| |
| |||||||
Log-Analyse und Auswertung: SergeLeLama.vbs im autostart und verschiedene nicht zu beendende ProzesseWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.07.2014, 11:37
| #1 |
| |  SergeLeLama.vbs im autostart und verschiedene nicht zu beendende Prozesse Hallo liebes Trojaner-Board-Team, Ich habe mir vor knapp 10 Tagen etwas fieses auf meinen (5 Jahre alten, zwischendurch nie formatierten) Laptop geholt als ich in einem Copyshop etwas ausdrucken musste und dabei wohl meinen USB-Stick infiziert habe. Ich hatte es kurz danach gemerkt, als Inhalte in Ordnern auf dem USB-Stick sich in neuen Fenstern öffneten und neue Dateien nur noch als Verknüpfungen angezeigt wurden. Da das Ganze genau in der Prüfungszeit war und ich absolut keine Zeit für irgendwas außer lernen hatte, war ich so dämlich und hab nur den Rogue-Killer drüber laufen lassen, aber zwischendurch wohl die Logfile gelöscht. Ich hatte zudem mein System 2x mit Malwarebytes Anti-Malware gescannt aber es kam beides mal nichts bei raus, weswegen ich die Logs hier auch nicht anhänge. Mittlerweile sind die Prüfungen rum aber das ganze wird immer böser. Unter meinen Autostart-programmen zeigt sich ein "SergeleLama.vbs" was sich zu kopieren scheint wenn ich es deaktiviere. Zudem laufen zahlreiche aktive Prozesse ohne Benutzernamen und Beschreibung, die sich nicht mehr beenden lassen (u.A. csrss.exe, winlogon.exe, atieclxx.exe, wacomhost.exe, etc) und mein Laptop wird darunter immer langsamer. Wäre richtig toll wenn sich da noch was machen ließe oder wenn ihr mir zumindest sagen könnt, ob am (wohl ohnehin schon überfälligen) Formatieren kein Weg vorbei führt. Vielen Dank! SegundoSol Hier die Logfiles: FRST.txt: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by JéRaThie (administrator) on SEGUNDOSOL on 24-07-2014 12:03:10
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
( ) C:\Windows\System32\lxczcoms.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
() E:\Extras\DesktopCoral\DesktopCoral.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
(Spotify Ltd) C:\Users\JéRaThie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [238592 2009-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs" <===== ATTENTION
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [422400 2007-04-16] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4086432 2014-07-06] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BambooCore] => C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
Winlogon\Notify\WB: E:\Extras\WindowBlinds\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe -update activex
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [Desktop Coral] => E:\Extras\DesktopCoral\DesktopCoral.exe [2303488 2008-11-26] ()
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Run: [SergeLeLama] => wscript.exe //B "C:\Users\JRATHI~1\AppData\Local\Temp\SergeLeLama.vbs" <===== ATTENTION
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {45fda274-199a-11df-ab98-0026222e4b24} - G:\StartPortableApps.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {55598bdb-ab70-11de-88a4-0026222e4b24} - D:\Eautorun.exe
HKU\S-1-5-21-502464258-2623245878-921248753-1000\...\MountPoints2: {fc268444-23b4-11df-a7e9-001e65103b4e} - VLkmed0349-v-sd90jk129-0G\1490304-609127988309-709234\taskmgr.exe
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteTray.lnk
ShortcutTarget: EvernoteTray.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
Startup: C:\Users\JéRaThie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SergeLeLama.vbs ()
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
BootExecute:
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEG&bmod=TSEG;
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSEG;
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {B370819F-BB8B-4389-A1F6-AC059D91316A} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/stg_drm.ocx
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/armhelper.ocx
DPF: HKLM-x32 {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 139.18.25.3 139.18.1.2
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @google.com/npPicasa2,version=2.0.0 - C:\Program Files (x86)\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\JéRaThie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\libdivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdivx32.dll (DivX,Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ssldivx.dll (The OpenSSL Project, hxxp://www.openssl.org/)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-02-06]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-14]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-10-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-04-13]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Shiretoko\firefox.exe
Chrome:
=======
CHR HomePage: hxxp://my.jolicloud.com/#!/dashboard
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (Snip-Me - Amazon-Preisalarm) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggbcajkaanddkocabpldmeomjdlgjpag [2014-04-11]
CHR Extension: (AdBlock) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-11]
CHR Extension: (avast! Online Security) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-11]
CHR Extension: (vGet Extension (Video Downloader, DLNA)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hniladkejehjfchadikcbjmgjaogciic [2014-04-11]
CHR Extension: (StayFocusd) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji [2014-04-11]
CHR Extension: (Jolidrive) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfakdllpdfjjbfommlcnfkedmbigkfdo [2014-07-23]
CHR Extension: (Pocket (formerly Read It Later)) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2014-04-11]
CHR Extension: (Google Wallet) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Quick Scroll) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc [2014-04-11]
CHR Extension: (Evernote Web Clipper) - C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-04-27]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-07-06]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems) [File not signed]
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-07-06] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [627992 2013-12-17] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 androidusb; C:\Windows\System32\Drivers\tinnoadb.sys [31744 2010-03-12] (Google Inc) [File not signed]
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64752 2014-07-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-06] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2014-07-06] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-09-09] ()
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-01-04] (Samsung Electronics)
S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4AMD64.sys [22176 2012-04-02] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-09-17] (EnTech Taiwan)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-09-09] ()
R0 LPCFilter; C:\Windows\SysWOW64\DRIVERS\LPCFilter.sys [32040 2008-05-07] (COMPAL ELECTRONIC INC.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-09-27] () [File not signed]
S3 cpuz130; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz132; \??\C:\Users\JRATHI~1\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 moufiltr; system32\DRIVERS\moufiltr.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 UnlockMonitor; \??\C:\Program Files (x86)\UnLock IT\v3\UnlockMonitor-x64.sys [X]
S3 vhidmini; system32\DRIVERS\walvhid.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-24 11:27 - 2014-07-24 12:00 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Prüfungsarbeit.doc#
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 02:48 - 2014-07-24 02:48 - 00029531 _____ () C:\Users\JéRaThie\Desktop\gmer.txt
2014-07-24 01:32 - 2014-07-24 11:34 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 19:14 - 2014-07-24 11:36 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-23 17:56 - 2014-07-23 19:01 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-23 11:42 - 2014-07-23 12:04 - 117204143 _____ () C:\Users\JéRaThie\Downloads\xvideos.com_d5c634aaccd72fa1f90a47886ae91c9f.flv
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 22:57 - 2014-07-16 22:58 - 04812672 _____ (Piriform Ltd) C:\Users\JéRaThie\Downloads\ccsetup415.exe
2014-07-16 18:18 - 2014-07-24 11:22 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-16 18:18 - 2014-07-16 18:18 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:05 - 2014-07-16 00:06 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-15 19:51 - 2014-07-15 19:51 - 00848856 _____ (Panda Security ) C:\Users\JéRaThie\Downloads\USBVaccineSetup.exe
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-10 15:46 - 2014-06-07 06:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 15:46 - 2014-06-07 05:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 15:46 - 2014-06-07 04:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 15:46 - 2014-06-07 04:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 15:46 - 2014-06-07 04:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 04:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 15:46 - 2014-06-07 04:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-07-10 15:46 - 2014-06-07 04:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-10 15:46 - 2014-06-07 04:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 04:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 04:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 04:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 04:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 04:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-07-10 15:46 - 2014-06-07 04:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-10 15:46 - 2014-06-07 02:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 15:46 - 2014-06-07 01:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 15:46 - 2014-06-07 01:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 15:46 - 2014-06-07 01:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 15:46 - 2014-06-07 01:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 15:46 - 2014-06-07 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 15:46 - 2014-06-07 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-07-10 15:46 - 2014-06-07 00:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-10 15:46 - 2014-06-07 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-10 15:46 - 2014-06-07 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-07-10 15:46 - 2014-06-07 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 15:46 - 2014-06-07 00:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 15:46 - 2014-06-07 00:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-07-10 15:46 - 2014-06-07 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-10 15:46 - 2014-06-07 00:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-07-10 15:46 - 2014-06-07 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-10 15:45 - 2014-06-07 02:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 15:45 - 2014-06-06 10:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 15:45 - 2014-06-06 09:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 15:45 - 2014-05-30 09:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-07 01:53 - 2014-07-12 21:10 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-29 20:22 - 2014-06-29 20:38 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 20:12 - 2014-07-14 19:25 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-28 20:00 - 2014-06-28 20:07 - 00007530 _____ () C:\Users\JéRaThie\Documents\Uninstall Dragon Age Origins.log
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\JéRaThie\Desktop\Skyrim.lnk
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\Gast\Desktop\Skyrim (SKSE).lnk
2014-06-28 19:18 - 2014-06-29 15:22 - 00000000 ____D () C:\Users\JéRaThie\Documents\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000853 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Black_Tree_Gaming
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
2014-06-28 18:12 - 2014-06-29 15:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Skyrim
2014-06-28 18:11 - 2014-06-28 18:12 - 00977294 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_LangPack_MSI369D.txt
2014-06-28 18:10 - 2014-06-28 18:11 - 00000000 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_x64_MSI35B6.txt
2014-06-27 15:30 - 2014-06-28 15:33 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\avidemux
2014-06-25 19:03 - 2014-06-25 19:03 - 00005379 _____ () C:\Windows\SysWOW64\collectionCache.bnk
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-07-24 12:03 - 2014-04-17 08:56 - 00000000 ____D () C:\Users\JéRaThie\Downloads\Malware-removal
2014-07-24 12:03 - 2014-04-16 15:22 - 00000000 ____D () C:\FRST
2014-07-24 12:00 - 2014-07-24 11:27 - 00000124 ____H () C:\Users\JéRaThie\Desktop\.~lock.Prüfungsarbeit.doc#
2014-07-24 11:57 - 2014-05-19 09:12 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\DropboxMaster
2014-07-24 11:57 - 2011-09-17 15:45 - 00000000 ___RD () C:\Users\JéRaThie\Dropbox
2014-07-24 11:57 - 2011-09-17 15:41 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Dropbox
2014-07-24 11:52 - 2012-11-30 15:33 - 01535175 _____ () C:\Windows\WindowsUpdate.log
2014-07-24 11:39 - 2012-08-13 23:16 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-24 11:36 - 2014-07-23 19:14 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Diagnostik
2014-07-24 11:34 - 2014-07-24 01:32 - 00000366 ____H () C:\Windows\Tasks\avast! Emergency Update.job
2014-07-24 11:28 - 2012-09-12 11:31 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Spotify
2014-07-24 11:26 - 2012-08-21 08:14 - 00003896 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-07-24 11:26 - 2012-08-13 23:16 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-24 11:23 - 2013-01-28 15:13 - 00000000 ____D () C:\Users\Gast
2014-07-24 11:23 - 2011-07-03 04:44 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\Rainmeter
2014-07-24 11:23 - 2009-09-09 16:43 - 00000000 ____D () C:\Users\JéRaThie
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\spool
2014-07-24 11:23 - 2006-11-02 15:34 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-07-24 11:23 - 2006-11-02 14:33 - 79429632 _____ () C:\Windows\system32\config\software_previous
2014-07-24 11:23 - 2006-11-02 14:33 - 50069504 _____ () C:\Windows\system32\config\system_previous
2014-07-24 11:22 - 2014-07-16 18:18 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-24 11:22 - 2014-04-10 11:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-24 11:22 - 2010-08-02 09:50 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-24 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 11:22 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-24 11:22 - 2006-11-02 17:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-24 11:22 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\registration
2014-07-24 11:16 - 2006-11-02 14:33 - 61865984 _____ () C:\Windows\system32\config\components_previous
2014-07-24 11:16 - 2006-11-02 14:33 - 00057344 _____ () C:\Windows\system32\config\sam_previous
2014-07-24 11:12 - 2014-07-24 11:12 - 00000000 __SHD () C:\found.001
2014-07-24 03:09 - 2010-10-09 00:47 - 00000000 ____D () C:\ProgramData\Origin
2014-07-24 03:09 - 2006-11-02 17:42 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-24 03:01 - 2013-08-14 20:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 03:00 - 2013-08-14 20:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 02:59 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\vlc
2014-07-24 02:58 - 2012-05-31 20:32 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-07-24 02:48 - 2014-07-24 02:48 - 00029531 _____ () C:\Users\JéRaThie\Desktop\gmer.txt
2014-07-24 02:13 - 2012-04-23 17:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 01:32 - 2014-07-24 01:32 - 00001805 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-07-23 21:14 - 2006-11-02 14:33 - 00360448 _____ () C:\Windows\system32\config\default_previous
2014-07-23 21:14 - 2006-11-02 14:33 - 00024576 _____ () C:\Windows\system32\config\security_previous
2014-07-23 21:09 - 2014-06-03 02:39 - 00024760 _____ () C:\Users\JéRaThie\Desktop\Diagnostik.odt
2014-07-23 21:09 - 2014-04-14 17:46 - 00022464 _____ () C:\Users\JéRaThie\Desktop\BiWi V - Seminar 1.odt
2014-07-23 19:40 - 2012-09-12 11:33 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Spotify
2014-07-23 19:28 - 2014-06-19 17:36 - 00000000 ____D () C:\Users\JéRaThie\Desktop\master thesis
2014-07-23 19:23 - 2014-05-07 14:45 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Farben
2014-07-23 19:01 - 2014-07-23 17:56 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Tests
2014-07-23 12:04 - 2014-07-23 11:42 - 117204143 _____ () C:\Users\JéRaThie\Downloads\xvideos.com_d5c634aaccd72fa1f90a47886ae91c9f.flv
2014-07-17 03:32 - 2012-07-05 21:22 - 00001150 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA.job
2014-07-16 23:02 - 2014-07-16 23:02 - 00000821 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-07-16 23:01 - 2010-09-18 17:29 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-07-16 22:58 - 2014-07-16 22:57 - 04812672 _____ (Piriform Ltd) C:\Users\JéRaThie\Downloads\ccsetup415.exe
2014-07-16 22:54 - 2010-10-22 17:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-07-16 22:54 - 2010-10-22 17:05 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-07-16 22:53 - 2011-01-22 14:38 - 00000000 ____D () C:\Program Files (x86)\Iomega
2014-07-16 22:53 - 2009-06-05 17:07 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\Public\Documents\Audible
2014-07-16 22:47 - 2014-04-27 15:49 - 00000000 ____D () C:\Users\JéRaThie\Documents\Audible
2014-07-16 22:44 - 2014-06-05 18:42 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-07-16 20:26 - 2014-04-09 00:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-16 19:17 - 2014-04-09 23:26 - 00000000 ____D () C:\AdwCleaner
2014-07-16 18:23 - 2008-01-21 13:10 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-16 18:23 - 2008-01-21 13:09 - 00674274 _____ () C:\Windows\system32\perfh007.dat
2014-07-16 18:23 - 2008-01-21 13:09 - 00146254 _____ () C:\Windows\system32\perfc007.dat
2014-07-16 18:18 - 2014-07-16 18:18 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-07-16 00:32 - 2012-07-05 21:22 - 00001128 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core.job
2014-07-16 00:09 - 2013-11-30 01:29 - 00000000 ____D () C:\Users\JéRaThie\Downloads\sortieren_alt
2014-07-16 00:06 - 2014-07-16 00:06 - 00003072 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Panda Security
2014-07-16 00:06 - 2014-07-16 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-07-16 00:06 - 2014-07-16 00:05 - 00000000 ____D () C:\Program Files (x86)\Panda USB Vaccine
2014-07-15 19:51 - 2014-07-15 19:51 - 00848856 _____ (Panda Security ) C:\Users\JéRaThie\Downloads\USBVaccineSetup.exe
2014-07-15 19:21 - 2012-02-07 12:15 - 00000248 _____ () C:\lxcz.log
2014-07-14 19:25 - 2014-06-29 20:12 - 00000000 ____D () C:\Users\JéRaThie\Desktop\Language Change
2014-07-14 12:29 - 2014-07-14 12:29 - 00363536 _____ () C:\Users\JéRaThie\Downloads\zentralperspektive_arbeitsmaterial_299298-299417-1.zip
2014-07-14 12:26 - 2014-07-14 12:26 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2014-07-12 21:10 - 2014-07-07 01:53 - 00000000 ____D () C:\Users\JéRaThie\Desktop\translation
2014-07-11 03:29 - 2006-11-02 17:21 - 05120800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 03:24 - 2006-11-02 17:07 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-11 03:06 - 2014-04-17 02:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 03:02 - 2006-11-02 14:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-07-09 22:51 - 2014-07-09 22:51 - 11204096 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 22:51 - 2012-04-23 17:01 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 22:51 - 2011-05-22 00:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-06 23:39 - 2010-09-17 00:59 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-07-06 23:38 - 2014-07-06 23:38 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-07-06 23:38 - 2014-04-25 16:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-07-06 23:38 - 2013-07-24 17:13 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-07-06 23:38 - 2011-04-13 02:03 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-07-06 23:38 - 2011-01-19 02:24 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-07-06 23:38 - 2010-09-17 00:59 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00065264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2014-07-06 23:38 - 2010-09-17 00:59 - 00064752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswrdr.sys
2014-07-03 23:04 - 2009-09-14 14:35 - 00213504 _____ () C:\Users\JéRaThie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-03 23:02 - 2012-10-27 20:02 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\dvdcss
2014-06-30 09:28 - 2006-11-02 15:33 - 00000000 ____D () C:\Windows\Branding
2014-06-29 22:58 - 2014-04-15 00:18 - 00000132 _____ () C:\Users\JéRaThie\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-06-29 20:38 - 2014-06-29 20:22 - 00000000 ____D () C:\Users\JéRaThie\Desktop\AAVE
2014-06-29 15:22 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\Documents\Nexus Mod Manager
2014-06-29 15:02 - 2014-06-28 18:12 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Skyrim
2014-06-29 04:07 - 2014-06-29 04:07 - 00000922 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-29 04:07 - 2014-04-09 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-29 04:07 - 2014-04-09 00:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-06-28 20:07 - 2014-06-28 20:00 - 00007530 _____ () C:\Users\JéRaThie\Documents\Uninstall Dragon Age Origins.log
2014-06-28 20:01 - 2010-12-16 01:03 - 00000000 ____D () C:\Users\JéRaThie\Documents\BioWare
2014-06-28 20:01 - 2010-04-12 19:00 - 00000000 ____D () C:\ProgramData\BioWare
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\JéRaThie\Desktop\Skyrim.lnk
2014-06-28 19:20 - 2014-06-28 19:20 - 00001015 _____ () C:\Users\Gast\Desktop\Skyrim (SKSE).lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000853 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Users\JéRaThie\AppData\Local\Black_Tree_Gaming
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2014-06-28 19:18 - 2014-06-28 19:18 - 00000000 ____D () C:\Program Files\Nexus Mod Manager
2014-06-28 18:12 - 2014-06-28 18:11 - 00977294 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_LangPack_MSI369D.txt
2014-06-28 18:12 - 2011-01-22 13:45 - 00259266 _____ () C:\Users\JéRaThie\AppData\Local\dd_dotnetfx35install_lp.txt
2014-06-28 18:12 - 2010-11-29 16:19 - 01750032 _____ () C:\Users\JéRaThie\AppData\Local\dd_dotnetfx35install.txt
2014-06-28 18:12 - 2010-11-29 16:19 - 01608393 _____ () C:\Users\JéRaThie\AppData\Local\dd_depcheck_NETFX_EXP_35.txt
2014-06-28 18:12 - 2010-08-29 23:01 - 00000000 ____D () C:\Users\JéRaThie\Documents\My Games
2014-06-28 18:11 - 2014-06-28 18:10 - 00000000 _____ () C:\Users\JéRaThie\AppData\Local\dd_NET_Framework35_x64_MSI35B6.txt
2014-06-28 15:33 - 2014-06-27 15:30 - 00000000 ____D () C:\Users\JéRaThie\AppData\Roaming\avidemux
2014-06-25 19:03 - 2014-06-25 19:03 - 00005379 _____ () C:\Windows\SysWOW64\collectionCache.bnk
Some content of TEMP:
====================
C:\Users\JéRaThie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppkcrsp.dll
C:\Users\JéRaThie\AppData\Local\Temp\Quarantine.exe
C:\Users\JéRaThie\AppData\Local\Temp\rtdrvmon.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-24 11:33
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014
Ran by JéRaThie at 2014-07-24 12:04:03
Running from C:\Users\JéRaThie\Downloads\Malware-removal
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AC3Filter 2.5b (HKLM-x32\...\AC3Filter_is1) (Version: 2.5b - Alexander Vigovsky)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (x32 Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)
Adobe InDesign CS2 (HKLM-x32\...\Adobe InDesign CS2 - {7F4C8163-F259-49A0-A018-2857A90578BC}) (Version: 004.000.000 - Adobe Systems Incorporated)
Adobe InDesign CS2 (x32 Version: 004.000.000 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe SVG Viewer 3.0 (HKLM-x32\...\Adobe SVG Viewer) (Version: 3.0 - Adobe Systems, Inc.)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.102.302.104 - ALPS ELECTRIC CO., LTD.)
AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{82C9101B-36EC-5821-DD8B-05480074A0B8}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{F5266D28-E0B2-4130-BFC5-EE155AD514DC}) (Version: 2.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arcanum Of Steamworks and Magick Obscura (HKLM-x32\...\Arcanum Of Steamworks and Magick Obscura_is1) (Version: - GOG.com)
ArtRage 2 (HKLM-x32\...\{B9BD670E-E9BF-494A-9843-F20C13EE8C4C}) (Version: 2.6.0 - Ambient Design)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)
Bamboo Dock (HKLM-x32\...\Bamboo Dock) (Version: 4.1 - Wacom Co., Ltd.)
Bamboo Dock (x32 Version: 4.1.0 - Wacom Europe GmbH) Hidden
Bamboo Tablets Tutorial (x32 Version: 3.0.20 - Wacom) Hidden
Bastion (HKLM-x32\...\Steam App 107100) (Version: - Supergiant Games)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version: - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.0421.2132.36832 - ATI Technologies, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
Catalyst Pro Control Center (x32 Version: 2012.0405.2205.37728 - Ihr Firmenname) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0405.2204.37728 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0405.2205.37728 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
Defraggler (HKLM\...\Defraggler) (Version: 2.09 - Piriform)
Desktop Coral 1.03.01 (HKLM-x32\...\DesktopCoral_is1) (Version: - )
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version: - Softland)
Dreamfall: The Longest Journey (HKLM-x32\...\Steam App 6300) (Version: - Funcom)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
DScaler (HKLM-x32\...\DScaler_is1) (Version: - )
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
Dungeon Keeper 2 (HKLM\...\{4f94b43a-8a00-4ac4-bb94-269cf24aef97}.sdb) (Version: - )
Dungeon Keeper 2 (HKLM-x32\...\Dungeon Keeper 2_is1) (Version: - GOG.com)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Eufloria (HKLM-x32\...\Steam App 41210) (Version: - )
Evernote v. 5.4.1 (HKLM-x32\...\{A5F7DF42-F67D-11E3-B7EB-00163E98E7D6}) (Version: 5.4.1.3962 - Evernote Corp.)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Fallout (HKLM-x32\...\GOGPACKFALLOUT_is1) (Version: 2.0.0.14 - GOG.com)
Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
From Dust (HKLM-x32\...\Steam App 33460) (Version: - )
GOG.com Downloader version 3.4.8 (HKLM-x32\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.4.8 - GOG.com)
GOG.com Planescape Torment (HKLM\...\{8f376ce2-c213-4a6c-a329-0b2a7eb2bad8}.sdb) (Version: - )
Gone Home (HKLM-x32\...\Steam App 232430) (Version: - The Fullbright Company)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
hp psc 1200 series (x32 Version: 1.10.0000 - Hewlett-Packard Company) Hidden
iCloud (HKLM\...\{8B485965-8EFE-464A-842F-CF8F18C3DFD7}) (Version: 1.1.0.40 - Apple Inc.)
Image Data Converter (HKLM-x32\...\{87998E4E-6D9C-411B-AAE9-B8523FFE357D}) (Version: 4.0.01.09151 - Sony Corporation)
iTunes (HKLM\...\{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}) (Version: 10.6.3.25 - Apple Inc.)
Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version: - Big Huge Games)
Lexmark 1200 Series (HKLM\...\Lexmark 1200 Series) (Version: - Lexmark International, Inc.)
MAGIX Screenshare (HKLM-x32\...\{D96ED789-9A41-4A89-99A4-3CE466A80DF2}) (Version: 4.3.6.1987 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Mount & Blade: Warband (HKLM-x32\...\Steam App 48700) (Version: - Tale Worlds)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB941833) (HKLM-x32\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Music Rescue (HKLM-x32\...\{3364BD16-5A28-4862-86A1-A8FF5FD23919}) (Version: 4.0.9.25 - KennettNet Software Ltd)
Neverwinter Nights 2 Complete (HKLM-x32\...\GOGPACKNWN2COMPLETE_is1) (Version: 2.1.0.6 - GOG.com)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.50.3 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}) (Version: 9.11.1111 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 8.6.0.357 - Electronic Arts, Inc.)
Osmos (HKLM-x32\...\Steam App 29180) (Version: - Hemisphere Games)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version: - Panda Security)
Papers, Please (HKLM-x32\...\Steam App 239030) (Version: - 3909)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Planescape Torment (HKLM-x32\...\GOGPACKPLANESCAPETORMENT_is1) (Version: 2.0.0.8 - GOG.com)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: - )
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0004 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 6.0.6000.20132 - Realtek Semiconductor Corp.)
Reus (HKLM-x32\...\Steam App 222730) (Version: - Abbey Games)
RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.6 - Rockstar Games)
SecureW2 EAP Suite 1.1.3 for Windows (HKLM-x32\...\SecureW2 EAP Suite) (Version: - )
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB)
Star Wars: Knights of the Old Republic II (HKLM-x32\...\Steam App 208580) (Version: - LucasArts)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Symphony (HKLM-x32\...\Steam App 207750) (Version: - Empty Clip Studios)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM-x32\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: - )
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.6C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisor Password (x32 Version: 1.63.0.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM-x32\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.3C - TOSHIBA CORPORATION)
Trine (HKLM-x32\...\Trine_is1) (Version: - Frozenbyte, Inc.)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games)
TSLRCM 1.6 (HKLM-x32\...\The Sith Lords Restored Content Mod_is1) (Version: - )
Two Worlds II (HKLM-x32\...\Steam App 7520) (Version: - )
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Utility Common Driver (x32 Version: 1.0.50.22C - TOSHIBA) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.3-2 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
World of Goo (HKLM-x32\...\Steam App 22000) (Version: - 2D BOY)
YOU DON'T KNOW JACK® 3 - Abwärts! (HKLM-x32\...\YDKJG3) (Version: - )
==================== Custom CLSID entries: ==========================
(Only entries are listed that could be exploited by malware. If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\JéRaThie\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-502464258-2623245878-921248753-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
==================== Restore Points =========================
17-07-2014 01:56:05 Geplanter Prüfpunkt
23-07-2014 15:43:23 Windows Update
23-07-2014 23:27:11 avast! antivirus system restore point
24-07-2014 00:01:14 Windows Update
24-07-2014 01:00:12 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 14:34 - 2014-07-16 19:08 - 00000709 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {16CE0B6E-4678-498F-814A-6BDEC0C2F0ED} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {189E45FF-9376-4DD4-BE43-2768C6D5A365} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - JéRaThie => C:\Program Files (x86)\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {1E560156-A445-435D-9DD7-195ACD950758} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {1EF79A2B-FC33-4250-9E80-1A2D89F8FE99} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-13] (Google Inc.)
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {266286FD-716E-48A6-B4E6-2716B6592FB9} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {3F861458-5006-48C7-A7C0-EB888F94DBE7} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {4B944DC3-8D08-40FA-A356-955260DCEE78} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {511BE410-85AF-46F9-B9FB-024F686E67E9} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {5B37AE3A-FAC2-4175-A4E1-5B5E52A6859F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {5EBF65B8-8E01-4FC4-8EEC-299958F4BED4} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {9C3F21C7-4CC1-47FF-8F39-41A3576BEDC4} - System32\Tasks\{BB40B51D-98F9-4E31-AF44-DAA137D7016E} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)
Task: {A46A73A4-AA64-4360-9C62-A75176EACF6A} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {AFFFA717-6094-4CD5-88E4-322B57E2109F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {C2C9CDF8-4599-4EED-A27E-FCCD87AFCFA2} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-07-06] (AVAST Software)
Task: {C594F0E7-233E-46CD-A14D-50B7E1EBA207} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-13] (Google Inc.)
Task: {DB0423D4-4B37-4DBE-80FA-2444FAD0407B} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {DCFF9DEB-8231-403A-8510-EBCD5519CD1F} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {EBAFF3DA-DAF2-4EF5-8A9F-F543FFAE4EAA} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-502464258-2623245878-921248753-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {EFC9F7ED-B395-4A72-8E99-1B7F0641A2B8} - System32\Tasks\{BB5FF825-1022-47B3-BF09-0B7A73A81149} => Chrome.exe hxxp://www.skype.com/go/downloading?source=installer&ver=6.0.60.120&LastError=-9
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\avast! Emergency Update.job => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000Core.job => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502464258-2623245878-921248753-1000UA.job => C:\Users\JéRaThie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2006-12-04 02:26 - 2006-12-04 02:26 - 00022016 _____ () C:\Windows\System32\sugs1l6.dll
2012-06-05 03:26 - 2012-04-06 03:09 - 00045056 _____ () C:\Windows\system32\atitmp64.dll
2014-04-12 17:24 - 2013-12-17 03:17 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2010-08-02 09:50 - 2007-09-02 13:58 - 00495616 _____ () C:\Program Files (x86)\RocketDock\RocketDock.exe
2011-07-03 22:33 - 2008-11-26 13:16 - 02303488 _____ () E:\Extras\DesktopCoral\DesktopCoral.exe
2011-07-03 16:03 - 2011-07-03 16:03 - 00102912 _____ () C:\Program Files\Rainmeter\Rainmeter.exe
2011-07-03 16:03 - 2011-07-03 16:03 - 00839680 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2011-07-03 16:03 - 2011-07-03 16:03 - 00025600 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll
2011-07-03 16:04 - 2011-07-03 16:04 - 00167936 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll
2012-10-16 11:39 - 2012-10-16 11:39 - 00646744 _____ () C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
2014-04-07 01:12 - 2014-07-06 23:38 - 00301152 _____ () C:\Program Files\Alwil Software\Avast5\aswProperty.dll
2014-07-24 01:56 - 2014-07-24 01:56 - 02794496 _____ () C:\Program Files\Alwil Software\Avast5\defs\14072300\algo.dll
2014-07-24 11:53 - 2014-07-24 11:53 - 02794496 _____ () C:\Program Files\Alwil Software\Avast5\defs\14072400\algo.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-08-02 09:50 - 2007-09-02 13:57 - 00069632 _____ () C:\Program Files (x86)\RocketDock\RocketDock.dll
2014-07-24 11:26 - 2014-07-24 11:26 - 00043008 _____ () c:\Users\JéRaThie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppkcrsp.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\JéRaThie\AppData\Roaming\Dropbox\bin\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00436576 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00318304 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2013-11-23 23:32 - 2014-07-06 23:38 - 19329904 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 21118304 _____ () C:\Program Files (x86)\Evernote\Evernote\libcef.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00985968 _____ () C:\Program Files (x86)\Evernote\Evernote\avcodec-54.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00136048 _____ () C:\Program Files (x86)\Evernote\Evernote\avutil-51.dll
2014-06-17 18:10 - 2014-06-17 18:10 - 00192368 _____ () C:\Program Files (x86)\Evernote\Evernote\avformat-54.dll
2013-07-11 13:33 - 2013-07-11 13:33 - 00988160 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxml2.dll
2013-07-10 22:08 - 2013-07-10 22:08 - 00170496 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxslt.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-15 01:32 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-04-10 11:08 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll
2014-04-10 11:08 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\JéRaThie\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
AlternateDataStreams: C:\ProgramData\TEMP:196FC0A6
AlternateDataStreams: C:\ProgramData\TEMP:6F770ABC
AlternateDataStreams: C:\ProgramData\TEMP:7D6EC5BE
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^JéRaThie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupreg: Google Update => "C:\Users\JéRaThie\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: TkBellExe => "c:\program files (x86)\real\realplayer\update\realsched.exe" -osboot
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/24/2014 11:24:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 02:11:48 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (07/24/2014 01:27:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (07/23/2014 05:34:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/23/2014 11:06:07 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path
Error: (07/23/2014 10:30:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/18/2014 02:50:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/17/2014 04:58:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/24/2014 11:34:51 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:46 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:40 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:35 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:30 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:25 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:20 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:14 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:08 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Error: (07/24/2014 11:34:03 AM) (Source: DCOM) (EventID: 10009) (User: )
Description: localdydikewxyo
Microsoft Office Sessions:
=========================
Error: (07/24/2014 11:24:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/24/2014 02:11:48 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe
Error: (07/24/2014 01:27:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe
Error: (07/23/2014 08:33:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Users\JéRaThie\Downloads\Malware-removal\esetsmartinstaller_deu.exe
Error: (07/23/2014 05:34:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/23/2014 11:06:07 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path
Error: (07/23/2014 10:30:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/18/2014 02:50:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/17/2014 04:58:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-07-23 19:50:31.646
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:31.435
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:31.223
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:31.013
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:29.595
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:29.383
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:29.171
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:50:28.959
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:43:31.092
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-07-23 19:43:30.879
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 61%
Total physical RAM: 4059.93 MB
Available physical RAM: 1560.82 MB
Total Pagefile: 8323.08 MB
Available Pagefile: 5130.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:149.04 GB) (Free:16.9 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:147.58 GB) (Free:1.69 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 7878FC96)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=148 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
| Themen zu SergeLeLama.vbs im autostart und verschiedene nicht zu beendende Prozesse |
| canon, ccsetup, cyberghost, java/agent.dj, java/agent.dn, java/agent.dw, java/exploit.cve-2012-0507.dh, lnk/agent.ak, panda usb vaccine, refresh, tablet, vbs/kryptik.bo, win32/bundled.toolbar.ask.d, win32/downloadsponsor.a, win32/psw.papras.cx, win32/toolbar.conduit, win32/toolbar.conduit.r, win32/toolbar.crossrider.e, win32/toolbar.crossrider.f, wscript.exe |
Baum-Darstellung