29 15:34 - 2014-06-29 14:14 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files\Google
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-29 13:55 - 2012-06-14 14:35 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-06-29 13:51 - 2013-11-16 12:16 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Winamp
2014-06-29 13:51 - 2013-04-09 09:32 - 00000000 ____D () C:\Windows\Minidump
2014-06-29 13:51 - 2011-02-24 19:03 - 00000000 ____D () C:\Windows\Panther
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:47 - 2012-06-08 20:52 - 00000000 ____D () C:\Users\Nick\AppData\Local\Google
2014-06-29 13:46 - 2012-06-18 21:44 - 00000000 ____D () C:\Program Files (x86)\Thoosje Sevenbar
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 13:45 - 2014-06-07 22:20 - 00000000 ____D () C:\Program Files (x86)\FreeRIP3
2014-06-29 12:00 - 2012-06-08 16:42 - 00851192 _____ () C:\Users\Nick\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-29 11:58 - 2009-07-14 06:45 - 06627640 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:57 - 2012-05-25 16:50 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-06-28 22:57 - 2012-05-25 16:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-28 22:56 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:53 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-28 22:53 - 2012-07-06 19:45 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\DVDVideoSoft
2014-06-28 22:52 - 2012-11-01 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-06-28 22:48 - 2012-07-06 19:46 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\OpenCandy
2014-06-25 20:14 - 2012-06-14 09:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TeamSpeak 3 Client
2014-06-25 19:11 - 2014-06-25 19:07 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:17 - 2014-06-25 18:16 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 21:08 - 2012-06-09 10:11 - 00000000 ____D () C:\Users\Nick\.gimp-2.6
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:40 - 2014-06-22 14:39 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-21 19:48 - 2012-06-08 21:22 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\MAXON
2014-06-20 12:35 - 2014-04-08 19:02 - 00000000 ____D () C:\Users\Nick\Desktop\Spiele
2014-06-19 12:57 - 2013-08-23 19:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-18 20:09 - 2012-05-25 17:09 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 20:09 - 2012-05-25 17:09 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-18 10:35 - 2014-06-13 14:27 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-06-18 00:41 - 2013-10-19 00:08 - 00000000 ____D () C:\Program Files (x86)\Overwolf
2014-06-17 21:54 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Local\VirtualStore
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:54 - 2014-06-15 18:53 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:52 - 2014-06-15 18:50 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
2014-06-13 14:27 - 2014-06-13 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!
2014-06-12 04:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-12 03:04 - 2013-08-15 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 03:02 - 2012-07-03 19:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 03:00 - 2014-05-06 21:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 13:04 - 2014-06-10 13:04 - 00279379 _____ () C:\Users\Nick\Downloads\VirtualAudioCable409.zip
2014-06-10 13:02 - 2014-06-10 13:02 - 00961360 _____ (Chip Digital GmbH) C:\Users\Nick\Downloads\Virtual Audio Cable - CHIP-Installer.exe
2014-06-09 02:07 - 2014-06-09 02:06 - 00000000 ____D () C:\Users\Nick\AppData\Local\{59207876-E84C-49FC-9F84-0EA6B0E3B779}
2014-06-09 02:06 - 2014-04-14 00:14 - 00000000 ____D () C:\Users\Nick\AppData\Local\Windows Live
2014-06-08 21:27 - 2014-06-08 21:27 - 00000000 ____D () C:\Program Files\RdDrv001
2014-06-08 15:19 - 2014-06-08 15:19 - 00000419 _____ () C:\Users\Nick\Downloads\listen-dsl.pls
2014-06-08 11:13 - 2014-06-12 01:50 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 01:50 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Files to move or delete:
====================
C:\Users\Nick\kg DI Video Essentials 2.exe
C:\Users\Nick\kg DI Video Essentials 3.exe
Some content of TEMP:
====================
C:\Users\Nick\AppData\Local\Temp\EslWireSetup-1.17.3.8001-x64.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-28 02:05
==================== End Of Log ============================
|
|
10.07.2014, 16:54
| #4 |
| | Windows 7: Internet langsam / Computer lahmt Gmer.txt Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-08 21:20:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR1 931,51GB
Running: b098o7xn.exe; Driver: C:\Users\Nick\AppData\Local\Temp\uxtdapod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035b2000 63 bytes [00, 00, 0F, 02, 4B, 4C, 73, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff800035b2040 72 bytes {ADD AL, DL; PUSH RCX; ADD AL, 0x7; CMP DL, 0xff; CALL QWORD [RAX]}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe[3704] C:\Windows\syswow64\kernel32.dll!CreateThread 0000000077543495 5 bytes JMP 0000000100329c38
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070b61a22 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070b61ad0 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070b61b08 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070b61bba 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070b61bda 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[3812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070b61a22 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070b61ad0 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070b61b08 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070b61bba 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070b61bda 2 bytes [B6, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Windows\SysWOW64\PnkBstrB.exe[3884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[5100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076f11465 2 bytes [F1, 76]
.text C:\Windows\SysWOW64\RunDll32.exe[5100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076f114bb 2 bytes [F1, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000779b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000779b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000779b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000779b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000779b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000779b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000779b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000779b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000779b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000779b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000779b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000779b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000779b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000779b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000779b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000779b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000779b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000779b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000779b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000779b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000779b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000779b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000779b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077a01380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077a01500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077a01530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077a01650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077a01700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077a01d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077a01f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077a027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000749a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000749a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000749a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000749a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6376] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000749a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000779b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000779b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000779b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000779b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000779b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000779b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000779b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000779b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000779b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000779b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000779b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000779b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000779b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000779b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000779b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000779b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000779b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000779b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000779b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000779b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000779b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000779b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000779b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077a01380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077a01500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077a01530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077a01650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077a01700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077a01d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077a01f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077a027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000749a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000749a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000749a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000749a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000749a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000779b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000779b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000779b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000779b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000779b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000779b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000779b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000779b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000779b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000779b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000779b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000779b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000779b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000779b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000779b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000779b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000779b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000779b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000779b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000779b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000779b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000779b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000779b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077a01380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077a01500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077a01530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077a01650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077a01700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077a01d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077a01f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077a027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000749a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000749a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000749a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000749a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7312] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000749a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000749a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000749a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000749a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000749a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000749a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtClose 0000000077baf9e0 5 bytes JMP 000000016bdef270
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey 0000000077bafa28 5 bytes JMP 000000016bdef8d2
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey 0000000077bafa40 5 bytes JMP 000000016bdee00d
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey 0000000077bafa90 5 bytes JMP 000000016bdedb69
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077bafaa8 5 bytes JMP 000000016bdede5a
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey 0000000077bafb40 5 bytes JMP 000000016bdefb12
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000077bafc38 5 bytes JMP 000000016bdfaccc
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey 0000000077bafd4c 5 bytes JMP 000000016bded9b1
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000077bafd64 5 bytes JMP 000000016bdfa2ee
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077bafd98 5 bytes JMP 000000016bdfa5e9
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject 0000000077bafe44 5 bytes JMP 000000016bdeee45
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile 0000000077bafe5c 5 bytes JMP 000000016bdfa417
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000077bb00b4 5 bytes JMP 000000016bdfa133
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077bb01c4 5 bytes JMP 000000016bdee1b5
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtCreateKeyTransacted 0000000077bb0754 5 bytes JMP 000000016bdefbb4
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile 0000000077bb09e4 5 bytes JMP 000000016bdfa32b
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey 0000000077bb09fc 5 bytes JMP 000000016bded785
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077bb0a44 5 bytes JMP 000000016bdee36b
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey 0000000077bb0b80 5 bytes JMP 000000016bded89b
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey 0000000077bb0f70 5 bytes JMP 000000016bdee7f8
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys 0000000077bb0f88 5 bytes JMP 000000016bdee994
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx 0000000077bb1018 5 bytes JMP 000000016bdef95f
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransacted 0000000077bb1030 5 bytes JMP 000000016bdefa82
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransactedEx 0000000077bb1048 5 bytes JMP 000000016bdef9ef
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile 0000000077bb133c 5 bytes JMP 000000016bdfa500
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey 0000000077bb147c 5 bytes JMP 000000016bdee66b
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject 0000000077bb1528 5 bytes JMP 000000016bdeeb58
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey 0000000077bb1718 5 bytes JMP 000000016bdee4e3
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey 0000000077bb1a58 5 bytes JMP 000000016bdedd12
.text C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe[6200] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject 0000000077bb1b9c 5 bytes JMP 000000016bdeecda
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000779b11f5 8 bytes {JMP 0xd}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000779b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000779b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000779b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000779b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000779b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000779b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000779b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000779b1fd7 8 bytes {JMP 0xb}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000779b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000779b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000779b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779b27d2 8 bytes {JMP 0x10}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000779b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000779b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000779b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000779b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000779b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000779b33c0 16 bytes {JMP 0x4e}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000779b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000779b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000779b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000779b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000779b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077a01380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077a01500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077a01530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077a01650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077a01700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077a01d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077a01f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077a027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000749a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000749a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000749a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000749a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Nick\Desktop\b098o7xn.exe[3424] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000749a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [6860:7464] 000007fee96b9688
---- Processes - GMER 2.1 ----
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 0000000057c40000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\adal.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 000000006d410000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 000000006bbf0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\MSPTLS.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 000000006ab30000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\csi.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 00000000655e0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\ACEOLEDB.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 000000006bba0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACECORE.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 0000000069de0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\1031\ACEWSTR.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 0000000069d00000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACEES.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 0000000069c60000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\VBAJET32.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 00000000734d0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\expsrv.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 000000006bb40000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\ACEERR.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [6200] 0000000073bc0000
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-07-2014 01
Ran by Nick at 2014-07-08 20:43:29
Running from C:\Users\Nick\Desktop\Trojaner-Board
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(T)Raumschiff Surprise - Periode 1 - XXL (HKLM-x32\...\{6FF1763A-35B2-4DF5-AB57-AB5613AFBAE0}) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.3.0.3670 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.3.0.3670 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed III 1.01 (HKLM-x32\...\{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}) (Version: 1.01 - Ubisoft)
AV VoizGame 6.0 (HKLM-x32\...\AV VoizGame 6.0) (Version: 6.0.50 - AVSOFT Corp.)
AVIcodec (remove only) (HKLM-x32\...\AVIcodec) (Version: - )
Avid Free DigiRack Plug-Ins 9.0 (HKLM-x32\...\{A24C2C43-4312-493E-96B3-5D1DCE24DEBF}) (Version: 9.0 - Avid Technology, Inc.)
Avid Pro Tools Creative Collection 9.0 (HKLM-x32\...\{3BB2CF34-1FC8-46E2-9D64-4A8D1D577549}) (Version: 9.0 - Avid Technology, Inc.)
Avid Pro Tools MP 9.0 (HKLM-x32\...\{3C89685D-D38C-4124-B8C4-56203B399875}) (Version: 9.0 - Avid Technology, Inc.)
Ballerburg (HKLM-x32\...\Ballerburg_is1) (Version: - )
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Battlefield 2(TM) (HKLM-x32\...\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}) (Version: - )
Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.0.0 - Electronic Arts)
BCC 7 OFX 64Bit (HKLM\...\{05D8FAA8-958E-4E47-96DA-F1E043EB01E5}) (Version: 7.0.4.1 - Boris FX, Inc.)
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
Blender (HKLM\...\Blender) (Version: 2.70a - Blender Foundation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version: - )
Call of Duty: Black Ops II - Zombies (HKLM-x32\...\Steam App 212910) (Version: - )
Call of Duty: Ghosts - Multiplayer (HKLM-x32\...\Steam App 209170) (Version: - )
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version: - Infinity Ward)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version: - Infinity Ward)
CCleaner (HKLM\...\CCleaner) (Version: 3.19 - Piriform)
Chicken Invaders v1.30 (HKLM-x32\...\Chicken Invaders_is1) (Version: - InterAction studios)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.32.50 - Conexant)
Counter-Strike(TM) (HKLM-x32\...\{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}) (Version: 1.0.0.0 - Valve)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Counter-Strike: Source (HKLM-x32\...\{9580813D-94B1-4C28-9426-A441E2BB29A5}) (Version: 1.0.0.0 - Valve)
CyberGhost VPN (HKLM\...\CyberGhost VPN_is1) (Version: - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Die Schlacht um Mittelerde(tm) (HKLM-x32\...\{3F290582-3F4E-4B96-009C-E0BABAA40C42}) (Version: - )
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version: - Steinberg Media Technologies GmbH)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
ESL Wire 1.17.2 (HKLM\...\ESL Wire_is1) (Version: - Turtle Entertainment GmbH)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
Free AVI Video Converter version 5.0.37.327 (HKLM-x32\...\Free AVI Video Converter_is1) (Version: 5.0.37.327 - DVDVideoSoft Ltd.)
Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.3.5.623 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.41.623 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.41.623 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
Gameforge Live 1.7.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.7.0 - Gameforge)
GhostMouse (HKLM-x32\...\GhostMouse_is1) (Version: Free V3.2.1 - ghost-mouse.com)
GIMP 2.6.8 (HKLM\...\WinGimp-2.0_is1) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Grand Theft Auto Vice City (HKLM-x32\...\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}) (Version: 1.00.000 - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
HyperCam 3 (HKLM-x32\...\HyperCam 3 3.5.1210.30) (Version: 3.5.1210.30 - Solveig Multimedia)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.3.1427 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2656 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 7 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217007FF}) (Version: 7.0.70 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
K-Lite Codec Pack 10.4.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.4.0 - )
Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 2.0.0713 - KYOCERA Document Solutions Inc.)
Kyocera TWAIN Driver (HKLM-x32\...\InstallShield_{C1C5C0F5-4B4B-48AD-B2F0-90CAB520C989}) (Version: 2.0.2507 - KYOCERA Document Solutions Inc.)
Kyocera TWAIN Driver (x32 Version: 2.0.2507 - KYOCERA Document Solutions Inc.) Hidden
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.2300 - Broadcom Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.11.1206.1 - Vimicro)
Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.9 - Lenovo)
Lenovo pointing device (HKLM\...\Elantech) (Version: 10.4.2.8 - ELAN Microelectronic Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.3712.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.3712.52 - CyberLink Corp.) Hidden
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3728 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
Lenovo_Wireless_Driver (HKLM-x32\...\{28ABE740-47F3-441B-9437-852F6A64EFF8}) (Version: 1.02.01 - Lenovo)
License Support (HKLM-x32\...\InstallShield_{3165EA9B-36CC-499B-96FF-36FC30E10EF4}) (Version: 1.00.0000 - PACE Anti-Piracy, Inc.)
License Support (Version: 1.00.0000 - PACE Anti-Piracy, Inc.) Hidden
LockKey (HKLM-x32\...\InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}) (Version: 1.38.1.2 - Lenovo)
LockKey (x32 Version: 1.38.1.2 - Lenovo) Hidden
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.214 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.214 - LogMeIn, Inc.) Hidden
Magic Bullet Looks Vegas (HKLM-x32\...\Magic Bullet Looks Vegas) (Version: - )
Magic Bullet Suite 64-bit (HKLM-x32\...\InstallShield_{93488C33-D8D6-472A-83BB-F71603355CF0}) (Version: 11.1.0 - Red Giant Software)
Magic Bullet Suite 64-bit (Version: 11.1.0 - Red Giant Software) Hidden
M-Audio MobilePre Driver 1.0.4 (x64) (HKLM\...\{205811A2-78C0-11DF-87D8-1AF2DED72085}) (Version: 1.0.4 - M-Audio)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metin2 (HKLM-x32\...\Metin2_is1) (Version: - Gameforge 4D GmbH)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires (HKLM-x32\...\Age of Empires) (Version: - )
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 Small Business Premium - de-de (HKLM\...\O365SmallBusPremRetail - de-de) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Movavi Video Converter 12 (HKLM-x32\...\Movavi Video Converter 12) (Version: 12.3.0 - Movavi)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neverwinter (HKLM-x32\...\Neverwinter) (Version: - Cryptic Studios)
NewBlue Art Effects (HKLM-x32\...\NewBlue Art Effects) (Version: - )
NewBlue Motion Effects (HKLM-x32\...\NewBlue Motion Effects) (Version: - )
NewBlue Video Essentials II for Windows (HKLM-x32\...\NewBlue Video Essentials II for Windows) (Version: - )
NewBlue Video Essentials III for Windows (HKLM-x32\...\NewBlue Video Essentials III for Windows) (Version: - )
Nostale(DE) (HKLM-x32\...\NosTale(DE)_is1) (Version: - Gameforge 4D GmbH)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.11.1111 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.11.1111 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.11.1111 - NVIDIA Corporation)
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.76.1.0 - Overwolf Ltd.)
PartyPoker (HKLM-x32\...\PartyPoker) (Version: - PartyGaming)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
QuickTime (HKLM-x32\...\{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}) (Version: 7.2.0.240 - Apple Inc.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39016 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.48 - Piriform)
ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version: - Roccat GmbH)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Steinberg Cubase LE AI Elements 6 64bit (HKLM\...\{8EEEB23E-A3EB-44A4-AEE9-D2FD6F96E4A0}) (Version: 6.0.2 - Steinberg Media Technologies GmbH)
Steinberg Drum Loop Expansion 01 (HKLM-x32\...\{490BF87E-1F75-4453-BF55-9F540543A3CA}) (Version: 2.0.0.0 - Steinberg Media Technologies GmbH)
Steinberg Groove Agent ONE Content (HKLM-x32\...\{BD86F1AC-B594-46E4-85DC-1258AC9E2232}) (Version: 1.0.0.003 - Steinberg Media Technologies GmbH)
Steinberg Groove Agent ONE Vintage Beatboxes (HKLM-x32\...\{DBF4BC99-53F1-4C97-84C3-7557D103E182}) (Version: 1.0.0.000 - Steinberg Media Technologies GmbH)
Steinberg HALion Sonic SE 64bit (HKLM\...\{B99C316B-C135-43B5-8E77-2BC5E241F964}) (Version: 1.5.2 - Steinberg Media Technologies GmbH)
Steinberg HALion Sonic SE Content for Cubase LE AI Elements (HKLM-x32\...\{CF45002F-2205-4116-BB51-2D015F436CAC}) (Version: 1.5.2.000 - Steinberg Media Technologies GmbH)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TemplateToaster 4 (HKLM-x32\...\TemplateToaster 4_is1) (Version: 4.0.0.5445 - TemplateToaster.com)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 7 - Gameforge Productions GmbH)
UA-4FX-Treiber (HKLM\...\RolandRDID0061) (Version: - Roland Corporation)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
Vegas Pro 12.0 (64-bit) (HKLM\...\{BE94768F-5232-11E3-BD78-F04DA23A5C58}) (Version: 12.0.770 - Sony)
VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.1230 - Lenovo)
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version: - )
Visual C++ Redistributables (HKLM-x32\...\InstallShield_{C2AF7B2D-7018-414B-9B8B-D3C9F3BED04F}) (Version: 1.00.0000 - PACE Anti-Piracy, Inc.)
Visual C++ Redistributables (x32 Version: 1.00.0000 - PACE Anti-Piracy, Inc.) Hidden
War of the Immortals (HKLM-x32\...\Steam App 209710) (Version: - Perfect World Shanghai)
Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
Wizard101(DE) (HKCU\...\Wizard101(DE)_is1) (Version: - Gameforge 4D GmbH)
WoLoSoft SuperEdi 4.3.1 (HKLM-x32\...\SuperEdi_is1) (Version: 4.3.1 - WoLoSoft International)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.2-2 - BitNami)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.3) (Version: 1.3.3 - Xvid Team)
==================== Restore Points =========================
01-07-2014 16:33:09 Windows Update
07-07-2014 17:58:06 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-06-29 23:33 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {167C0AF0-680A-43BD-BE4A-6C5CA0287030} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-25] (Google Inc.)
Task: {1EE5A25A-ED17-42F6-A3F3-45B71FD0FA5B} - System32\Tasks\{BD198C11-5CE3-475F-B1BB-70CAC94C61ED} => Firefox.exe hxxp://ui.skype.com/ui/0/6.7.0.102/de/abandoninstall?page=tsProgressBar
Task: {56CE6734-4047-47F0-8774-865F65B82E67} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Lauch-Nick Lauch => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-19] (Microsoft Corporation)
Task: {57DA3532-E24E-4E30-93F5-AF24C3B977AA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-25] (Google Inc.)
Task: {6E064696-6578-45EB-9151-466D635BBB6E} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()
Task: {6F7CCC41-39BA-4195-8FDF-F94D8A84F881} - System32\Tasks\RunAsStdUser Task => C:\Program Files (x86)\Thoosje Sevenbar\Thoosje Sevenbar.exe
Task: {78EA7C5C-A519-4DE3-A0D0-86C842255850} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-06-19] (Microsoft Corporation)
Task: {93583515-518D-42C6-B42D-268167731352} - System32\Tasks\CreateHardwareScanTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {AFE2A9A6-3FE2-40EE-8E64-BAA027CAAC79} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2014-06-10] (Overwolf LTD)
Task: {B6E41FD2-F9FF-4E47-B963-DD796CD00A05} - System32\Tasks\MySearchDial => C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {C95C5ACD-DC36-4AC5-90CA-264FAC0B121F} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: {DEA6D72E-CD82-42EC-BEBD-A0BF1B036B39} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: {E09AE007-045C-4E18-B11B-55C0E70C4CC5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {EBF2FFF0-CF5C-4E10-AF35-F9D083DB0AF9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {ED476C2A-2215-4435-A110-57880BE3DCF7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
Task: {F818FC61-56F7-42AA-BD0B-DA1224BBCC1D} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Nick\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-05-25 16:43 - 2012-10-02 21:51 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-05-25 17:06 - 2012-05-25 17:06 - 01508192 _____ () C:\Windows\system32\IcnOvrly.dll
2014-03-15 12:10 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-03-05 10:28 - 2012-02-17 18:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2008-12-20 03:20 - 2012-05-25 17:10 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2012-05-25 17:10 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2012-05-25 17:10 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2012-05-25 17:10 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-09-08 16:10 - 2013-06-11 11:52 - 00663056 _____ () C:\Program Files\EslWire\service\WireHelperSvc.exe
2012-09-08 16:10 - 2013-07-09 13:12 - 00214016 _____ () C:\Program Files\EslWire\service\NocIPC64.dll
2012-11-22 19:15 - 2013-04-10 19:57 - 00076888 ____N () C:\Windows\SysWOW64\PnkBstrA.exe
2012-11-22 19:15 - 2013-05-18 08:42 - 00215128 ____N () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-02-15 14:16 - 2014-02-15 14:16 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\b162055347700182d96325676dd591c4\IsdiInterop.ni.dll
2012-05-25 16:31 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-05-25 16:32 - 2012-02-21 06:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-06-29 23:43 - 2014-06-06 06:38 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-06-19 12:23 - 2014-06-19 12:23 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Nick\Lokale Einstellungen:BayuW0rooKDnIhROGDzwpA2u
AlternateDataStreams: C:\Users\Nick\AppData\Local:BayuW0rooKDnIhROGDzwpA2u
AlternateDataStreams: C:\Users\Nick\AppData\Local\Anwendungsdaten:BayuW0rooKDnIhROGDzwpA2u
AlternateDataStreams: C:\Users\Nick\AppData\Local\lotvQuCq:IvQDx0Lg7ROjmRmUkdsbU4M
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Avnex Virtual Audio Device
Description: Avnex Virtual Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: AVNEX Ltd.
Service: VCSVADHWSer
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/08/2014 07:49:42 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/08/2014 07:49:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/08/2014 07:14:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.697, Zeitstempel: 0x506b3bc0
Name des fehlerhaften Moduls: nvtray.exe, Version: 7.17.13.697, Zeitstempel: 0x506b3bc0
Ausnahmecode: 0x40000015
Fehleroffset: 0x0000000000153481
ID des fehlerhaften Prozesses: 0xb08
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (07/08/2014 06:59:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: autoupdate-windows.exe, Version: 1.0.0.0, Zeitstempel: 0x5049c0c3
Name des fehlerhaften Moduls: nvinit.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x506b31f3
Ausnahmecode: 0xc0000005
Fehleroffset: 0x746ece39
ID des fehlerhaften Prozesses: 0xd68
Startzeit der fehlerhaften Anwendung: 0xautoupdate-windows.exe0
Pfad der fehlerhaften Anwendung: autoupdate-windows.exe1
Pfad des fehlerhaften Moduls: autoupdate-windows.exe2
Berichtskennung: autoupdate-windows.exe3
Error: (07/08/2014 06:59:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2014 07:49:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: autoupdate-windows.exe, Version: 1.0.0.0, Zeitstempel: 0x5049c0c3
Name des fehlerhaften Moduls: nvinit.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x506b31f3
Ausnahmecode: 0xc0000005
Fehleroffset: 0x735dce39
ID des fehlerhaften Prozesses: 0xdac
Startzeit der fehlerhaften Anwendung: 0xautoupdate-windows.exe0
Pfad der fehlerhaften Anwendung: autoupdate-windows.exe1
Pfad des fehlerhaften Moduls: autoupdate-windows.exe2
Berichtskennung: autoupdate-windows.exe3
Error: (07/07/2014 07:49:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/06/2014 06:51:27 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485936
Error: (07/06/2014 06:51:27 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {DB06CD57-3F27-4F67-B73A-E3D6A4F42E9A}
Error: (07/06/2014 06:51:15 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {DB06CD57-3F27-4F67-B73A-E3D6A4F42E9A}
System errors:
=============
Error: (07/08/2014 07:20:29 PM) (Source: BROWSER) (EventID: 8020) (User: )
Description: Der Suchdienst konnte sich nicht selbst zur Funktion als Hauptsuchdienst heraufstufen.
Der Computer, der zurzeit die Funktion als Hauptsuchdienst erfüllt, ist unbekannt.
Error: (07/08/2014 07:14:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (07/08/2014 07:14:55 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (07/08/2014 07:01:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (07/08/2014 07:01:56 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (07/08/2014 06:59:46 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse ***********
registriert werden. Der Computer mit IP-Adresse *********** hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (07/08/2014 06:58:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "lemsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (07/08/2014 06:58:29 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\lemsgt.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (07/08/2014 06:58:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "hwpsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (07/08/2014 06:58:26 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\hwpsgt.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Microsoft Office Sessions:
=========================
Error: (07/08/2014 07:49:42 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\Freizeit\Extras\SoftonicDownloader_fuer_freerip-mp3.exe
Error: (07/08/2014 07:49:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Nick\Desktop\Freizeit\Extras\SoftonicDownloader_fuer_freerip-mp3.exe
Error: (07/08/2014 07:14:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nvtray.exe7.17.13.697506b3bc0nvtray.exe7.17.13.697506b3bc0400000150000000000153481b0801cf9acdc810e9abC:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files\NVIDIA Corporation\Display\nvtray.exe6219a7b5-06c3-11e4-8157-08edb997d346
Error: (07/08/2014 06:59:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: autoupdate-windows.exe1.0.0.05049c0c3nvinit.dll_unloaded0.0.0.0506b31f3c0000005746ece39d6801cf9acdda7088c9C:\Program Files (x86)\Xvid\autoupdate-windows.exenvinit.dll4796f7e0-06c1-11e4-8157-08edb997d346
Error: (07/08/2014 06:59:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2014 07:49:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: autoupdate-windows.exe1.0.0.05049c0c3nvinit.dll_unloaded0.0.0.0506b31f3c0000005735dce39dac01cf9a0babc85cd4C:\Program Files (x86)\Xvid\autoupdate-windows.exenvinit.dll140b9a11-05ff-11e4-96b9-08edb997d346
Error: (07/07/2014 07:49:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/06/2014 06:51:27 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485936
Error: (07/06/2014 06:51:27 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {DB06CD57-3F27-4F67-B73A-E3D6A4F42E9A}
Error: (07/06/2014 06:51:15 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {DB06CD57-3F27-4F67-B73A-E3D6A4F42E9A}
CodeIntegrity Errors:
===================================
Date: 2014-04-14 11:28:24.103
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-14 11:28:23.994
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-13 09:43:37.360
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-13 09:43:37.266
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 15:00:32.650
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 15:00:32.556
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 14:50:08.168
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 14:50:08.106
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 10:30:06.941
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-04-12 10:30:06.848
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vcsvad.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 33%
Total physical RAM: 8094.36 MB
Available physical RAM: 5371.53 MB
Total Pagefile: 16186.89 MB
Available Pagefile: 12945.02 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:886.32 GB) (Free:595.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:22.2 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: CC1D1A93)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=886 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=20 GB) - (Type=12)
==================== End Of Log ============================
|
|
11.07.2014, 11:12
| #5 |
| /// the machine /// TB-Ausbilder | Windows 7: Internet langsam / Computer lahmt hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2014, 20:21
| #6 |
| | Windows 7: Internet langsam / Computer lahmt Hier ist die log.txt: Code:
ATTFilter ComboFix 14-07-11.04 - Nick 11.07.2014 20:47:49.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8094.5665 [GMT 2:00]
ausgeführt von:: c:\users\Nick\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Java\jre7\bin\jp2ssv.dll
c:\program files (x86)\Uninstall.exe
c:\program files\Lenovo\Lenovo Solution Center\Microsoft Fix it\FixitUi\_desktop.ini
c:\programdata\1348680197.bdinstall.bin
c:\programdata\1348758083.bdinstall.bin
c:\programdata\1375988588.bdinstall.bin
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-06-11 bis 2014-07-11 ))))))))))))))))))))))))))))))
.
.
2014-07-11 18:56 . 2014-07-11 18:56 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-07-11 18:56 . 2014-07-11 18:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-07-11 17:56 . 2014-07-11 17:56 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{61243A7C-8321-4505-84D4-137CDDECBD26}\offreg.dll
2014-07-11 17:50 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{61243A7C-8321-4505-84D4-137CDDECBD26}\mpengine.dll
2014-07-08 20:22 . 2014-06-05 14:45 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-07-08 20:22 . 2014-06-05 14:26 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-07-08 20:22 . 2014-06-05 14:25 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-07-08 20:10 . 2014-06-18 02:19 503296 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tiptsf.dll
2014-07-08 20:10 . 2014-06-18 02:19 449024 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-08 20:10 . 2014-06-18 02:19 1247232 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-08 20:10 . 2014-06-18 02:19 110592 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-08 20:10 . 2014-06-18 02:18 224768 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TabTip.exe
2014-07-08 20:10 . 2014-06-18 02:18 692736 ----a-w- c:\windows\system32\osk.exe
2014-07-08 20:10 . 2014-06-18 02:17 544768 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipRes.dll
2014-07-08 20:10 . 2014-06-18 01:52 348672 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll
2014-07-08 20:10 . 2014-06-18 01:51 10240 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe
2014-07-08 20:10 . 2014-06-18 01:51 646144 ----a-w- c:\windows\SysWow64\osk.exe
2014-07-08 20:10 . 2014-06-18 01:10 3157504 ----a-w- c:\windows\system32\win32k.sys
2014-07-08 19:56 . 2014-06-03 10:02 1719296 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2014-07-08 19:56 . 2014-06-03 10:02 1389568 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2014-07-08 19:56 . 2014-06-03 10:02 1380864 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2014-07-08 19:56 . 2014-06-03 10:02 1354240 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-08 19:56 . 2014-06-03 09:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2014-07-08 19:55 . 2014-06-30 02:09 519168 ----a-w- c:\windows\system32\aepdu.dll
2014-07-08 19:55 . 2014-06-30 02:04 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-07-08 18:42 . 2014-07-08 18:44 -------- d-----w- C:\FRST
2014-06-29 21:31 . 2014-06-29 21:33 181064 ----a-w- c:\windows\PSEXESVC.EXE
2014-06-29 16:09 . 2013-05-06 07:13 110176 ----a-w- c:\windows\system32\klfphc.dll
2014-06-29 16:08 . 2014-06-29 16:08 -------- d-----w- c:\windows\ELAMBKUP
2014-06-29 16:07 . 2014-07-11 18:02 -------- d-----w- c:\programdata\Kaspersky Lab
2014-06-29 16:07 . 2014-06-29 16:07 -------- d-----w- c:\program files (x86)\Kaspersky Lab
2014-06-29 16:07 . 2014-06-29 21:03 625248 ----a-w- c:\windows\system32\drivers\klif.sys
2014-06-29 16:07 . 2014-06-29 21:03 115296 ----a-w- c:\windows\system32\drivers\klflt.sys
2014-06-28 20:54 . 2014-06-28 20:54 -------- d-----w- c:\users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 20:54 . 2014-06-28 20:54 -------- d-----w- c:\users\Nick\AppData\Local\TuneUp Software
2014-06-28 20:53 . 2014-06-28 20:54 -------- d-----w- c:\programdata\TuneUp Software
2014-06-28 20:53 . 2014-06-28 20:53 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-28 20:53 . 2014-06-28 20:53 -------- d--h--w- c:\programdata\Common Files
2014-06-25 14:20 . 2014-06-25 14:20 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2014-06-13 12:27 . 2014-06-18 08:35 -------- d-----w- c:\program files (x86)\osu!
2014-06-11 23:55 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll
2014-06-11 23:55 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2014-06-11 23:55 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-06-11 23:55 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-11 23:55 . 2014-03-26 14:44 2002432 ----a-w- c:\windows\system32\msxml6.dll
2014-06-11 23:55 . 2014-03-26 14:44 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-06-11 23:55 . 2014-03-26 14:27 1389056 ----a-w- c:\windows\SysWow64\msxml6.dll
2014-06-11 23:55 . 2014-03-26 14:41 2048 ----a-w- c:\windows\system32\msxml6r.dll
2014-06-11 23:55 . 2014-03-26 14:41 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-06-11 23:55 . 2014-03-26 14:27 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2014-06-11 23:55 . 2014-03-26 14:25 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2014-06-11 23:55 . 2014-03-26 14:25 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-09 22:00 . 2012-07-03 17:59 96441528 ----a-w- c:\windows\system32\MRT.exe
2014-07-08 21:14 . 2012-06-09 16:43 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-08 21:14 . 2012-06-09 16:43 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-29 21:03 . 2013-06-10 10:27 29792 ----a-w- c:\windows\system32\drivers\klim6.sys
2014-06-29 21:03 . 2013-06-06 15:38 178272 ----a-w- c:\windows\system32\drivers\kneps.sys
2014-06-29 21:03 . 2013-05-05 20:42 29280 ----a-w- c:\windows\system32\drivers\klkbdflt.sys
2014-06-29 21:03 . 2013-05-05 20:42 29280 ----a-w- c:\windows\system32\drivers\klmouflt.sys
2014-06-29 21:03 . 2013-05-06 07:22 458336 ----a-w- c:\windows\system32\drivers\kl1.sys
2014-06-03 08:41 . 2013-08-23 18:20 589008 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2010-06-15 01:54 . 2010-06-15 01:54 153008 ----a-w- c:\program files (x86)\fraps64.dll
2010-06-15 01:54 . 2010-06-15 01:54 206768 ----a-w- c:\program files (x86)\fraps32.dll
2010-06-15 01:54 . 2010-06-15 01:54 74672 ----a-w- c:\program files (x86)\fraps64.dat
2010-06-15 01:54 . 2010-06-15 01:54 2320304 ----a-w- c:\program files (x86)\fraps.exe
2010-06-15 01:46 . 2010-06-15 01:46 163840 ----a-w- c:\program files (x86)\frapslcd.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-06-10 08:39 1730264 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-06-10 08:39 1730264 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-06-10 08:39 1730264 ----a-w- c:\program files\Microsoft Office 15\root\office15\grooveex.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ESL Wire"="c:\program files\EslWire\wire.exe" [2013-07-09 4253696]
"GoogleChromeAutoLaunch_B9D48092DF53DE2F032C3C1B28E5E1A1"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-06-05 860488]
"Overwolf"="c:\program files (x86)\Overwolf\Overwolf.exe" [2014-06-10 39712]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"Xvid"="c:\program files (x86)\Xvid\CheckUpdate.exe" [2011-01-17 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"LockKey"="c:\program files (x86)\LockKey\LockKey.exe" [2011-08-25 337776]
"Dolby Advanced Audio v2"="c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2011-12-20 507744]
"331BigDog"="c:\program files (x86)\USB Camera\VM331_STI.EXE" [2011-11-24 548864]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488]
"YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448]
"VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2012-05-25 329056]
"RemoteControl10"="c:\program files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-09-28 75048]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"DigidesignMMERefresh"="c:\program files (x86)\Digidesign\Pro Tools\MMERefresh.exe" [2011-03-04 81920]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2007-06-29 286720]
"RoccatKonePure"="c:\program files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE" [2013-10-22 561152]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-06-23 3816272]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2012-2-1 1380128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\Lenovo\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 CLKMSVC10_3A60B698;CyberLink Product - 2012/05/25 17:07;c:\program files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe;c:\program files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe;c:\program files\CyberGhost VPN\CGVPNCliService.exe [x]
R3 Ctafiltv;Ctafiltv;c:\windows\system32\drivers\Ctafiltv.sys;c:\windows\SYSNATIVE\drivers\Ctafiltv.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 MAUSBMOBILEPREII;Service for M-Audio MobilePre II;c:\windows\system32\DRIVERS\MAudioMobilePreII.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioMobilePreII.sys [x]
R3 OverwolfUpdater;Overwolf Updater Windows SCM;c:\program files (x86)\Overwolf\OverwolfUpdater.exe;c:\program files (x86)\Overwolf\OverwolfUpdater.exe [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys;c:\windows\SYSNATIVE\drivers\ScreamingBAudio64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys;c:\windows\SYSNATIVE\DRIVERS\vcsvad.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
R4 DamageGuard;DamageGuard;c:\windows\system32\DRIVERS\DamageGuardX64.sys;c:\windows\SYSNATIVE\DRIVERS\DamageGuardX64.sys [x]
R4 DamageGuardSvc;Lenovo Instant Reset Service;c:\program files\Lenovo\Instant Reset\DamageGuardSvc.exe;c:\program files\Lenovo\Instant Reset\DamageGuardSvc.exe [x]
R4 dgFltr;dgFltr;c:\windows\system32\drivers\dgFltrX64.sys;c:\windows\SYSNATIVE\drivers\dgFltrX64.sys [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys;c:\windows\SYSNATIVE\drivers\fbfmon.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys;c:\windows\SYSNATIVE\drivers\BPntDrv.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 DigiNet;Digidesign Ethernet Support;c:\windows\system32\DRIVERS\diginet.sys;c:\windows\SYSNATIVE\DRIVERS\diginet.sys [x]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys;c:\windows\SYSNATIVE\drivers\ESLWireACD.sys [x]
S2 EslWireHelper;ESL Wire Helper Service;c:\program files\EslWire\service\WireHelperSvc.exe;c:\program files\EslWire\service\WireHelperSvc.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
S2 MobilePreIIAudioDevMon;MobilePre Audio Device Monitor;c:\program files (x86)\M-Audio\MobilePre\AudioDevMon.exe;c:\program files (x86)\M-Audio\MobilePre\AudioDevMon.exe [x]
S2 PaceLicenseDServices;PACE License Services;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys;c:\windows\SYSNATIVE\DRIVERS\vrtaucbl.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys;c:\windows\SYSNATIVE\Drivers\vm331avs.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - CLKMDRV10_3A60B698
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-06-11 02:03 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 21:14]
.
2014-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-25 15:09]
.
2014-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-25 15:09]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2012-05-25 15:06 1508192 ----a-w- c:\windows\System32\IcnOvrly.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-02 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-02 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-02 440600]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-12-15 564352]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-05-25 8079408]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2012-05-25 6199128]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2012-05-25 206176]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ie
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Nick\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
FF - ProfilePath - c:\users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-Fraps - c:\program files (x86)\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-07-11 20:59:30
ComboFix-quarantined-files.txt 2014-07-11 18:59
.
Vor Suchlauf: 29 Verzeichnis(se), 645.842.018.304 Bytes frei
Nach Suchlauf: 38 Verzeichnis(se), 645.332.287.488 Bytes frei
.
- - End Of File - - 82A0B957983075EEF9325F64218D77D9
|
|
12.07.2014, 18:03
| #7 |
| /// the machine /// TB-Ausbilder | Windows 7: Internet langsam / Computer lahmt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2014, 23:41
| #8 |
| | Windows 7: Internet langsam / Computer lahmt Hier die Codes: mbam.txt: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 12.07.2014 Suchlauf-Zeit: 22:56:57 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.07.12.08 Rootkit Datenbank: v2014.07.09.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Nick Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 333196 Verstrichene Zeit: 8 Min, 58 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 12 PUP.Optional.SearchProtect.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [34742f6f7efd16203c0782cfdc26847c], PUP.Optional.MySearchDial.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [5b4db4ea2853ed49a4a0b79a59a93fc1], PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [5b4db4ea2853ed49a4a0b79a59a93fc1], PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, In Quarantäne, [ffa9fea004778da9607b6a78768ca35d], PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\mysearchdial, In Quarantäne, [6e3a613d88f356e07686bb5ab0545ea2], PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, In Quarantäne, [dfc91e80df9c8aacda010bd7c83ade22], PUP.Optional.MySearchDial.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial.com, In Quarantäne, [594f7b23c3b88da94d1a01f6e51ec63a], PUP.Optional.PriceGong.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [7533d3cb62191c1abe122ab02dd51ce4], PUP.Optional.MySearchDial.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pflphaooapbgpeakohlggbpidpppgdff, In Quarantäne, [7c2cb0eee9922016f1e9ebf7a0629e62], PUP.Optional.InstallCore.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [c5e3eab4a7d496a0da8423bd09f9d12f], PUP.Optional.InstallCore.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [4266a0feb2c90630560f7a7cc340ad53], PUP.Optional.Softonic.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [81273c62423968cecc8d705f2bd751af], Registrierungswerte: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0A2O0R1R1H2Z1S1G0H1F, In Quarantäne, [4266a0feb2c90630560f7a7cc340ad53] Registrierungsdaten: 4 PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=),Ersetzt,[6e3a65394c2fe254d725485462a26f91] PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|Tabs, hxxp://start.mysearchdial.com/?f=2&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=2&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=),Ersetzt,[3573c9d5c4b713234568217262a230d0] PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=),Ersetzt,[594fa5f9e794320434c8623a966eee12] PUP.Optional.Trovi.A, HKU\S-1-5-21-155573163-2419272169-70813047-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ie, Gut: (www.google.com), Schlecht: (hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ie),Ersetzt,[b7f15945017a77bfb11fa7eb9371b947] Ordner: 53 PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\icons_2.2.14.1379, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\116408AD2F484647AAB1F846D42B4D05, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\99877B98CE5A44029ECCEC90DB12B57B, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\B51743E57C5A43388C914C0F974DD0D2, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\E9BB6D72BBD64E6EA323A52CD388BEFA, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\browser, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\browser\misc, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\icons, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\resources, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\favorites, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\info, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ar, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\de, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\en, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\es, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\fr, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\he, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\it, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ja, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\nl, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\pl, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\pt_BR, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ru, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\tr, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\LocalLow\mysearchdial, In Quarantäne, [1197356955263501bc89abf6c0427090], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\LocalLow\mysearchdial\mysearchdial, In Quarantäne, [1197356955263501bc89abf6c0427090], PUP.Optional.SimilarSites.A, C:\Users\Nick\AppData\Roaming\SimilarSites, In Quarantäne, [0b9d4658d8a3eb4bfbaf9213aa58b34d], PUP.Optional.Blabbers.A, C:\Users\Nick\AppData\LocalLow\youtubegizm, In Quarantäne, [f1b7fba346358fa78dc2e3c6ca38ac54], PUP.Optional.Blabbers.A, C:\Users\Nick\AppData\LocalLow\youtubegizm\content, In Quarantäne, [f1b7fba346358fa78dc2e3c6ca38ac54], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], Dateien: 180 PUP.Optional.Conduit.A, C:\Users\Nick\AppData\Roaming\OpenCandy\99877B98CE5A44029ECCEC90DB12B57B\sp-downloader.exe, In Quarantäne, [2f796b33e59643f3a5fb958e9d64ff01], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Local\mysearchdial-speeddial.crx, In Quarantäne, [b1f78e104338e94d98735862986a1de3], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage, In Quarantäne, [891fb9e5780385b16651b75bfd07ea16], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage-journal, In Quarantäne, [ddcbc3db48335adcbbfcc84ac242d42c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\icons_2.2.14.1379\62.ico, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\icons_2.2.14.1379\80.ico, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\config.dat, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\info.dat, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\STTL.DAT, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\TTL.DAT, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.MySearchDial.A, C:\Users\Nick\AppData\Roaming\mysearchdial\UpdateProc\UpdateTask.exe, In Quarantäne, [2f793e60e39800366e3e5e3f20e2e41c], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\116408AD2F484647AAB1F846D42B4D05\TuneUpUtilities2014_de-DE.exe, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\B51743E57C5A43388C914C0F974DD0D2\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.OpenCandy, C:\Users\Nick\AppData\Roaming\OpenCandy\E9BB6D72BBD64E6EA323A52CD388BEFA\driverscannerDE_p1v5.exe, In Quarantäne, [22866c32b2c9ce6809b1e9b44ab84bb5], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\manifest.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\browser\background.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\browser\background.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\browser\misc\screenshot.inject.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_de.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_en_gb.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_en_us.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_fr.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_he.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_it.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_pt_br.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_ru.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\data\favorites_tr.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\angular.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\crypto-js.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery-2.1.0.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery.autocomplete.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery.balloon.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery.fittext.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery.Jcrop.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\jquery.simplecolorpicker.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\mustache.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\string.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\external\underscore-min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\gallery.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\gallery.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\newtab.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\newtab.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\review.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\content\newtab\review.min.js, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\foundation.min.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\indicator.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\Jcrop.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\jquery.autocomplete.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\jquery.Jcrop.min.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\jquery.simplecolorpicker.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\external\normalize.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\arrow-gallery-cat-selected.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\arrow.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\emptyArea.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\gallery.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\gallery_templates.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\icon-gallery-search.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\not_available_32.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\plus.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\gallery\X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\icons\128.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\icons\16.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\icons\48.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\buttons.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\footer.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\header.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\list.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\newtab.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\search.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\css\themes.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-layout.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\ajax-loader-2.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\ajax-loader-bar.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\ajax-loader-medium.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\ajax-loader-small.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\ajax-loader.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\arrow-footer.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\arrow-header.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\attachment.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\close-bar2.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\close.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\edit-button.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-apps-dark.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-apps.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-chrome.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-close.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-contents-light.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-contents.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-edit.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-plus-dark.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-plus.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-right.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-search.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-settings.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\icon-theme.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\menu_v.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\menu_v_white.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\provider.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\x-button.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\arab_tile.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\batthern_@2X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\bo_play_pattern_@2X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\dark_wood_@2X.jpg, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\diagonal_striped_brick.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\escheresque_ste_@2X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\gold_scale.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\purty_wood_@2X.jpg, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\readme.txt, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\starring_@2X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\tileable_wood_texture_@2X.jpg, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\weave_@2X.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\wild_oliva_@2X.jpg, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\images\patterns\woven.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\resources\groups.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\resources\list.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\newtab\resources\menu.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\activetabs.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\favorites.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\layout.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\modal-fav-add.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\modal-fav-edit.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\modal-fav-group.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\readitlater.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\recentlyclosed.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\theme.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\css\webapps.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\bookmarks.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\download.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\downloads.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\downloas.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\extensions.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\history.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\settings.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\chrome\trash.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\favorites\empty.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\favorites\error.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\favorites\shadow.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\info\contactus.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\info\facebook.ico, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\info\rateus.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\images\info\twitter.ico, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\activetabs.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\favorites.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\layout.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\modal-fav-add.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\modal-fav-edit.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\modal-fav-group.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\readitlater.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\readitlater_content.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\readitlater_menu.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\recentlyclosed.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\theme.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\webapps.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\plugins\resources\webapps_contextmenu.html, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\cat_1.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\cat_2.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\cat_3.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\cat_4.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\cat_5.gif, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\rating-star.png, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\skin\review\review.css, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ar\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\de\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\en\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\es\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\fr\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\he\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\it\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ja\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\nl\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\pl\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\pt_BR\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\ru\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff\9.4.24_0\_locales\tr\messages.json, In Quarantäne, [dfc9ced082f91a1ce2c5d7c9d82add23], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff\000003.log, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff\CURRENT, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff\LOCK, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff\LOG, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], PUP.Optional.MySpeedDial.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pflphaooapbgpeakohlggbpidpppgdff\MANIFEST-000002, In Quarantäne, [9216514d275491a59f06e9c1ec16e917], PUP.Optional.Trovi.A, C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=55&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&SSPV=SP21511B_sp_ch",), Ersetzt,[decaa4fab6c59c9a9f8465671fe5a25e] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.215 - Bericht erstellt am 13/07/2014 um 00:10:38
# Aktualisiert 09/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nick - LAUCH
# Gestartet von : C:\Users\Nick\Desktop\adwcleaner_3.215.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\FreeRIP
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\FreeRIP3
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Windows\util
Ordner Gelöscht : C:\Users\Nick\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa
Ordner Gelöscht : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\MGShareware
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\MGShareware
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default\prefs.js ]
-\\ Google Chrome v35.0.1916.153
[ Datei : C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0E0FzytAzyzytByBtAtDtN0D0Tzu0SyCzyyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1825343052&ir=
Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MFA4AB3C5-0CFA-411B-A047-D806F0A43238&SearchSource=58&CUI=&UM=5&UP=SP70D82E79-2E24-4C54-B8F6-BC1D3AF36FC1&q={searchTerms}&SSPV=SP21511B_sp_ch
Gelöscht [Extension] : blbkdnmdcafmfhinpmnlhhddbepgkeaa
Gelöscht [Extension] : nikpibnbobmbdbheedjfogjlikpgpnhp
*************************
AdwCleaner[R0].txt - [3575 octets] - [13/07/2014 00:09:36]
AdwCleaner[S0].txt - [3167 octets] - [13/07/2014 00:10:38]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3227 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Nick on 13.07.2014 at 0:25:20,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Nick\appdata\local\{4B76B55A-B268-49A0-BDF2-352228692BD7}
Successfully deleted: [Empty Folder] C:\Users\Nick\appdata\local\{59207876-E84C-49FC-9F84-0EA6B0E3B779}
Successfully deleted: [Empty Folder] C:\Users\Nick\appdata\local\{7B65676D-DCBD-4D92-AD47-FCB7253703A3}
Successfully deleted: [Empty Folder] C:\Users\Nick\appdata\local\{B7CA52A0-54E4-4EC8-AC7A-7F742C6E2384}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.07.2014 at 0:35:00,15
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
12.07.2014, 23:52
| #9 |
| | Windows 7: Internet langsam / Computer lahmt FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-07-2014
Ran by Nick (administrator) on LAUCH on 13-07-2014 00:38:41
Running from C:\Users\Nick\Desktop\Trojaner-Board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Avid Technology, Inc.) C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(M-Audio) C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\Bluetooth Headset Helper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.76.1.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.76.1.0\OverwolfHelper64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-05-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-05-25] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-05-25] (Lenovo)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [LockKey] => C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-05-25] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DigidesignMMERefresh] => C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [286720 2007-06-29] (Apple Inc.)
HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2013-10-23] (ROCCAT GmbH)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816272 2014-06-23] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [ESL Wire] => C:\Program Files\EslWire\wire.exe [4253696 2013-07-09] (Turtle Entertainment GmbH)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [GoogleChromeAutoLaunch_B9D48092DF53DE2F032C3C1B28E5E1A1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [39712 2014-06-10] (Overwolf LTD)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()
ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {2B65D609-89B6-43A7-A527-C618C5AFDD77} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A010DE714&p={SearchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Nick\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-30]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-06-29]
Chrome:
=======
CHR HomePage:
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: mcafee
CHR DefaultSearchProvider: McAfee
CHR DefaultSearchURL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A210DE714&p={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (No Name) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-06-29]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-06-29]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-06-29]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-06-29]
CHR Extension: (Virtual Keyboard) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-06-29]
CHR Extension: (No Name) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-21]
CHR Extension: (Google Wallet) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Anti-Banner) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-06-29]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-06-17]
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-06-29] (Kaspersky Lab ZAO)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
S4 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-02-13] (Lenovo (Beijing) Limited)
R2 DigiRefresh; C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.) [File not signed]
S3 digiSPTIService; C:\Program Files (x86)\Digidesign\Pro Tools\digiSPTIService.exe [159744 2011-03-04] (Avid Technology, Inc.) [File not signed]
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-15] (LogMeIn, Inc.)
R2 MobilePreIIAudioDevMon; C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe [1923592 2010-06-21] (M-Audio)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [976672 2014-06-10] (Overwolf LTD)
R2 PaceLicenseDServices; C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [2647552 2010-11-08] (PACE Anti-Piracy, Inc.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-10] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [215128 2013-05-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S3 Ctafiltv; C:\Windows\System32\drivers\Ctafiltv.sys [24064 2008-08-14] (Creative Technology Ltd.)
S4 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
S4 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2012-09-04] (<Turtle Entertainment>)
S2 hwpsgt; C:\Windows\SysWOW64\DRIVERS\hwpsgt.sys [137344 2013-09-21] () [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-06-29] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-06-29] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-06-29] (Kaspersky Lab ZAO)
S2 lemsgt; C:\Windows\SysWOW64\DRIVERS\lemsgt.sys [9472 2013-09-21] () [File not signed]
S3 MAUSBMOBILEPREII; C:\Windows\System32\DRIVERS\MAudioMobilePreII.sys [484360 2010-06-21] (M-Audio)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VCSVADHWSer; C:\Windows\System32\DRIVERS\vcsvad.sys [21504 2008-12-26] (Avnex) [File not signed]
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc;
U4 bdselfpr;
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-13 00:35 - 2014-07-13 00:35 - 00001180 _____ () C:\Users\Nick\Desktop\JRT.txt
2014-07-13 00:25 - 2014-07-13 00:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-13 00:24 - 2014-07-13 00:24 - 00003311 _____ () C:\Users\Nick\Desktop\AdwCleaner[S0].txt
2014-07-13 00:10 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-13 00:09 - 2014-07-13 00:10 - 00000000 ____D () C:\AdwCleaner
2014-07-13 00:08 - 2014-07-13 00:08 - 00056406 _____ () C:\Users\Nick\Desktop\mbam.txt
2014-07-12 22:54 - 2014-07-13 00:07 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-12 22:54 - 2014-07-12 22:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-12 22:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-12 22:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-12 22:46 - 2014-07-12 22:46 - 01016261 _____ (Thisisu) C:\Users\Nick\Desktop\JRT.exe
2014-07-12 22:45 - 2014-07-12 22:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Nick\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-12 22:45 - 2014-07-12 22:46 - 01348263 _____ () C:\Users\Nick\Desktop\adwcleaner_3.215.exe
2014-07-11 20:59 - 2014-07-11 20:59 - 00030784 _____ () C:\ComboFix.txt
2014-07-11 20:45 - 2014-07-11 20:59 - 00000000 ____D () C:\Qoobox
2014-07-11 20:45 - 2014-07-11 20:58 - 00000000 ____D () C:\Windows\erdnt
2014-07-11 20:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-11 20:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-11 20:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-11 20:41 - 2014-07-11 20:44 - 05218473 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe
2014-07-09 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-08 22:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-08 22:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-08 22:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-08 22:10 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-08 22:10 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-08 22:10 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-08 22:04 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-08 22:04 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-08 22:04 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 21:55 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-08 21:55 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-08 20:50 - 2014-07-08 20:50 - 00001415 _____ () C:\Users\Nick\Desktop\g,er.txt
2014-07-08 20:47 - 2014-07-08 20:47 - 00380416 _____ () C:\Users\Nick\Desktop\b098o7xn.exe
2014-07-08 20:42 - 2014-07-13 00:38 - 00000000 ____D () C:\FRST
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:40 - 2014-07-13 00:38 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-08 20:39 - 2014-07-08 20:39 - 00380416 _____ () C:\Users\Nick\Desktop\Gmer-19357.exe
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:31 - 2014-06-29 23:33 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:10 - 2014-06-29 23:26 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 18:11 - 2014-06-29 23:36 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:09 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-07-13 00:31 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-29 18:07 - 2014-06-29 23:03 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 18:07 - 2014-06-29 23:03 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:09 - 2014-06-29 17:45 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 14:14 - 2014-06-29 15:34 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-07-13 00:11 - 00001288 _____ () C:\Windows\setupact.log
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2014-07-13 00:11 - 00824746 _____ () C:\Windows\PFRO.log
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-25 19:07 - 2014-06-25 19:11 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:16 - 2014-06-25 18:17 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:39 - 2014-06-22 14:40 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-18 00:29 - 2014-06-29 23:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:53 - 2014-06-15 18:54 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:50 - 2014-06-15 18:52 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
2014-06-13 14:27 - 2014-06-18 10:35 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-06-13 14:27 - 2014-06-13 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!
==================== One Month Modified Files and Folders =======
2014-07-13 00:38 - 2014-07-08 20:42 - 00000000 ____D () C:\FRST
2014-07-13 00:38 - 2014-07-08 20:40 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-13 00:36 - 2012-06-12 15:03 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype
2014-07-13 00:35 - 2014-07-13 00:35 - 00001180 _____ () C:\Users\Nick\Desktop\JRT.txt
2014-07-13 00:31 - 2014-06-29 18:07 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-07-13 00:27 - 2014-05-21 18:43 - 00005120 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Lauch-Nick Lauch
2014-07-13 00:25 - 2014-07-13 00:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-13 00:24 - 2014-07-13 00:24 - 00003311 _____ () C:\Users\Nick\Desktop\AdwCleaner[S0].txt
2014-07-13 00:22 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-13 00:22 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-13 00:18 - 2012-05-25 16:26 - 02031966 _____ () C:\Windows\WindowsUpdate.log
2014-07-13 00:17 - 2012-06-22 08:03 - 00000000 ____D () C:\Users\Nick\AppData\Local\LogMeIn Hamachi
2014-07-13 00:16 - 2014-03-25 21:23 - 00000000 ____D () C:\Users\Nick\AppData\Local\CrashDumps
2014-07-13 00:16 - 2013-10-19 00:02 - 00000000 ____D () C:\Users\Nick\AppData\Local\Overwolf
2014-07-13 00:15 - 2012-09-08 16:10 - 00000000 ____D () C:\Users\Nick\AppData\Local\ESL Wire Game Client
2014-07-13 00:14 - 2012-09-14 23:31 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-13 00:14 - 2012-05-25 17:06 - 00000000 ____D () C:\ProgramData\VeriFace
2014-07-13 00:13 - 2012-09-14 23:31 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-13 00:13 - 2012-05-25 17:11 - 00100820 _____ () C:\Windows\system32\fastboot.set
2014-07-13 00:12 - 2012-06-08 16:37 - 02263867 _____ () C:\FaceProv.log
2014-07-13 00:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-13 00:11 - 2014-06-29 13:57 - 00001288 _____ () C:\Windows\setupact.log
2014-07-13 00:11 - 2014-06-29 13:56 - 00824746 _____ () C:\Windows\PFRO.log
2014-07-13 00:10 - 2014-07-13 00:09 - 00000000 ____D () C:\AdwCleaner
2014-07-13 00:08 - 2014-07-13 00:08 - 00056406 _____ () C:\Users\Nick\Desktop\mbam.txt
2014-07-13 00:07 - 2014-07-12 22:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-12 23:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-07-12 23:12 - 2012-06-09 18:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-12 22:54 - 2014-07-12 22:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2012-09-14 11:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-12 22:48 - 2014-07-12 22:45 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Nick\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-12 22:46 - 2014-07-12 22:46 - 01016261 _____ (Thisisu) C:\Users\Nick\Desktop\JRT.exe
2014-07-12 22:46 - 2014-07-12 22:45 - 01348263 _____ () C:\Users\Nick\Desktop\adwcleaner_3.215.exe
2014-07-11 22:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-11 20:59 - 2014-07-11 20:59 - 00030784 _____ () C:\ComboFix.txt
2014-07-11 20:59 - 2014-07-11 20:45 - 00000000 ____D () C:\Qoobox
2014-07-11 20:59 - 2009-07-14 05:20 - 00000000 ___HD () C:\Users\Default
2014-07-11 20:58 - 2014-07-11 20:45 - 00000000 ____D () C:\Windows\erdnt
2014-07-11 20:56 - 2009-07-14 04:34 - 00000270 _____ () C:\Windows\system.ini
2014-07-11 20:44 - 2014-07-11 20:41 - 05218473 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe
2014-07-11 20:29 - 2013-08-23 19:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-07-10 15:15 - 2013-11-01 18:11 - 00000000 ____D () C:\Program Files\Recuva
2014-07-10 00:02 - 2013-08-15 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 00:00 - 2012-07-03 19:59 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 14:23 - 2009-07-14 06:45 - 06627640 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 14:14 - 2014-05-06 21:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-09 14:14 - 2011-10-10 10:19 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-09 14:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-09 14:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-08 23:14 - 2012-06-09 18:43 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-08 23:14 - 2012-06-09 18:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-08 23:14 - 2012-06-09 18:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:50 - 2014-07-08 20:50 - 00001415 _____ () C:\Users\Nick\Desktop\g,er.txt
2014-07-08 20:47 - 2014-07-08 20:47 - 00380416 _____ () C:\Users\Nick\Desktop\b098o7xn.exe
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:41 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick
2014-07-08 20:39 - 2014-07-08 20:39 - 00380416 _____ () C:\Users\Nick\Desktop\Gmer-19357.exe
2014-07-08 19:52 - 2014-03-27 23:07 - 00008704 ___SH () C:\Users\Nick\Thumbs.db
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-07-07 20:30 - 2012-05-26 02:14 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-07-07 20:30 - 2012-05-26 02:14 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-07-07 20:30 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-06 18:16 - 2014-04-08 18:58 - 00000000 ____D () C:\Users\Nick\Desktop\Schule
2014-07-01 21:26 - 2014-03-29 10:04 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft
2014-07-01 19:28 - 2012-06-14 09:55 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TS3Client
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-30 04:09 - 2014-07-08 21:55 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-08 21:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-18 00:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-29 23:43 - 2012-06-08 21:07 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Mozilla
2014-06-29 23:36 - 2014-06-29 18:11 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 23:33 - 2014-06-29 23:31 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:33 - 2009-07-14 04:34 - 00000439 _____ () C:\Windows\win.ini
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:26 - 2014-06-29 23:10 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 23:03 - 2014-06-29 18:07 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 23:03 - 2014-06-29 18:07 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 23:03 - 2013-06-10 12:27 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2014-06-29 23:03 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-06-29 23:03 - 2013-05-06 09:22 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-06-29 20:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-06-29 17:47 - 2013-02-11 17:33 - 00000000 ____D () C:\Program Files\McAfee
2014-06-29 17:45 - 2014-06-29 17:09 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 16:26 - 2014-03-22 21:33 - 00000000 ____D () C:\ProgramData\Norton
2014-06-29 15:34 - 2014-06-29 14:14 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files\Google
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-29 13:55 - 2012-06-14 14:35 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-06-29 13:51 - 2013-11-16 12:16 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Winamp
2014-06-29 13:51 - 2013-04-09 09:32 - 00000000 ____D () C:\Windows\Minidump
2014-06-29 13:51 - 2011-02-24 19:03 - 00000000 ____D () C:\Windows\Panther
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:47 - 2012-06-08 20:52 - 00000000 ____D () C:\Users\Nick\AppData\Local\Google
2014-06-29 13:46 - 2012-06-18 21:44 - 00000000 ____D () C:\Program Files (x86)\Thoosje Sevenbar
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 12:00 - 2012-06-08 16:42 - 00851192 _____ () C:\Users\Nick\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:57 - 2012-05-25 16:50 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-06-28 22:57 - 2012-05-25 16:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-28 22:56 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:53 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-28 22:53 - 2012-07-06 19:45 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\DVDVideoSoft
2014-06-28 22:52 - 2012-11-01 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-06-25 20:14 - 2012-06-14 09:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TeamSpeak 3 Client
2014-06-25 19:11 - 2014-06-25 19:07 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:17 - 2014-06-25 18:16 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 21:08 - 2012-06-09 10:11 - 00000000 ____D () C:\Users\Nick\.gimp-2.6
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:40 - 2014-06-22 14:39 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-21 19:48 - 2012-06-08 21:22 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\MAXON
2014-06-20 22:14 - 2014-07-09 15:20 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-06-20 21:39 - 2014-07-09 15:20 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-06-20 12:35 - 2014-04-08 19:02 - 00000000 ____D () C:\Users\Nick\Desktop\Spiele
2014-06-19 03:39 - 2014-07-09 15:20 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-19 03:06 - 2014-07-09 15:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-19 03:06 - 2014-07-09 15:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-19 02:48 - 2014-07-09 15:20 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-19 02:42 - 2014-07-09 15:20 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-19 02:42 - 2014-07-09 15:20 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-19 02:41 - 2014-07-09 15:20 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-06-19 02:41 - 2014-07-09 15:20 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-19 02:32 - 2014-07-09 15:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-19 02:31 - 2014-07-09 15:20 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-19 02:26 - 2014-07-09 15:20 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-19 02:24 - 2014-07-09 15:20 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-19 02:24 - 2014-07-09 15:20 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-19 02:23 - 2014-07-09 15:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-19 02:16 - 2014-07-09 15:20 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-19 02:14 - 2014-07-09 15:20 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-19 02:09 - 2014-07-09 15:20 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-19 01:59 - 2014-07-09 15:20 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-19 01:56 - 2014-07-09 15:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-19 01:53 - 2014-07-09 15:20 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-19 01:51 - 2014-07-09 15:20 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-19 01:50 - 2014-07-09 15:20 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-19 01:48 - 2014-07-09 15:20 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-19 01:39 - 2014-07-09 15:20 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-19 01:38 - 2014-07-09 15:20 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-19 01:37 - 2014-07-09 15:20 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-19 01:36 - 2014-07-09 15:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-19 01:35 - 2014-07-09 15:20 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-06-19 01:33 - 2014-07-09 15:20 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-19 01:32 - 2014-07-09 15:20 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-19 01:28 - 2014-07-09 15:20 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-19 01:28 - 2014-07-09 15:20 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-19 01:27 - 2014-07-09 15:20 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-19 01:27 - 2014-07-09 15:20 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-19 01:25 - 2014-07-09 15:20 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-19 01:23 - 2014-07-09 15:20 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-19 01:22 - 2014-07-09 15:20 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-19 01:12 - 2014-07-09 15:20 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-19 01:06 - 2014-07-09 15:20 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-19 01:01 - 2014-07-09 15:20 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-19 00:59 - 2014-07-09 15:20 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-19 00:58 - 2014-07-09 15:20 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-19 00:58 - 2014-07-09 15:20 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-19 00:52 - 2014-07-09 15:20 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-19 00:51 - 2014-07-09 15:20 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-19 00:49 - 2014-07-09 15:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-19 00:46 - 2014-07-09 15:20 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-19 00:45 - 2014-07-09 15:20 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-19 00:35 - 2014-07-09 15:20 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-19 00:34 - 2014-07-09 15:20 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-19 00:15 - 2014-07-09 15:20 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-19 00:13 - 2014-07-09 15:20 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-19 00:09 - 2014-07-09 15:20 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-19 00:07 - 2014-07-09 15:20 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-18 20:09 - 2012-05-25 17:09 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 20:09 - 2012-05-25 17:09 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-18 10:35 - 2014-06-13 14:27 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-06-18 04:18 - 2014-07-08 22:10 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-06-18 03:51 - 2014-07-08 22:10 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-06-18 03:10 - 2014-07-08 22:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-06-18 00:41 - 2013-10-19 00:08 - 00000000 ____D () C:\Program Files (x86)\Overwolf
2014-06-17 21:54 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Local\VirtualStore
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:54 - 2014-06-15 18:53 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:52 - 2014-06-15 18:50 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
2014-06-13 14:27 - 2014-06-13 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!
Files to move or delete:
====================
C:\Users\Nick\kg DI Video Essentials 2.exe
C:\Users\Nick\kg DI Video Essentials 3.exe
Some content of TEMP:
====================
C:\Users\Nick\AppData\Local\Temp\EslWireSetup-1.17.3.8001-x64.exe
C:\Users\Nick\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-08 22:14
==================== End Of Log ============================
|
|
13.07.2014, 15:10
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Internet langsam / Computer lahmtESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.07.2014, 20:53
| #11 |
| | Windows 7: Internet langsam / Computer lahmt ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a3f495ca76ea764d8c6abd70e4210fe4
# engine=19169
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-14 06:16:55
# local_time=2014-07-14 08:16:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1292 16777213 100 100 11993 36839837 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 95531 156991665 0 0
# scanned=359015
# found=4
# cleaned=0
# scan_time=10099
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=F5817128DC921B6379A43746DA0EBBA3FE389F38 ft=1 fh=b864000aff00c7dc vn="Win32/SoftonicDownloader.G evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Nick\Desktop\Freizeit\Extras\SoftonicDownloader_fuer_freerip-mp3.exe"
sh=2E614AC2807DA84C87BF40535480B2462599903C ft=1 fh=3d7e7c096ff48567 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Nick\Desktop\Minecraft etc\Neben-Bearbeitung\Sony Vegas Pro - CHIP-Downloader.exe"
sh=CE69C2437A6AFF1BED41CE2A6B2FB7587322C5BD ft=1 fh=259edf11759a5db9 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Nick\Downloads\Virtual Audio Cable - CHIP-Installer.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.85
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Internet Security
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Call of Duty: Ghosts - Multiplayer
JavaFX 2.1.1
Java 7 Update 7
Java version out of Date!
Adobe Flash Player 14.0.0.145
Adobe Reader 10.1.1 Adobe Reader out of Date!
Mozilla Firefox (30.0)
Google Chrome 35.0.1916.114
Google Chrome 35.0.1916.153
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2014 01
Ran by Nick (administrator) on LAUCH on 14-07-2014 20:18:05
Running from C:\Users\Nick\Desktop\Trojaner-Board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Avid Technology, Inc.) C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(M-Audio) C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-05-25] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-05-25] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-05-25] (Lenovo)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-05-25] (Lenovo)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DigidesignMMERefresh] => C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [GoogleChromeAutoLaunch_B9D48092DF53DE2F032C3C1B28E5E1A1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-155573163-2419272169-70813047-1001\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()
ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {2B65D609-89B6-43A7-A527-C618C5AFDD77} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A010DE714&p={SearchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.250
FireFox:
========
FF ProfilePath: C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Nick\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\xdcbzp4d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-30]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-06-29]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-06-29]
Chrome:
=======
CHR HomePage:
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchKeyword: mcafee
CHR DefaultSearchProvider: McAfee
CHR DefaultSearchURL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A210DE714&p={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (No Name) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-06-29]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-06-29]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-06-29]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-06-29]
CHR Extension: (Virtual Keyboard) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-06-29]
CHR Extension: (No Name) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-02-21]
CHR Extension: (Google Wallet) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Anti-Banner) - C:\Users\Nick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-06-29]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-06-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-06-17]
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-06-29] (Kaspersky Lab ZAO)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
S4 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-02-13] (Lenovo (Beijing) Limited)
R2 DigiRefresh; C:\Program Files (x86)\Digidesign\Pro Tools\MMERefresh.exe [81920 2011-03-04] (Avid Technology, Inc.) [File not signed]
S3 digiSPTIService; C:\Program Files (x86)\Digidesign\Pro Tools\digiSPTIService.exe [159744 2011-03-04] (Avid Technology, Inc.) [File not signed]
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-06-11] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-15] (LogMeIn, Inc.)
R2 MobilePreIIAudioDevMon; C:\Program Files (x86)\M-Audio\MobilePre\AudioDevMon.exe [1923592 2010-06-21] (M-Audio)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [976672 2014-06-10] (Overwolf LTD)
R2 PaceLicenseDServices; C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [2647552 2010-11-08] (PACE Anti-Piracy, Inc.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-04-10] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [215128 2013-05-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S3 Ctafiltv; C:\Windows\System32\drivers\Ctafiltv.sys [24064 2008-08-14] (Creative Technology Ltd.)
S4 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
S4 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [147472 2012-09-04] (<Turtle Entertainment>)
S2 hwpsgt; C:\Windows\SysWOW64\DRIVERS\hwpsgt.sys [137344 2013-09-21] () [File not signed]
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-06-29] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-06-29] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-06-29] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-06-29] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-06-29] (Kaspersky Lab ZAO)
S2 lemsgt; C:\Windows\SysWOW64\DRIVERS\lemsgt.sys [9472 2013-09-21] () [File not signed]
S3 MAUSBMOBILEPREII; C:\Windows\System32\DRIVERS\MAudioMobilePreII.sys [484360 2010-06-21] (M-Audio)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VCSVADHWSer; C:\Windows\System32\DRIVERS\vcsvad.sys [21504 2008-12-26] (Avnex) [File not signed]
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
U3 BcmSqlStartupSvc;
U4 bdselfpr;
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-14 17:06 - 2014-07-14 17:06 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-14 00:26 - 2014-07-14 00:26 - 00000947 _____ () C:\Users\Nick\Desktop\checkup.txt
2014-07-13 17:47 - 2014-07-13 17:47 - 00854390 _____ () C:\Users\Nick\Desktop\SecurityCheck.exe
2014-07-13 17:46 - 2014-07-13 17:47 - 02347384 _____ (ESET) C:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
2014-07-13 17:45 - 2014-07-13 17:45 - 00006572 _____ () C:\Users\Nick\Documents\cc_20140713_174540.reg
2014-07-13 00:39 - 2014-07-13 00:39 - 00069522 _____ () C:\Users\Nick\Desktop\FRST.txt
2014-07-13 00:35 - 2014-07-13 00:35 - 00001180 _____ () C:\Users\Nick\Desktop\JRT.txt
2014-07-13 00:25 - 2014-07-13 00:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-13 00:24 - 2014-07-13 00:24 - 00003311 _____ () C:\Users\Nick\Desktop\AdwCleaner[S0].txt
2014-07-13 00:10 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-13 00:09 - 2014-07-13 00:10 - 00000000 ____D () C:\AdwCleaner
2014-07-13 00:08 - 2014-07-13 00:08 - 00056406 _____ () C:\Users\Nick\Desktop\mbam.txt
2014-07-12 22:54 - 2014-07-13 00:07 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-12 22:54 - 2014-07-12 22:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-12 22:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-12 22:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-12 22:46 - 2014-07-12 22:46 - 01016261 _____ (Thisisu) C:\Users\Nick\Desktop\JRT.exe
2014-07-12 22:45 - 2014-07-12 22:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Nick\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-12 22:45 - 2014-07-12 22:46 - 01348263 _____ () C:\Users\Nick\Desktop\adwcleaner_3.215.exe
2014-07-11 21:20 - 2014-07-11 21:20 - 00030784 _____ () C:\Users\Nick\Desktop\ComboFix.txt
2014-07-11 20:59 - 2014-07-11 20:59 - 00030784 _____ () C:\ComboFix.txt
2014-07-11 20:45 - 2014-07-11 20:59 - 00000000 ____D () C:\Qoobox
2014-07-11 20:45 - 2014-07-11 20:58 - 00000000 ____D () C:\Windows\erdnt
2014-07-11 20:45 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-11 20:45 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-11 20:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-11 20:45 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-11 20:41 - 2014-07-11 20:44 - 05218473 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe
2014-07-09 15:20 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 15:20 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 15:20 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 15:20 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 15:20 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 15:20 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 15:20 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 15:20 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 15:20 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 15:20 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 15:20 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 15:20 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 15:20 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 15:20 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 15:20 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 15:20 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 15:20 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 15:20 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 15:20 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 15:20 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 15:20 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 15:20 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 15:20 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 15:20 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 15:20 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 15:20 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 15:20 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 15:20 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 15:20 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 15:20 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 15:20 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 15:20 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 15:20 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 15:20 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 15:20 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 15:20 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 15:20 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 15:20 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 15:20 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 15:20 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 15:20 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 15:20 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 15:20 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 15:20 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 15:20 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 15:20 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 15:20 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 15:20 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 15:20 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 15:20 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 15:20 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 15:20 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 15:20 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 15:20 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 15:20 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 15:20 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-08 22:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-08 22:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-08 22:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-08 22:10 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-08 22:10 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-08 22:10 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-08 22:04 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-08 22:04 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-08 22:04 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-08 22:04 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-08 22:04 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 21:55 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-08 21:55 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-08 20:50 - 2014-07-08 20:50 - 00001415 _____ () C:\Users\Nick\Desktop\g,er.txt
2014-07-08 20:47 - 2014-07-08 20:47 - 00380416 _____ () C:\Users\Nick\Desktop\b098o7xn.exe
2014-07-08 20:42 - 2014-07-14 20:18 - 00000000 ____D () C:\FRST
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:40 - 2014-07-14 20:18 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-08 20:39 - 2014-07-08 20:39 - 00380416 _____ () C:\Users\Nick\Desktop\Gmer-19357.exe
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:31 - 2014-06-29 23:33 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:10 - 2014-06-29 23:26 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 18:11 - 2014-06-29 23:36 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:09 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-07-14 19:17 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-29 18:07 - 2014-06-29 23:03 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 18:07 - 2014-06-29 23:03 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:09 - 2014-06-29 17:45 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 14:14 - 2014-06-29 15:34 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-07-14 16:55 - 00001456 _____ () C:\Windows\setupact.log
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2014-07-13 00:11 - 00824746 _____ () C:\Windows\PFRO.log
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:54 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-25 19:07 - 2014-06-25 19:11 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:16 - 2014-06-25 18:17 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:39 - 2014-06-22 14:40 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-18 00:29 - 2014-06-29 23:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:53 - 2014-06-15 18:54 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:50 - 2014-06-15 18:52 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
==================== One Month Modified Files and Folders =======
2014-07-14 20:18 - 2014-07-08 20:42 - 00000000 ____D () C:\FRST
2014-07-14 20:18 - 2014-07-08 20:40 - 00000000 ____D () C:\Users\Nick\Desktop\Trojaner-Board
2014-07-14 20:14 - 2012-09-14 23:31 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-14 20:14 - 2012-09-14 23:31 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-14 20:12 - 2012-06-09 18:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-14 19:17 - 2014-06-29 18:07 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-07-14 17:32 - 2014-05-21 18:43 - 00005120 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Lauch-Nick Lauch
2014-07-14 17:06 - 2014-07-14 17:06 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-14 17:05 - 2013-11-01 18:11 - 00000000 ____D () C:\Program Files\Recuva
2014-07-14 17:05 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-14 17:05 - 2009-07-14 06:45 - 00031840 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-14 17:03 - 2012-05-25 16:26 - 02076271 _____ () C:\Windows\WindowsUpdate.log
2014-07-14 16:59 - 2014-03-25 21:23 - 00000000 ____D () C:\Users\Nick\AppData\Local\CrashDumps
2014-07-14 16:58 - 2012-06-22 08:03 - 00000000 ____D () C:\Users\Nick\AppData\Local\LogMeIn Hamachi
2014-07-14 16:57 - 2012-05-25 17:11 - 00073376 _____ () C:\Windows\system32\fastboot.set
2014-07-14 16:57 - 2012-05-25 17:06 - 00000000 ____D () C:\ProgramData\VeriFace
2014-07-14 16:56 - 2012-06-08 16:37 - 02270229 _____ () C:\FaceProv.log
2014-07-14 16:55 - 2014-06-29 13:57 - 00001456 _____ () C:\Windows\setupact.log
2014-07-14 16:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-14 00:26 - 2014-07-14 00:26 - 00000947 _____ () C:\Users\Nick\Desktop\checkup.txt
2014-07-13 17:47 - 2014-07-13 17:47 - 00854390 _____ () C:\Users\Nick\Desktop\SecurityCheck.exe
2014-07-13 17:47 - 2014-07-13 17:46 - 02347384 _____ (ESET) C:\Users\Nick\Desktop\esetsmartinstaller_deu.exe
2014-07-13 17:45 - 2014-07-13 17:45 - 00006572 _____ () C:\Users\Nick\Documents\cc_20140713_174540.reg
2014-07-13 17:45 - 2012-05-25 16:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-07-13 14:25 - 2012-06-12 15:03 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype
2014-07-13 13:54 - 2013-10-19 00:02 - 00000000 ____D () C:\Users\Nick\AppData\Local\Overwolf
2014-07-13 13:53 - 2012-09-08 16:10 - 00000000 ____D () C:\Users\Nick\AppData\Local\ESL Wire Game Client
2014-07-13 00:39 - 2014-07-13 00:39 - 00069522 _____ () C:\Users\Nick\Desktop\FRST.txt
2014-07-13 00:35 - 2014-07-13 00:35 - 00001180 _____ () C:\Users\Nick\Desktop\JRT.txt
2014-07-13 00:25 - 2014-07-13 00:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-13 00:24 - 2014-07-13 00:24 - 00003311 _____ () C:\Users\Nick\Desktop\AdwCleaner[S0].txt
2014-07-13 00:11 - 2014-06-29 13:56 - 00824746 _____ () C:\Windows\PFRO.log
2014-07-13 00:10 - 2014-07-13 00:09 - 00000000 ____D () C:\AdwCleaner
2014-07-13 00:08 - 2014-07-13 00:08 - 00056406 _____ () C:\Users\Nick\Desktop\mbam.txt
2014-07-13 00:07 - 2014-07-12 22:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-12 23:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-07-12 22:54 - 2014-07-12 22:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2014-07-12 22:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-07-12 22:54 - 2012-09-14 11:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-12 22:48 - 2014-07-12 22:45 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Nick\Desktop\mbam-setup-2.0.2.1012.exe
2014-07-12 22:46 - 2014-07-12 22:46 - 01016261 _____ (Thisisu) C:\Users\Nick\Desktop\JRT.exe
2014-07-12 22:46 - 2014-07-12 22:45 - 01348263 _____ () C:\Users\Nick\Desktop\adwcleaner_3.215.exe
2014-07-11 22:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-11 21:20 - 2014-07-11 21:20 - 00030784 _____ () C:\Users\Nick\Desktop\ComboFix.txt
2014-07-11 20:59 - 2014-07-11 20:59 - 00030784 _____ () C:\ComboFix.txt
2014-07-11 20:59 - 2014-07-11 20:45 - 00000000 ____D () C:\Qoobox
2014-07-11 20:59 - 2009-07-14 05:20 - 00000000 ___HD () C:\Users\Default
2014-07-11 20:58 - 2014-07-11 20:45 - 00000000 ____D () C:\Windows\erdnt
2014-07-11 20:56 - 2009-07-14 04:34 - 00000270 _____ () C:\Windows\system.ini
2014-07-11 20:44 - 2014-07-11 20:41 - 05218473 ____R (Swearware) C:\Users\Nick\Desktop\ComboFix.exe
2014-07-11 20:29 - 2013-08-23 19:42 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-07-10 00:02 - 2013-08-15 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 00:00 - 2012-07-03 19:59 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 14:23 - 2009-07-14 06:45 - 06627640 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 14:14 - 2014-05-06 21:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-09 14:14 - 2011-10-10 10:19 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-09 14:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-09 14:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-08 23:14 - 2012-06-09 18:43 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-08 23:14 - 2012-06-09 18:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-08 23:14 - 2012-06-09 18:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:50 - 2014-07-08 20:50 - 00001415 _____ () C:\Users\Nick\Desktop\g,er.txt
2014-07-08 20:47 - 2014-07-08 20:47 - 00380416 _____ () C:\Users\Nick\Desktop\b098o7xn.exe
2014-07-08 20:41 - 2014-07-08 20:41 - 00000000 _____ () C:\Users\Nick\defogger_reenable
2014-07-08 20:41 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick
2014-07-08 20:39 - 2014-07-08 20:39 - 00380416 _____ () C:\Users\Nick\Desktop\Gmer-19357.exe
2014-07-08 19:52 - 2014-03-27 23:07 - 00008704 ___SH () C:\Users\Nick\Thumbs.db
2014-07-07 21:06 - 2014-07-07 21:06 - 00000000 ____D () C:\Users\Nick\Desktop\Extra
2014-07-07 20:30 - 2012-05-26 02:14 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-07-07 20:30 - 2012-05-26 02:14 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-07-07 20:30 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-06 18:16 - 2014-04-08 18:58 - 00000000 ____D () C:\Users\Nick\Desktop\Schule
2014-07-01 21:26 - 2014-03-29 10:04 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft
2014-07-01 19:28 - 2012-06-14 09:55 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TS3Client
2014-06-30 20:11 - 2014-06-30 20:11 - 00009792 _____ () C:\Users\Nick\Documents\cc_20140630_201106.reg
2014-06-30 04:09 - 2014-07-08 21:55 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-08 21:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-29 23:43 - 2014-06-29 23:43 - 00001166 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-29 23:43 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-29 23:43 - 2014-06-18 00:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-29 23:43 - 2012-06-08 21:07 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Mozilla
2014-06-29 23:36 - 2014-06-29 18:11 - 00002337 _____ () C:\Users\Nick\Desktop\Sicherer Zahlungsverkehr.lnk
2014-06-29 23:33 - 2014-06-29 23:31 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2014-06-29 23:33 - 2009-07-14 04:34 - 00000439 _____ () C:\Windows\win.ini
2014-06-29 23:27 - 2014-06-29 23:27 - 00000000 ____D () C:\Users\Nick\Desktop\tweaking.com_windows_repair_aio
2014-06-29 23:26 - 2014-06-29 23:10 - 29677544 _____ (Mozilla) C:\Users\Nick\Downloads\Firefox_Setup_de30.0.exe
2014-06-29 23:03 - 2014-06-29 18:07 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-29 23:03 - 2014-06-29 18:07 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-29 23:03 - 2013-06-10 12:27 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2014-06-29 23:03 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-06-29 23:03 - 2013-05-06 09:22 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2014-06-29 23:03 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-06-29 20:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-29 18:09 - 2014-06-29 18:09 - 00001135 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-06-29 18:09 - 2014-06-29 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-06-29 18:08 - 2014-06-29 18:08 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-06-29 18:07 - 2014-06-29 18:07 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-29 17:50 - 2012-05-25 17:08 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-06-29 17:47 - 2013-02-11 17:33 - 00000000 ____D () C:\Program Files\McAfee
2014-06-29 17:45 - 2014-06-29 17:09 - 246598160 _____ () C:\Users\Nick\Downloads\kis14.0.0.4651de-de.exe
2014-06-29 16:26 - 2014-03-22 21:33 - 00000000 ____D () C:\ProgramData\Norton
2014-06-29 15:34 - 2014-06-29 14:14 - 281672840 ____N (Symantec Corporation) C:\Users\Nick\Downloads\NIS-ESD-21.3.0-GE.exe
2014-06-29 13:57 - 2014-06-29 13:57 - 00000000 _____ () C:\Windows\setuperr.log
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files\Google
2014-06-29 13:56 - 2012-05-25 17:09 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-29 13:55 - 2012-06-14 14:35 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-06-29 13:51 - 2013-11-16 12:16 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Winamp
2014-06-29 13:51 - 2013-04-09 09:32 - 00000000 ____D () C:\Windows\Minidump
2014-06-29 13:51 - 2011-02-24 19:03 - 00000000 ____D () C:\Windows\Panther
2014-06-29 13:49 - 2014-06-29 13:49 - 00021248 _____ () C:\Users\Nick\Documents\cc_20140629_134859.reg
2014-06-29 13:49 - 2014-06-29 13:49 - 00000184 _____ () C:\Users\Nick\Documents\cc_20140629_134910.reg
2014-06-29 13:47 - 2012-06-08 20:52 - 00000000 ____D () C:\Users\Nick\AppData\Local\Google
2014-06-29 13:46 - 2012-06-18 21:44 - 00000000 ____D () C:\Program Files (x86)\Thoosje Sevenbar
2014-06-29 13:45 - 2014-06-29 13:45 - 00000033 _____ () C:\ProgramData\{081230F8-EA50-42A9-983C-D22ABC2EED3B}.ini
2014-06-29 12:00 - 2012-06-08 16:42 - 00851192 _____ () C:\Users\Nick\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-29 00:22 - 2014-06-29 00:22 - 00140594 _____ () C:\Users\Nick\Documents\cc_20140629_002247.reg
2014-06-29 00:17 - 2014-06-29 00:17 - 00079968 _____ () C:\Users\Nick\Documents\ts3_clientui-win64-1403250090-2014-06-29 00_17_29.975685.dmp
2014-06-28 22:57 - 2012-05-25 16:50 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-06-28 22:56 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:56 - 2012-05-25 17:06 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TuneUp Software
2014-06-28 22:54 - 2014-06-28 22:53 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-28 22:53 - 2014-06-28 22:53 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-28 22:53 - 2012-07-06 19:45 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\DVDVideoSoft
2014-06-28 22:52 - 2012-11-01 21:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-06-25 20:14 - 2012-06-14 09:54 - 00000000 ____D () C:\Users\Nick\AppData\Local\TeamSpeak 3 Client
2014-06-25 19:11 - 2014-06-25 19:07 - 40889525 _____ () C:\Users\Nick\Downloads\TEAVSRP2.zip
2014-06-25 18:17 - 2014-06-25 18:16 - 00000123 _____ () C:\Users\Nick\Desktop\xx.txt
2014-06-25 16:20 - 2014-06-25 16:20 - 00000937 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-06-25 16:20 - 2014-06-25 16:20 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-06-23 21:08 - 2012-06-09 10:11 - 00000000 ____D () C:\Users\Nick\.gimp-2.6
2014-06-23 20:48 - 2014-06-23 20:48 - 00004695 _____ () C:\Users\Nick\.recently-used.xbel
2014-06-22 16:40 - 2014-06-22 16:40 - 00002161 _____ () C:\Users\Nick\Downloads\Part_2.html
2014-06-22 14:40 - 2014-06-22 14:39 - 00000000 ____D () C:\Users\Nick\Desktop\Nebenzeugs
2014-06-21 19:48 - 2012-06-08 21:22 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\MAXON
2014-06-20 22:14 - 2014-07-09 15:20 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-06-20 21:39 - 2014-07-09 15:20 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-06-20 12:35 - 2014-04-08 19:02 - 00000000 ____D () C:\Users\Nick\Desktop\Spiele
2014-06-19 03:39 - 2014-07-09 15:20 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-19 03:06 - 2014-07-09 15:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-19 03:06 - 2014-07-09 15:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-19 02:48 - 2014-07-09 15:20 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-19 02:42 - 2014-07-09 15:20 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-19 02:42 - 2014-07-09 15:20 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-19 02:41 - 2014-07-09 15:20 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-06-19 02:41 - 2014-07-09 15:20 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-19 02:32 - 2014-07-09 15:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-19 02:31 - 2014-07-09 15:20 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-19 02:26 - 2014-07-09 15:20 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-19 02:24 - 2014-07-09 15:20 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-19 02:24 - 2014-07-09 15:20 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-19 02:23 - 2014-07-09 15:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-19 02:16 - 2014-07-09 15:20 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-19 02:14 - 2014-07-09 15:20 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-19 02:09 - 2014-07-09 15:20 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-19 01:59 - 2014-07-09 15:20 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-19 01:56 - 2014-07-09 15:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-19 01:53 - 2014-07-09 15:20 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-19 01:51 - 2014-07-09 15:20 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-19 01:50 - 2014-07-09 15:20 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-19 01:48 - 2014-07-09 15:20 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-19 01:39 - 2014-07-09 15:20 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-19 01:38 - 2014-07-09 15:20 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-19 01:37 - 2014-07-09 15:20 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-19 01:36 - 2014-07-09 15:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-19 01:35 - 2014-07-09 15:20 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-06-19 01:33 - 2014-07-09 15:20 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-19 01:32 - 2014-07-09 15:20 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-19 01:28 - 2014-07-09 15:20 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-19 01:28 - 2014-07-09 15:20 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-19 01:27 - 2014-07-09 15:20 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-19 01:27 - 2014-07-09 15:20 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-19 01:25 - 2014-07-09 15:20 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-19 01:23 - 2014-07-09 15:20 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-19 01:22 - 2014-07-09 15:20 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-19 01:12 - 2014-07-09 15:20 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-19 01:06 - 2014-07-09 15:20 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-19 01:01 - 2014-07-09 15:20 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-19 00:59 - 2014-07-09 15:20 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-19 00:58 - 2014-07-09 15:20 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-19 00:58 - 2014-07-09 15:20 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-19 00:52 - 2014-07-09 15:20 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-19 00:51 - 2014-07-09 15:20 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-19 00:49 - 2014-07-09 15:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-19 00:46 - 2014-07-09 15:20 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-19 00:45 - 2014-07-09 15:20 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-19 00:35 - 2014-07-09 15:20 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-19 00:34 - 2014-07-09 15:20 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-19 00:15 - 2014-07-09 15:20 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-19 00:13 - 2014-07-09 15:20 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-19 00:09 - 2014-07-09 15:20 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-19 00:07 - 2014-07-09 15:20 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-18 20:09 - 2012-05-25 17:09 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 20:09 - 2012-05-25 17:09 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-18 10:35 - 2014-06-13 14:27 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-06-18 04:18 - 2014-07-08 22:10 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-06-18 03:51 - 2014-07-08 22:10 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-06-18 03:10 - 2014-07-08 22:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-06-18 00:41 - 2013-10-19 00:08 - 00000000 ____D () C:\Program Files (x86)\Overwolf
2014-06-17 21:54 - 2012-06-08 16:37 - 00000000 ____D () C:\Users\Nick\AppData\Local\VirtualStore
2014-06-17 21:52 - 2014-06-17 21:52 - 00000100 _____ () C:\Users\Nick\Desktop\einslivedigi.m3u
2014-06-15 18:54 - 2014-06-15 18:53 - 00000000 ____D () C:\Users\Nick\AppData\OICE_15_974FA576_32C1D314_36D9
2014-06-15 18:52 - 2014-06-15 18:50 - 00330240 _____ () C:\Users\Nick\Downloads\Hitlers Auenpolitik in den Jahren 1933 - 1939.ppt
Files to move or delete:
====================
C:\Users\Nick\kg DI Video Essentials 2.exe
C:\Users\Nick\kg DI Video Essentials 3.exe
Some content of TEMP:
====================
C:\Users\Nick\AppData\Local\Temp\EslWireSetup-1.17.3.8001-x64.exe
C:\Users\Nick\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-08 22:14
==================== End Of Log ============================
--- --- --- Ja, keine derzeitig erwähnenswerte Verbesserung erfolgt. Internet weiterhin sehr langsam. so langsam, dass diese Seite von mir etwa 20x geladen werden musste, damit sie überhaupt abgezeigt werden konnte. Die anderen 19-male war keine Verbindung zum Internet vorhanden. - Bei meiner Familie etc. funktioniert alles einwandfrei. |
|
15.07.2014, 19:28
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7: Internet langsam / Computer lahmt Also nur dieser Rechner? In jedem Browser? Was ist mit WIndows Update, Update von AV? Auch so langsam? Java und Adobe updaten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
