| |
| |||||||
Alles rund um Windows: TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exeWindows 7 Hilfe zu allen Windows-Betriebssystemen: Windows XP, Windows Vista, Windows 7, Windows 8(.1) und Windows 10 / Windows 11- als auch zu sämtlicher Windows-Software. Alles zu Windows 10 ist auch gerne willkommen. Bitte benenne etwaige Fehler oder Bluescreens unter Windows mit dem Wortlaut der Fehlermeldung und Fehlercode. Erste Schritte für Hilfe unter Windows. |
 |
12.08.2014, 17:15
| #16 |
 |  TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Grüß Dich, schau mal meinst Du das ?? Code:
ATTFilter # AdwCleaner v3.304 - Bericht erstellt am 12/08/2014 um 18:10:58
# Aktualisiert 08/08/2014 von Xplode
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : contesssa - CONNY
# Gestartet von : C:\Users\contesssa\Downloads\adwcleaner_3.304.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17126
-\\ Google Chrome v36.0.1985.125
[ Datei : C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R10].txt - [1801 octets] - [11/08/2014 18:52:01]
AdwCleaner[R11].txt - [738 octets] - [12/08/2014 18:10:58]
AdwCleaner[R2].txt - [1789 octets] - [07/08/2014 12:07:06]
AdwCleaner[R3].txt - [935 octets] - [07/08/2014 13:40:02]
AdwCleaner[R4].txt - [1053 octets] - [07/08/2014 13:43:05]
AdwCleaner[R5].txt - [1173 octets] - [07/08/2014 13:50:03]
AdwCleaner[R6].txt - [1292 octets] - [07/08/2014 22:52:35]
AdwCleaner[R7].txt - [1352 octets] - [07/08/2014 23:24:09]
AdwCleaner[R8].txt - [1472 octets] - [08/08/2014 10:01:44]
AdwCleaner[R9].txt - [1591 octets] - [08/08/2014 14:11:48]
AdwCleaner[S2].txt - [1571 octets] - [07/08/2014 12:12:06]
AdwCleaner[S3].txt - [647 octets] - [07/08/2014 13:40:47]
AdwCleaner[S4].txt - [647 octets] - [07/08/2014 13:44:50]
AdwCleaner[S5].txt - [647 octets] - [07/08/2014 13:52:51]
AdwCleaner[S6].txt - [647 octets] - [07/08/2014 23:25:51]
AdwCleaner[S7].txt - [647 octets] - [08/08/2014 10:09:00]
AdwCleaner[S8].txt - [647 octets] - [08/08/2014 14:20:48]
AdwCleaner[S9].txt - [1814 octets] - [11/08/2014 19:17:36]
########## EOF - C:\AdwCleaner\AdwCleaner[R11].txt - [1751 octets] ##########
|
|
13.08.2014, 08:37
| #17 |
| /// TB-Ausbilder   | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Servus,
__________________gibt es noch Probleme mit Malware? Wenn ja, welche? Ggf. Logdateien deines AV-programms nachreichen. FRST als Kontrolle:
|
|
13.08.2014, 11:47
| #18 |
| | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] FRST Additions Logfile:
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2014
Ran by contesssa at 2014-08-13 12:39:03
Running from C:\Users\contesssa\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{15B2F0E3-3FAC-4495-B0FD-398EECFA4100}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Intel® Trusted Connect Service Client (Version: 1.26.242.3 - Intel Corporation) Hidden
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 8 Update 5 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418005FF}) (Version: 8.0.50 - Oracle Corporation)
Lenovo OneKey Recovery (Version: 8.0.0.1219 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: - )
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50325 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50330 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.50325 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50325 - Microsoft Corporation)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Nitro Pro 8 (HKLM\...\{34BE77EE-B563-49D7-A8A0-FFD76D29BBD3}) (Version: 8.0.10.7 - Nitro)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.222 - Qualcomm Atheros Communications)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shopping Helper Smartbar Engine (HKCU\...\{f6f7e3e1-d1e6-4adc-b2c8-4f9946a84573}) (Version: 10.215.63.15249 - ReSoft Ltd.) <==== ATTENTION
Skype™ 6.9 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.4.1.0 - Synaptics Incorporated)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
04-08-2014 13:29:52 Windows Update
11-08-2014 17:14:27 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {028F7BA2-6F53-4A86-973A-B72EBE6D73A6} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {11713C7D-CDD5-4ED6-A865-89685117D6DE} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {15CFED45-5261-4590-A96F-47EBB8A1961D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {31C2A7A0-4892-4BD0-AD93-4A752D1796A5} - System32\Tasks\Lenovo\LenovoMachineInformation => C:\Program Files\lenovo\SystemAgent\MachineInformation.exe [2013-05-02] ()
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {41B089C1-D45B-41BD-A1C7-B07E874EF3EE} - System32\Tasks\Lenovo\LenovoWarrantyChinaTask => C:\Program Files\lenovo\SystemAgent\ChinaWarrantyService.exe [2013-05-02] ()
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4ADE1941-F662-4498-8972-B198A70241BF} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-05-02] ()
Task: {578DA71D-4792-49E5-A998-82BD10017897} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {6A22210D-76C7-4A29-AFE1-B08943249160} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-26] (Google Inc.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7EEFEB6A-289F-4D4E-9025-A535969B0364} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8C93EE21-3136-4695-881A-2F45783050C1} - System32\Tasks\SoftUpdateLogon => C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {927CF79C-0219-4928-9A28-263935B64716} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A1361BB9-0188-439D-9100-D20F39CDF21E} - System32\Tasks\SoftUpdateDaily => C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe
Task: {A56F93A8-C213-4A7D-90F0-3EE0E5551C59} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {AA05510B-0EE5-4260-9FB0-84CE84E4290A} - System32\Tasks\Lenovo\LenovoUserguidesCopy => C:\Program Files\lenovo\SystemAgent\UserguidesCopy.exe [2013-05-02] ()
Task: {B379786F-D38D-47CD-AB65-82CA8CF66164} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {B8A14DF3-0A9A-437A-B5D8-9D3CF10694E9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-26] (Google Inc.)
Task: {C4583446-F249-471E-B139-442A743C0538} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {D97C9F57-3822-4C1D-9B29-ACDB7995D42B} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2013-02-28 18:05 - 2013-02-28 18:05 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-02-28 18:02 - 2013-02-28 18:02 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-02-28 18:06 - 2013-02-28 18:06 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2013-12-21 01:02 - 2013-12-21 01:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-25 21:52 - 2014-04-25 21:52 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\7a891719ed7b38bb959d812adc580f5c\PSIClient.ni.dll
2013-07-23 14:55 - 2012-10-23 15:22 - 01199648 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\contesssa\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "fst_de_99"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/08/2014 02:20:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Name des fehlerhaften Moduls: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x0002f8c7
ID des fehlerhaften Prozesses: 0x338
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.303.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.303.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.303.exe2
Berichtskennung: adwcleaner_3.303.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.303.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.303.exe5
Error: (08/08/2014 01:14:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MachineInformation.exe, Version: 1.5.33.0, Zeitstempel: 0x51826efc
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17055, Zeitstempel: 0x532943a3
Ausnahmecode: 0xe0434352
Fehleroffset: 0x00011d4d
ID des fehlerhaften Prozesses: 0xa08
Startzeit der fehlerhaften Anwendung: 0xMachineInformation.exe0
Pfad der fehlerhaften Anwendung: MachineInformation.exe1
Pfad des fehlerhaften Moduls: MachineInformation.exe2
Berichtskennung: MachineInformation.exe3
Vollständiger Name des fehlerhaften Pakets: MachineInformation.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MachineInformation.exe5
Error: (08/08/2014 01:14:53 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.IO.IOException
Stapel:
bei System.IO.__Error.WinIOError(Int32, System.String)
bei System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
bei System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare)
bei System.Xml.XmlDocument.Save(System.String)
bei MachineInformation.Program.Main(System.String[])
Error: (08/08/2014 10:12:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Name des fehlerhaften Moduls: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Ausnahmecode: 0xc0000417
Fehleroffset: 0x000763cb
ID des fehlerhaften Prozesses: 0x7ac
Startzeit der fehlerhaften Anwendung: 0xjre-8u11-windows-au.exe0
Pfad der fehlerhaften Anwendung: jre-8u11-windows-au.exe1
Pfad des fehlerhaften Moduls: jre-8u11-windows-au.exe2
Berichtskennung: jre-8u11-windows-au.exe3
Vollständiger Name des fehlerhaften Pakets: jre-8u11-windows-au.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: jre-8u11-windows-au.exe5
Error: (08/08/2014 10:12:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Name des fehlerhaften Moduls: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Ausnahmecode: 0xc0000417
Fehleroffset: 0x000763cb
ID des fehlerhaften Prozesses: 0x1698
Startzeit der fehlerhaften Anwendung: 0xjre-8u11-windows-au.exe0
Pfad der fehlerhaften Anwendung: jre-8u11-windows-au.exe1
Pfad des fehlerhaften Moduls: jre-8u11-windows-au.exe2
Berichtskennung: jre-8u11-windows-au.exe3
Vollständiger Name des fehlerhaften Pakets: jre-8u11-windows-au.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: jre-8u11-windows-au.exe5
Error: (08/08/2014 10:11:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Name des fehlerhaften Moduls: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Ausnahmecode: 0xc0000417
Fehleroffset: 0x000763cb
ID des fehlerhaften Prozesses: 0x105c
Startzeit der fehlerhaften Anwendung: 0xjre-8u11-windows-au.exe0
Pfad der fehlerhaften Anwendung: jre-8u11-windows-au.exe1
Pfad des fehlerhaften Moduls: jre-8u11-windows-au.exe2
Berichtskennung: jre-8u11-windows-au.exe3
Vollständiger Name des fehlerhaften Pakets: jre-8u11-windows-au.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: jre-8u11-windows-au.exe5
Error: (08/08/2014 10:09:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17031, Zeitstempel: 0x5308893d
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x00040833
ID des fehlerhaften Prozesses: 0xa40
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.303.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.303.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.303.exe2
Berichtskennung: adwcleaner_3.303.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.303.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.303.exe5
Error: (08/08/2014 10:04:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Name des fehlerhaften Moduls: jre-8u11-windows-au.exe, Version: 8.0.110.12, Zeitstempel: 0x539fb8f4
Ausnahmecode: 0xc0000417
Fehleroffset: 0x000763cb
ID des fehlerhaften Prozesses: 0x17d8
Startzeit der fehlerhaften Anwendung: 0xjre-8u11-windows-au.exe0
Pfad der fehlerhaften Anwendung: jre-8u11-windows-au.exe1
Pfad des fehlerhaften Moduls: jre-8u11-windows-au.exe2
Berichtskennung: jre-8u11-windows-au.exe3
Vollständiger Name des fehlerhaften Pakets: jre-8u11-windows-au.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: jre-8u11-windows-au.exe5
Error: (08/07/2014 11:25:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17031, Zeitstempel: 0x5308893d
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x0004082f
ID des fehlerhaften Prozesses: 0x31c
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.303.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.303.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.303.exe2
Berichtskennung: adwcleaner_3.303.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.303.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.303.exe5
Error: (08/07/2014 01:52:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17031, Zeitstempel: 0x5308893d
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x000420d5
ID des fehlerhaften Prozesses: 0x1060
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.303.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.303.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.303.exe2
Berichtskennung: adwcleaner_3.303.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.303.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.303.exe5
System errors:
=============
Error: (08/12/2014 06:22:46 PM) (Source: DCOM) (EventID: 10010) (User: CONNY)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (08/12/2014 06:07:08 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:57 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:38 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Microsoft Office Sessions:
=========================
Error: (08/08/2014 02:20:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.303.exe3.3.0.353e28764adwcleaner_3.303.exe3.3.0.353e28764c00000fd0002f8c733801cfb301e0f89fa8C:\Users\contesssa\Downloads\adwcleaner_3.303.exeC:\Users\contesssa\Downloads\adwcleaner_3.303.exe714e0251-1ef6-11e4-beac-50af735ae431
Error: (08/08/2014 01:14:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: MachineInformation.exe1.5.33.051826efcKERNELBASE.dll6.3.9600.17055532943a3e043435200011d4da0801cfb2f9e3c75422C:\Program Files\lenovo\SystemAgent\MachineInformation.exeC:\WINDOWS\SYSTEM32\KERNELBASE.dll3988c9de-1eed-11e4-beac-50af735ae431
Error: (08/08/2014 01:14:53 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: MachineInformation.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.IO.IOException
Stapel:
bei System.IO.__Error.WinIOError(Int32, System.String)
bei System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
bei System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare)
bei System.Xml.XmlDocument.Save(System.String)
bei MachineInformation.Program.Main(System.String[])
Error: (08/08/2014 10:12:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: jre-8u11-windows-au.exe8.0.110.12539fb8f4jre-8u11-windows-au.exe8.0.110.12539fb8f4c0000417000763cb7ac01cfb2e08e8e82efC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exeC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.execc5548e0-1ed3-11e4-beab-50af735ae431
Error: (08/08/2014 10:12:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: jre-8u11-windows-au.exe8.0.110.12539fb8f4jre-8u11-windows-au.exe8.0.110.12539fb8f4c0000417000763cb169801cfb2e076bccfddC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exeC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exeb48395f0-1ed3-11e4-beab-50af735ae431
Error: (08/08/2014 10:11:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: jre-8u11-windows-au.exe8.0.110.12539fb8f4jre-8u11-windows-au.exe8.0.110.12539fb8f4c0000417000763cb105c01cfb2e06a3eb7e1C:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exeC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exea81fb835-1ed3-11e4-beab-50af735ae431
Error: (08/08/2014 10:09:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.303.exe3.3.0.353e28764ntdll.dll6.3.9600.170315308893dc00000fd00040833a4001cfb2def9b5901dC:\Users\contesssa\Downloads\adwcleaner_3.303.exeC:\WINDOWS\SYSTEM32\ntdll.dll430badd9-1ed3-11e4-beab-50af735ae431
Error: (08/08/2014 10:04:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: jre-8u11-windows-au.exe8.0.110.12539fb8f4jre-8u11-windows-au.exe8.0.110.12539fb8f4c0000417000763cb17d801cfb2df56b93864C:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exeC:\Users\CONTES~1\AppData\Local\Temp\jre-8u11-windows-au.exe94fbfab5-1ed2-11e4-beab-50af735ae431
Error: (08/07/2014 11:25:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.303.exe3.3.0.353e28764ntdll.dll6.3.9600.170315308893dc00000fd0004082f31c01cfb285dd2e28ccC:\Users\contesssa\Downloads\adwcleaner_3.303.exeC:\WINDOWS\SYSTEM32\ntdll.dll6b033e8d-1e79-11e4-beab-50af735ae431
Error: (08/07/2014 01:52:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.303.exe3.3.0.353e28764ntdll.dll6.3.9600.170315308893dc00000fd000420d5106001cfb235b75a7506C:\Users\contesssa\Downloads\adwcleaner_3.303.exeC:\WINDOWS\SYSTEM32\ntdll.dll5f2b7dbb-1e29-11e4-beab-50af735ae431
CodeIntegrity Errors:
===================================
Date: 2014-07-20 13:18:25.679
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.
Date: 2014-07-20 13:18:12.580
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.
Date: 2014-02-25 21:57:06.854
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll that did not meet the Windows signing level requirements.
Date: 2014-02-25 21:57:06.682
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll that did not meet the Windows signing level requirements.
Date: 2013-11-03 01:10:55.629
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-03 00:59:03.666
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 09:18:13.111
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 08:44:57.218
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 08:38:59.879
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 01:14:32.601
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz
Percentage of memory in use: 35%
Total physical RAM: 3975.27 MB
Available physical RAM: 2558.86 MB
Total Pagefile: 4679.27 MB
Available Pagefile: 2941.99 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.23 GB) (Free:370.64 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 3FD8BFE0)
Partition: GPT Partition Type.
==================== End Of Log ============================
Sei gegrüßt es gibt keine Probleme mit der Malware. Viele Grüße Conny FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2014 Ran by contesssa (administrator) on CONNY on 13-08-2014 12:38:04 Running from C:\Users\contesssa\Downloads Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (LENOVO INCORPORATED.) C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13425224 2013-03-06] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-09] (Realtek Semiconductor) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2013-07-23] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2013-07-23] (Lenovo(beijing) Limited) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3041520 2013-03-09] (Synaptics Incorporated) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [168464 2012-10-30] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [224128 2014-03-18] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications)) HKU\S-1-5-21-1714798670-2283502341-2433251003-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20473504 2013-10-02] (Skype Technologies S.A.) HKU\S-1-5-21-1714798670-2283502341-2433251003-1001\...\Run: [GoogleChromeAutoLaunch_8856B223242C46EC7E7BB0B38EB6BDE4] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-07-15] (Google Inc.) ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyServer: http=127.0.0.1:50714;https=127.0.0.1:50714 HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {B8685F37-302D-4748-8F8A-0CC05A05EA7B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File BHO-x32: Avira Savings Advisor BHO -> {A18A516C-AA41-46A9-92DB-60208917E442} -> C:\Program Files (x86)\avira\Internet Explorer\avira32.dll () BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll No File Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR DefaultSearchKeyword: trovi.search CHR DefaultNewTabURL: CHR Extension: (Avira Sparberater) - C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\cojnmaaohncijldefpkpkkakjonfmgeb [2014-03-02] CHR Extension: (Google Wallet) - C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19] CHR HKLM-x32\...\Chrome\Extension: [cojnmaaohncijldefpkpkkakjonfmgeb] - C:\Program Files (x86)\avira\Chrome\avira-1.5.14.crx [2013-12-11] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-12-11] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-08] (Intel Corporation) R2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [562504 2013-05-02] (LENOVO INCORPORATED.) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2012-12-13] (Nitro PDF Software) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-02-28] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R1 HMD; C:\Windows\system32\DRIVERS\hmd.sys [14888 2013-10-07] () S3 IntcDAud; C:\Windows\system32\DRIVERS\IntcDAud.sys [342528 2013-01-24] (Intel(R) Corporation) [File not signed] R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-13] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-03-09] (Synaptics Incorporated) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-13 12:37 - 2014-08-13 12:37 - 00000000 ____D () C:\Users\contesssa\Downloads\FRST-OlderVersion 2014-08-12 17:54 - 2014-08-12 17:54 - 00000000 _____ () C:\Neues Textdokument.txt 2014-08-11 18:51 - 2014-08-11 18:51 - 01366203 _____ () C:\Users\contesssa\Downloads\adwcleaner_3.304.exe 2014-08-11 17:38 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2014-08-11 17:31 - 2014-08-12 18:23 - 00001210 _____ () C:\WINDOWS\PFRO.log 2014-08-08 13:32 - 2014-08-08 15:02 - 00001156 _____ () C:\anti malware.txt 2014-08-08 12:47 - 2014-08-13 11:41 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-08-08 12:47 - 2014-08-08 12:47 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-08-08 12:47 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-08-08 12:47 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-08-08 12:46 - 2014-08-08 12:46 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-07 12:04 - 2014-08-12 19:37 - 00000000 ____D () C:\AdwCleaner 2014-08-04 16:19 - 2014-08-04 16:19 - 00000936 _____ () C:\Users\contesssa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRST64.lnk 2014-08-04 15:24 - 2014-08-08 13:39 - 00032533 _____ () C:\Users\contesssa\Downloads\Addition.txt 2014-08-04 15:23 - 2014-08-13 12:38 - 00014086 _____ () C:\Users\contesssa\Downloads\FRST.txt 2014-08-04 15:19 - 2014-08-13 12:38 - 00000000 ____D () C:\FRST 2014-08-04 15:18 - 2014-08-13 12:37 - 02100224 _____ (Farbar) C:\Users\contesssa\Downloads\FRST64.exe 2014-08-04 14:56 - 2014-08-04 15:20 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Nico Mak Computing 2014-08-04 10:23 - 2014-08-13 12:07 - 00609595 _____ () C:\WINDOWS\WindowsUpdate.log 2014-08-04 10:16 - 2014-08-04 10:16 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iPod 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-04 09:03 - 2014-08-04 09:03 - 00000000 ____D () C:\Users\contesssa\AppData\Local\Adobe 2014-07-21 11:55 - 2014-07-21 11:55 - 03736040 _____ (Piriform Ltd) C:\Users\contesssa\Downloads\ccsetup415_slim.exe 2014-07-21 11:55 - 2014-07-21 11:55 - 00002780 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2014-07-21 11:55 - 2014-07-21 11:55 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-07-21 11:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll 2014-07-21 10:41 - 2014-07-21 10:41 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-07-21 10:30 - 2014-07-21 10:30 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking 2014-07-21 10:29 - 2014-07-21 10:41 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-07-15 00:37 - 2014-07-19 13:00 - 00000000 ____D () C:\WINDOWS\Minidump 2014-07-14 21:08 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-13 12:38 - 2014-08-04 15:23 - 00014086 _____ () C:\Users\contesssa\Downloads\FRST.txt 2014-08-13 12:38 - 2014-08-04 15:19 - 00000000 ____D () C:\FRST 2014-08-13 12:37 - 2014-08-13 12:37 - 00000000 ____D () C:\Users\contesssa\Downloads\FRST-OlderVersion 2014-08-13 12:37 - 2014-08-04 15:18 - 02100224 _____ (Farbar) C:\Users\contesssa\Downloads\FRST64.exe 2014-08-13 12:30 - 2014-02-26 14:46 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-13 12:07 - 2014-08-04 10:23 - 00609595 _____ () C:\WINDOWS\WindowsUpdate.log 2014-08-13 12:02 - 2013-10-18 00:55 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1714798670-2283502341-2433251003-1001 2014-08-13 12:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-08-13 11:52 - 2014-01-09 23:17 - 00000000 ____D () C:\Users\contesssa 2014-08-13 11:51 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-08-13 11:47 - 2014-02-26 14:45 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-08-13 11:45 - 2014-01-10 00:24 - 00000000 __RDO () C:\Users\contesssa\SkyDrive 2014-08-13 11:43 - 2014-01-29 17:31 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{85B33DF1-38E0-4A33-B992-7D2DC8C2FBAA} 2014-08-13 11:41 - 2014-08-08 12:47 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-08-13 11:41 - 2014-02-26 14:46 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-12 19:37 - 2014-08-07 12:04 - 00000000 ____D () C:\AdwCleaner 2014-08-12 18:25 - 2013-10-26 15:33 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Nitro PDF 2014-08-12 18:24 - 2014-03-13 21:38 - 00000182 _____ () C:\Users\contesssa\AppData\Local\RegisteredPackageInformation.xml 2014-08-12 18:23 - 2014-08-11 17:31 - 00001210 _____ () C:\WINDOWS\PFRO.log 2014-08-12 18:23 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-08-12 18:22 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2014-08-12 17:54 - 2014-08-12 17:54 - 00000000 _____ () C:\Neues Textdokument.txt 2014-08-12 17:36 - 2013-10-27 22:03 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Skype 2014-08-11 19:44 - 2013-10-23 18:45 - 00000000 ____D () C:\Conny 2014-08-11 18:51 - 2014-08-11 18:51 - 01366203 _____ () C:\Users\contesssa\Downloads\adwcleaner_3.304.exe 2014-08-11 17:41 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-08-11 17:31 - 2014-03-02 11:48 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-08 15:02 - 2014-08-08 13:32 - 00001156 _____ () C:\anti malware.txt 2014-08-08 13:39 - 2014-08-04 15:24 - 00032533 _____ () C:\Users\contesssa\Downloads\Addition.txt 2014-08-08 12:47 - 2014-08-08 12:47 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-08 12:46 - 2014-08-08 12:46 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-04 16:19 - 2014-08-04 16:19 - 00000936 _____ () C:\Users\contesssa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRST64.lnk 2014-08-04 15:20 - 2014-08-04 14:56 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Nico Mak Computing 2014-08-04 10:16 - 2014-08-04 10:16 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iPod 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-04 09:11 - 2013-10-26 15:04 - 00000000 ____D () C:\ProgramData\tmp 2014-08-04 09:03 - 2014-08-04 09:03 - 00000000 ____D () C:\Users\contesssa\AppData\Local\Adobe 2014-08-03 11:50 - 2013-11-14 09:27 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-08-03 11:50 - 2013-11-14 09:11 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat 2014-08-03 11:50 - 2013-11-14 09:11 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat 2014-07-22 11:52 - 2013-10-17 16:57 - 00000000 ___RD () C:\Users\contesssa\Desktop\Anwendungen 2014-07-22 11:50 - 2013-10-27 22:03 - 00000000 ____D () C:\ProgramData\Skype 2014-07-22 11:50 - 2013-10-27 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-07-22 11:43 - 2013-10-27 21:46 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-07-22 11:27 - 2013-10-27 16:09 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4 2014-07-22 01:30 - 2013-10-27 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-07-21 11:55 - 2014-07-21 11:55 - 03736040 _____ (Piriform Ltd) C:\Users\contesssa\Downloads\ccsetup415_slim.exe 2014-07-21 11:55 - 2014-07-21 11:55 - 00002780 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2014-07-21 11:55 - 2014-07-21 11:55 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-07-21 10:41 - 2014-07-21 10:41 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-07-21 10:41 - 2014-07-21 10:29 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-07-21 10:30 - 2014-07-21 10:30 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking 2014-07-20 13:27 - 2014-04-14 14:56 - 00000163 _____ () C:\WINDOWS\Reimage.ini 2014-07-19 13:00 - 2014-07-15 00:37 - 00000000 ____D () C:\WINDOWS\Minidump 2014-07-19 11:58 - 2013-08-22 15:25 - 00000194 _____ () C:\WINDOWS\win.ini 2014-07-15 16:49 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-07-15 00:37 - 2013-08-22 16:44 - 00360464 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-07-15 00:30 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-15 00:30 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-07-15 00:30 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-07-15 00:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-15 00:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-14 21:19 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-07-14 21:17 - 2013-10-25 14:06 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-07-14 21:15 - 2013-10-25 14:05 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe Some content of TEMP: ==================== C:\Users\contesssa\AppData\Local\Temp\avgnt.exe C:\Users\contesssa\AppData\Local\Temp\jre-8u11-windows-au.exe C:\Users\contesssa\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-13 12:02 ==================== End Of Log ============================ --- --- --- |
|
13.08.2014, 12:24
| #19 |
| /// TB-Ausbilder | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern. Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann. Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte  SecurityCheck und:
Schritt 4
Bitte poste mit deiner nächsten Antwort
|
|
13.08.2014, 18:20
| #20 |
| | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Vielen Dank Mathias,ich werde das so schnell wie möglich erledigen ! Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 11-August-2014
Tool run by contesssa on 13.08.2014 at 16:56:46,55.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\contesssa\Downloads\zoek.exe [Scan all users] [Quick Scan] [Auto Clean]
==== System Restore Info ======================
13.08.2014 16:58:02 Zoek.exe System Restore Point Created Succesfully.
==== Empty Folders Check ======================
C:\PROGRA~3\Oracle deleted successfully
C:\Users\contesssa\AppData\Roaming\Nico Mak Computing deleted successfully
C:\Users\contesssa\AppData\Roaming\Windows Live Writer deleted successfully
C:\Users\contesssa\AppData\Local\CrashDumps deleted successfully
C:\Users\contesssa\AppData\Local\SoftUpdate deleted successfully
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-1714798670-2283502341-2433251003-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_USERS\S-1-5-21-1714798670-2283502341-2433251003-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_USERS\S-1-5-21-1714798670-2283502341-2433251003-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_USERS\S-1-5-21-1714798670-2283502341-2433251003-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9} deleted successfully
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Deleting Files \ Folders ======================
C:\Users\contesssa\AppData\Local\nsgB9AD.tmp deleted
C:\WINDOWS\Reimage.ini deleted
C:\WINDOWS\wininit.ini deleted
==== Files Recently Created / Modified ======================
====== C:\WINDOWS ====
====== C:\Users\CONTES~1\AppData\Local\Temp ====
2014-08-08 08:04:08 E64FAFF5DD586EFE84E40C059AE56511 1609640 ----a-w- C:\Users\contesssa\AppData\Local\Temp\jre-8u11-windows-au.exe
2014-08-08 08:00:16 BC88BD8A271968E1370D4E28182F7831 49744 ----a-w- C:\Users\contesssa\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-08-06 15:48:25 D1B8356365D58B249B8E9E883E115B6A 454656 ----a-w- C:\Users\contesssa\AppData\Local\Temp\Quarantine.exe
====== Java Cache =====
====== C:\WINDOWS\SysWOW64 =====
====== C:\WINDOWS\SysWOW64\drivers =====
====== C:\WINDOWS\Sysnative =====
2014-08-11 15:38:08 6FB598E8DE02D879D17B35F144A1B3BC 270496 ------w- C:\WINDOWS\Sysnative\MpSigStub.exe
====== C:\WINDOWS\Sysnative\drivers =====
2014-08-08 10:47:17 8A50D5304E6AE48664CF5838EC32F647 122584 ----a-w- C:\WINDOWS\Sysnative\drivers\MBAMSwissArmy.sys
2014-08-08 10:47:03 F92B0E478C0FAA6D6661E6E977247E60 25816 ----a-w- C:\WINDOWS\Sysnative\drivers\mbam.sys
2014-08-08 10:47:03 9D9ED48F841EA37AA5310D54B9E5D3C7 91352 ----a-w- C:\WINDOWS\Sysnative\drivers\mbamchameleon.sys
2014-08-08 10:47:03 0664F6335F108F38FE08C3CA747311EE 64216 ----a-w- C:\WINDOWS\Sysnative\drivers\mwac.sys
====== C:\WINDOWS\Tasks ======
2014-07-21 08:30:16 -------- d-----w- C:\WINDOWS\Sysnative\Tasks\Safer-Networking
====== C:\WINDOWS\Temp ======
======= C:\Program Files =====
2014-08-04 08:16:14 -------- d-----w- C:\Program Files\iPod
2014-08-04 08:16:12 -------- d-----w- C:\Program Files\iTunes
======= C:\PROGRA~2 =====
2014-08-04 08:16:12 -------- d-----w- C:\PROGRA~2\iTunes
======= C: =====
2014-08-12 15:54:35 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Neues Textdokument.txt
2014-08-08 11:32:03 821DFBF0DD326EBDCE70614ED3FEB39C 1156 ----a-w- C:\anti malware.txt
====== C:\Users\contesssa\AppData\Roaming ======
2014-08-11 15:42:23 -------- d-s---w- C:\WINDOWS\serviceprofiles\networkservice\AppData\Locallow\Microsoft
2014-08-04 07:03:59 -------- d-----w- C:\Users\contesssa\AppData\Local\Adobe
2014-07-21 09:10:33 -------- d-----r- C:\Users\contesssa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-07-21 08:33:39 -------- d-----w- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Programs
====== C:\Users\contesssa ======
2014-08-13 12:10:57 -------- d-----w- C:\WINDOWS\serviceprofiles\Localservice\winhttp
2014-08-13 09:52:07 -------- d-----r- C:\Users\contesssa\Contacts
2014-08-11 16:51:30 9D46D72131D0E36A79D4819F08EA0E0B 1366203 ----a-w- C:\Users\contesssa\Downloads\adwcleaner_3.304.exe
2014-08-08 10:46:13 E90BF9E1562F40140161573B79CD5720 17292760 ----a-w- C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-04 13:18:34 03D4B2C090DD4AD273C9889F41E4F7E7 2100224 ----a-w- C:\Users\contesssa\Downloads\FRST64.exe
2014-08-04 08:16:59 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-04 08:16:12 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
====== C: exe-files ==
2014-08-13 10:37:46 03D4B2C090DD4AD273C9889F41E4F7E7 2100224 ----a-w- C:\Users\contesssa\AppData\Local\Microsoft\Windows\INetCache\IE\T4HAV8WD\FRST64[1].exe
2014-08-11 16:51:30 9D46D72131D0E36A79D4819F08EA0E0B 1366203 ----a-w- C:\Users\contesssa\Downloads\adwcleaner_3.304.exe
2014-08-11 15:38:08 6FB598E8DE02D879D17B35F144A1B3BC 270496 ------w- C:\Windows\System32\MpSigStub.exe
2014-08-08 10:46:13 E90BF9E1562F40140161573B79CD5720 17292760 ----a-w- C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-08 08:04:08 E64FAFF5DD586EFE84E40C059AE56511 1609640 ----a-w- C:\Users\contesssa\AppData\Local\Temp\jre-8u11-windows-au.exe
2014-08-06 15:48:25 D1B8356365D58B249B8E9E883E115B6A 454656 ----a-w- C:\Users\contesssa\AppData\Local\Temp\Quarantine.exe
=== C: other files ==
2014-08-08 10:47:17 8A50D5304E6AE48664CF5838EC32F647 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-08-08 10:47:03 F92B0E478C0FAA6D6661E6E977247E60 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-08-08 10:47:03 9D9ED48F841EA37AA5310D54B9E5D3C7 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-08-08 10:47:03 0664F6335F108F38FE08C3CA747311EE 64216 ----a-w- C:\Windows\System32\drivers\mwac.sys
==== Startup Registry Enabled ======================
[HKEY_USERS\S-1-5-21-1714798670-2283502341-2433251003-1001\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"GoogleChromeAutoLaunch_8856B223242C46EC7E7BB0B38EB6BDE4"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe 60"
"YouCam Tray"="C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe /s"
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"HP Software Update"="C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe"
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"GoogleChromeAutoLaunch_8856B223242C46EC7E7BB0B38EB6BDE4"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"BtvStack"="C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
==== Startup Registry Enabled x64 ======================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"
"RtHDVBg_Dolby"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 "
"Energy Management"="C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe"
"EnergyUtility"="C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe"
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe"
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe"
"Persistence"="C:\WINDOWS\system32\igfxpers.exe"
"SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe "
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"BtvStack"="C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
==== Task Scheduler Jobs ======================
C:\WINDOWS\tasks\Adobe Flash Player Updater.job --a-------- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [09.07.2014 19:47]
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [26.02.2014 14:46]
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [26.02.2014 14:46]
C:\WINDOWS\tasks\Synaptics TouchPad Enhancements.job --a-------- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [09.03.2013 02:57]
==== Other Scheduled Tasks ======================
"C:\WINDOWS\SysNative\tasks\Adobe Flash Player Updater" [C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]
"C:\WINDOWS\SysNative\tasks\aviraSWU" [cscript.exe]
"C:\WINDOWS\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]
"C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\WINDOWS\SysNative\tasks\SoftUpdateDaily" [C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe]
"C:\WINDOWS\SysNative\tasks\SoftUpdateLogon" [C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe]
"C:\WINDOWS\SysNative\tasks\User_Feed_Synchronization-{85B33DF1-38E0-4A33-B992-7D2DC8C2FBAA}" [C:\WINDOWS\system32\msfeedssync.exe]
"C:\WINDOWS\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]
"C:\WINDOWS\SysNative\tasks\Lenovo\LenovoDependencyVersionTask" [C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe]
"C:\WINDOWS\SysNative\tasks\Lenovo\LenovoMachineInformation" [C:\Program Files\lenovo\SystemAgent\MachineInformation.exe]
"C:\WINDOWS\SysNative\tasks\Lenovo\LenovoUserguidesCopy" [C:\Program Files\lenovo\SystemAgent\UserguidesCopy.exe]
"C:\WINDOWS\SysNative\tasks\Lenovo\LenovoWarrantyChinaTask" [C:\Program Files\lenovo\SystemAgent\ChinaWarrantyService.exe]
==== Chrome Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
cojnmaaohncijldefpkpkkakjonfmgeb - C:\Program Files (x86)\avira\Chrome\avira-1.5.14.crx[11.12.2013 17:48]
flliilndjeohchalpbbcdekjklbdgfkk - No path found[]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[]
Comodo Web Inspector - contesssa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bdngekjahnmlkinegnhdmmbcfnmbclnn
Comodo Share Page Service - contesssa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\mcmdgbiocnkpnaccjkailibfgepaccgf
Google Wallet - contesssa\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
en - contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\cojnmaaohncijldefpkpkkakjonfmgeb
Google Wallet - contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
==== Chromium Startpages ======================
C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "hxxp://www.google.com/",
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com"
"SearchAssistant"="hxxp://www.google.com"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://www.google.com"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="hxxp://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"
==== Reset IE Proxy ======================
Value(s) before fix:
"ProxyServer"="http=127.0.0.1:50714;https=127.0.0.1:50714"
"ProxyOverride"="<-loopback>"
"ProxyEnable"=dword:00000000
Value(s) after fix:
"ProxyEnable"=dword:00000000
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{f6f7e3e1-d1e6-4adc-b2c8-4f9946a84573} deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\A2B9E6CA6E7A71B4A8C6925D9176E321 deleted successfully
==== Empty IE Cache ======================
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\contesssa\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\contesssa\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\contesssa\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully
C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=8 folders=1 1099797 bytes)
==== Empty Temp Folders ======================
C:\Users\contesssa\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\WINDOWS\Temp successfully emptied
C:\Users\CONTES~1\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 13.08.2014 at 17:15:11,49 ======================
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=47b7fea3cdfb694688edabda2bdb5bae
# engine=19638
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-13 04:30:38
# local_time=2014-08-13 06:30:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 15163 12330959 0 0
# scanned=202275
# found=2
# cleaned=2
# scan_time=3806
sh=89FCAA65E8E8B19DD749276E66D0A78C685A7CCB ft=1 fh=0c144f570c7aed37 vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\contesssa\AppData\Roaming\Opera Software\Opera Stable\File System\008\t\00\00000000"
sh=BC38CF315188F75926B945C317C04CAF56FEDA1D ft=1 fh=32eec468610824c6 vn="Win32/AnyProtect.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\zoek_backup\C_Users_contesssa_AppData_Local_nsgB9AD.tmp.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.86 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Defender WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 14.0.0.145 Adobe Reader XI Google Chrome 35.0.1916.153 Google Chrome 36.0.1985.125 ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSMpEng.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2014
Ran by contesssa at 2014-08-13 19:16:45
Running from C:\Users\contesssa\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{15B2F0E3-3FAC-4495-B0FD-398EECFA4100}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Intel® Trusted Connect Service Client (Version: 1.26.242.3 - Intel Corporation) Hidden
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 8 Update 5 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418005FF}) (Version: 8.0.50 - Oracle Corporation)
Lenovo OneKey Recovery (Version: 8.0.0.1219 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: - )
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50325 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50330 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.50325 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50325 - Microsoft Corporation)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Nitro Pro 8 (HKLM\...\{34BE77EE-B563-49D7-A8A0-FFD76D29BBD3}) (Version: 8.0.10.7 - Nitro)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: - )
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.222 - Qualcomm Atheros Communications)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.9 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.4.1.0 - Synaptics Incorporated)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1714798670-2283502341-2433251003-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\contesssa\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
04-08-2014 13:29:52 Windows Update
11-08-2014 17:14:27 Geplanter Prüfpunkt
13-08-2014 14:57:37 zoek.exe restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {028F7BA2-6F53-4A86-973A-B72EBE6D73A6} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {11713C7D-CDD5-4ED6-A865-89685117D6DE} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {15CFED45-5261-4590-A96F-47EBB8A1961D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {31C2A7A0-4892-4BD0-AD93-4A752D1796A5} - System32\Tasks\Lenovo\LenovoMachineInformation => C:\Program Files\lenovo\SystemAgent\MachineInformation.exe [2013-05-02] ()
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {41B089C1-D45B-41BD-A1C7-B07E874EF3EE} - System32\Tasks\Lenovo\LenovoWarrantyChinaTask => C:\Program Files\lenovo\SystemAgent\ChinaWarrantyService.exe [2013-05-02] ()
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4ADE1941-F662-4498-8972-B198A70241BF} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-05-02] ()
Task: {578DA71D-4792-49E5-A998-82BD10017897} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {6A22210D-76C7-4A29-AFE1-B08943249160} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-26] (Google Inc.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7EEFEB6A-289F-4D4E-9025-A535969B0364} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8C93EE21-3136-4695-881A-2F45783050C1} - System32\Tasks\SoftUpdateLogon => C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {927CF79C-0219-4928-9A28-263935B64716} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A1361BB9-0188-439D-9100-D20F39CDF21E} - System32\Tasks\SoftUpdateDaily => C:\Users\contesssa\AppData\Local\SoftUpdate\SoftUpdate.exe
Task: {A56F93A8-C213-4A7D-90F0-3EE0E5551C59} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {AA05510B-0EE5-4260-9FB0-84CE84E4290A} - System32\Tasks\Lenovo\LenovoUserguidesCopy => C:\Program Files\lenovo\SystemAgent\UserguidesCopy.exe [2013-05-02] ()
Task: {B379786F-D38D-47CD-AB65-82CA8CF66164} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {B8A14DF3-0A9A-437A-B5D8-9D3CF10694E9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-26] (Google Inc.)
Task: {C4583446-F249-471E-B139-442A743C0538} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {D97C9F57-3822-4C1D-9B29-ACDB7995D42B} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2013-02-28 18:05 - 2013-02-28 18:05 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-02-28 18:02 - 2013-02-28 18:02 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-02-28 18:06 - 2013-02-28 18:06 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
2013-12-21 01:02 - 2013-12-21 01:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-25 21:52 - 2014-04-25 21:52 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\7a891719ed7b38bb959d812adc580f5c\PSIClient.ni.dll
2013-07-23 14:55 - 2012-10-23 15:22 - 01199648 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\contesssa\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "fst_de_99"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/13/2014 07:10:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 07:05:14 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:25:37 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:25:35 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:23:04 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:23:02 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:22:54 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:22:54 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/13/2014 05:22:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (08/08/2014 02:20:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Name des fehlerhaften Moduls: adwcleaner_3.303.exe, Version: 3.3.0.3, Zeitstempel: 0x53e28764
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x0002f8c7
ID des fehlerhaften Prozesses: 0x338
Startzeit der fehlerhaften Anwendung: 0xadwcleaner_3.303.exe0
Pfad der fehlerhaften Anwendung: adwcleaner_3.303.exe1
Pfad des fehlerhaften Moduls: adwcleaner_3.303.exe2
Berichtskennung: adwcleaner_3.303.exe3
Vollständiger Name des fehlerhaften Pakets: adwcleaner_3.303.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: adwcleaner_3.303.exe5
System errors:
=============
Error: (08/13/2014 05:09:20 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/13/2014 05:09:20 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/13/2014 05:09:20 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/13/2014 05:09:19 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/13/2014 05:09:19 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (08/12/2014 06:22:46 PM) (Source: DCOM) (EventID: 10010) (User: CONNY)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (08/12/2014 06:07:08 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:57 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:38 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (08/12/2014 06:05:14 PM) (Source: DCOM) (EventID: 10005) (User: CONNY)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Microsoft Office Sessions:
=========================
Error: (08/13/2014 07:10:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\$RECYCLE.BIN\S-1-5-21-1714798670-2283502341-2433251003-1001\$RED224R.exe
Error: (08/13/2014 07:05:14 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (08/13/2014 05:25:37 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:25:35 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:23:04 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:23:02 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:22:54 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:22:54 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/13/2014 05:22:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\contesssa\Downloads\esetsmartinstaller_deu.exe
Error: (08/08/2014 02:20:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: adwcleaner_3.303.exe3.3.0.353e28764adwcleaner_3.303.exe3.3.0.353e28764c00000fd0002f8c733801cfb301e0f89fa8C:\Users\contesssa\Downloads\adwcleaner_3.303.exeC:\Users\contesssa\Downloads\adwcleaner_3.303.exe714e0251-1ef6-11e4-beac-50af735ae431
CodeIntegrity Errors:
===================================
Date: 2014-07-20 13:18:25.679
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.
Date: 2014-07-20 13:18:12.580
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.
Date: 2014-02-25 21:57:06.854
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll that did not meet the Windows signing level requirements.
Date: 2014-02-25 21:57:06.682
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll that did not meet the Windows signing level requirements.
Date: 2013-11-03 01:10:55.629
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-03 00:59:03.666
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 09:18:13.111
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 08:44:57.218
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 08:38:59.879
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2013-11-02 01:14:32.601
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz
Percentage of memory in use: 44%
Total physical RAM: 3975.27 MB
Available physical RAM: 2212.14 MB
Total Pagefile: 4679.27 MB
Available Pagefile: 2831.31 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.23 GB) (Free:369.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 3FD8BFE0)
Partition: GPT Partition Type.
==================== End Of Log ============================
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2014 Ran by contesssa (administrator) on CONNY on 13-08-2014 19:16:00 Running from C:\Users\contesssa\Downloads Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (LENOVO INCORPORATED.) C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13425224 2013-03-06] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-09] (Realtek Semiconductor) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2013-07-23] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2013-07-23] (Lenovo(beijing) Limited) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3041520 2013-03-09] (Synaptics Incorporated) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [168464 2012-10-30] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [224128 2014-03-18] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132224 2013-02-28] ( (Atheros Communications)) HKU\S-1-5-21-1714798670-2283502341-2433251003-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20473504 2013-10-02] (Skype Technologies S.A.) HKU\S-1-5-21-1714798670-2283502341-2433251003-1001\...\Run: [GoogleChromeAutoLaunch_8856B223242C46EC7E7BB0B38EB6BDE4] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-07-15] (Google Inc.) ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {B8685F37-302D-4748-8F8A-0CC05A05EA7B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms} BHO-x32: Avira Savings Advisor BHO -> {A18A516C-AA41-46A9-92DB-60208917E442} -> C:\Program Files (x86)\avira\Internet Explorer\avira32.dll () Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll No File Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR DefaultSearchKeyword: trovi.search CHR DefaultNewTabURL: CHR Extension: (Avira Sparberater) - C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\cojnmaaohncijldefpkpkkakjonfmgeb [2014-03-02] CHR Extension: (Google Wallet) - C:\Users\contesssa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-19] CHR HKLM-x32\...\Chrome\Extension: [cojnmaaohncijldefpkpkkakjonfmgeb] - C:\Program Files (x86)\avira\Chrome\avira-1.5.14.crx [2013-12-11] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227968 2013-02-28] (Qualcomm Atheros Commnucations) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164736 2012-11-08] (Intel Corporation) R2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [562504 2013-05-02] (LENOVO INCORPORATED.) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2012-12-13] (Nitro PDF Software) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-02-28] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-02-28] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R1 HMD; C:\Windows\system32\DRIVERS\hmd.sys [14888 2013-10-07] () S3 IntcDAud; C:\Windows\system32\DRIVERS\IntcDAud.sys [342528 2013-01-24] (Intel(R) Corporation) [File not signed] R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-13] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-03-09] (Synaptics Incorporated) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-13 19:11 - 2014-08-13 19:11 - 00854410 _____ () C:\Users\contesssa\Downloads\SecurityCheck.exe 2014-08-13 17:23 - 2014-08-13 17:23 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-13 16:57 - 2014-08-13 17:15 - 00018752 _____ () C:\zoek-results.log 2014-08-13 16:55 - 2014-08-13 18:30 - 00000000 ____D () C:\zoek_backup 2014-08-13 16:54 - 2014-08-13 16:54 - 01288704 _____ () C:\Users\contesssa\Downloads\zoek.exe 2014-08-13 12:37 - 2014-08-13 12:37 - 00000000 ____D () C:\Users\contesssa\Downloads\FRST-OlderVersion 2014-08-12 17:54 - 2014-08-12 17:54 - 00000000 _____ () C:\Neues Textdokument.txt 2014-08-11 18:51 - 2014-08-11 18:51 - 01366203 _____ () C:\Users\contesssa\Downloads\adwcleaner_3.304.exe 2014-08-11 17:38 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2014-08-11 17:31 - 2014-08-13 17:14 - 00001780 _____ () C:\WINDOWS\PFRO.log 2014-08-08 13:32 - 2014-08-08 15:02 - 00001156 _____ () C:\anti malware.txt 2014-08-08 12:47 - 2014-08-13 17:30 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-08-08 12:47 - 2014-08-08 12:47 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-08-08 12:47 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-08-08 12:47 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-08-08 12:46 - 2014-08-08 12:46 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-07 12:04 - 2014-08-12 19:37 - 00000000 ____D () C:\AdwCleaner 2014-08-04 16:19 - 2014-08-04 16:19 - 00000936 _____ () C:\Users\contesssa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRST64.lnk 2014-08-04 15:24 - 2014-08-13 12:39 - 00031285 _____ () C:\Users\contesssa\Downloads\Addition.txt 2014-08-04 15:23 - 2014-08-13 19:16 - 00013556 _____ () C:\Users\contesssa\Downloads\FRST.txt 2014-08-04 15:19 - 2014-08-13 19:16 - 00000000 ____D () C:\FRST 2014-08-04 15:18 - 2014-08-13 12:37 - 02100224 _____ (Farbar) C:\Users\contesssa\Downloads\FRST64.exe 2014-08-04 10:23 - 2014-08-13 17:47 - 00962434 _____ () C:\WINDOWS\WindowsUpdate.log 2014-08-04 10:16 - 2014-08-04 10:16 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iPod 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-04 09:03 - 2014-08-04 09:03 - 00000000 ____D () C:\Users\contesssa\AppData\Local\Adobe 2014-07-21 11:55 - 2014-07-21 11:55 - 03736040 _____ (Piriform Ltd) C:\Users\contesssa\Downloads\ccsetup415_slim.exe 2014-07-21 11:55 - 2014-07-21 11:55 - 00002780 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2014-07-21 11:55 - 2014-07-21 11:55 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-07-21 11:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll 2014-07-21 10:30 - 2014-07-21 10:30 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking 2014-07-21 10:29 - 2014-07-21 10:41 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-07-15 00:37 - 2014-07-19 13:00 - 00000000 ____D () C:\WINDOWS\Minidump 2014-07-14 21:08 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-13 19:16 - 2014-08-04 15:23 - 00013556 _____ () C:\Users\contesssa\Downloads\FRST.txt 2014-08-13 19:16 - 2014-08-04 15:19 - 00000000 ____D () C:\FRST 2014-08-13 19:11 - 2014-08-13 19:11 - 00854410 _____ () C:\Users\contesssa\Downloads\SecurityCheck.exe 2014-08-13 19:09 - 2014-01-29 17:31 - 00003934 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{85B33DF1-38E0-4A33-B992-7D2DC8C2FBAA} 2014-08-13 19:06 - 2013-10-26 15:33 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Nitro PDF 2014-08-13 19:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-08-13 18:47 - 2014-02-26 14:45 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-08-13 18:31 - 2013-10-18 00:55 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1714798670-2283502341-2433251003-1001 2014-08-13 18:30 - 2014-08-13 16:55 - 00000000 ____D () C:\zoek_backup 2014-08-13 18:30 - 2014-02-26 14:46 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-13 18:30 - 2014-02-26 14:46 - 00001124 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-13 17:47 - 2014-08-04 10:23 - 00962434 _____ () C:\WINDOWS\WindowsUpdate.log 2014-08-13 17:30 - 2014-08-08 12:47 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-08-13 17:23 - 2014-08-13 17:23 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-13 17:15 - 2014-08-13 16:57 - 00018752 _____ () C:\zoek-results.log 2014-08-13 17:15 - 2014-03-13 21:38 - 00000182 _____ () C:\Users\contesssa\AppData\Local\RegisteredPackageInformation.xml 2014-08-13 17:15 - 2014-01-10 00:24 - 00000000 __RDO () C:\Users\contesssa\SkyDrive 2014-08-13 17:15 - 2014-01-09 23:17 - 00000000 ____D () C:\Users\contesssa 2014-08-13 17:15 - 2013-10-27 22:03 - 00000000 ____D () C:\Users\contesssa\AppData\Roaming\Skype 2014-08-13 17:14 - 2014-08-11 17:31 - 00001780 _____ () C:\WINDOWS\PFRO.log 2014-08-13 17:14 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-08-13 17:14 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2014-08-13 16:54 - 2014-08-13 16:54 - 01288704 _____ () C:\Users\contesssa\Downloads\zoek.exe 2014-08-13 14:19 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-08-13 12:39 - 2014-08-04 15:24 - 00031285 _____ () C:\Users\contesssa\Downloads\Addition.txt 2014-08-13 12:37 - 2014-08-13 12:37 - 00000000 ____D () C:\Users\contesssa\Downloads\FRST-OlderVersion 2014-08-13 12:37 - 2014-08-04 15:18 - 02100224 _____ (Farbar) C:\Users\contesssa\Downloads\FRST64.exe 2014-08-13 11:51 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-08-12 19:37 - 2014-08-07 12:04 - 00000000 ____D () C:\AdwCleaner 2014-08-12 17:54 - 2014-08-12 17:54 - 00000000 _____ () C:\Neues Textdokument.txt 2014-08-11 19:44 - 2013-10-23 18:45 - 00000000 ____D () C:\Conny 2014-08-11 18:51 - 2014-08-11 18:51 - 01366203 _____ () C:\Users\contesssa\Downloads\adwcleaner_3.304.exe 2014-08-11 17:41 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-08-11 17:31 - 2014-03-02 11:48 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-08 15:02 - 2014-08-08 13:32 - 00001156 _____ () C:\anti malware.txt 2014-08-08 12:47 - 2014-08-08 12:47 - 00001129 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-08 12:47 - 2014-08-08 12:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-08 12:46 - 2014-08-08 12:46 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\contesssa\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-04 16:19 - 2014-08-04 16:19 - 00000936 _____ () C:\Users\contesssa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRST64.lnk 2014-08-04 10:16 - 2014-08-04 10:16 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iTunes 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files\iPod 2014-08-04 10:16 - 2014-08-04 10:16 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-04 09:11 - 2013-10-26 15:04 - 00000000 ____D () C:\ProgramData\tmp 2014-08-04 09:03 - 2014-08-04 09:03 - 00000000 ____D () C:\Users\contesssa\AppData\Local\Adobe 2014-08-03 11:50 - 2013-11-14 09:27 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-08-03 11:50 - 2013-11-14 09:11 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat 2014-08-03 11:50 - 2013-11-14 09:11 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat 2014-07-22 11:52 - 2013-10-17 16:57 - 00000000 ___RD () C:\Users\contesssa\Desktop\Anwendungen 2014-07-22 11:50 - 2013-10-27 22:03 - 00000000 ____D () C:\ProgramData\Skype 2014-07-22 11:50 - 2013-10-27 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-07-22 11:43 - 2013-10-27 21:46 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-07-22 11:27 - 2013-10-27 16:09 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4 2014-07-22 01:30 - 2013-10-27 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-07-21 11:55 - 2014-07-21 11:55 - 03736040 _____ (Piriform Ltd) C:\Users\contesssa\Downloads\ccsetup415_slim.exe 2014-07-21 11:55 - 2014-07-21 11:55 - 00002780 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2014-07-21 11:55 - 2014-07-21 11:55 - 00000845 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-07-21 11:55 - 2014-07-21 11:55 - 00000000 ____D () C:\Program Files\CCleaner 2014-07-21 10:41 - 2014-07-21 10:29 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-07-21 10:30 - 2014-07-21 10:30 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Safer-Networking 2014-07-19 13:00 - 2014-07-15 00:37 - 00000000 ____D () C:\WINDOWS\Minidump 2014-07-19 11:58 - 2013-08-22 15:25 - 00000194 _____ () C:\WINDOWS\win.ini 2014-07-15 16:49 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-07-15 00:37 - 2013-08-22 16:44 - 00360464 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-07-15 00:30 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-15 00:30 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-07-15 00:30 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-07-15 00:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-15 00:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-14 21:17 - 2013-10-25 14:06 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-07-14 21:15 - 2013-10-25 14:05 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-13 12:02 ==================== End Of Log ============================ --- --- --- geschafft : ) |
|
13.08.2014, 19:45
| #21 |
| /// TB-Ausbilder | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
HKLM-x32\...\Run: [] => [X]
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Du verwendest veraltete Software auf deinem Rechner, was ein Sicherheitsrisiko darstellt. Daher solltest du veraltete Software deinstallieren und anschließend die aktuellste Version installieren. Folge dem Pfad Start > Systemsteuerung > Sofware / Programme deinstallieren. Deinstalliere die folgenden Programme von deinem Rechner:
Downloade und installiere dir bitte nun:Starte deinen Rechner nach der Installation neu auf. Schritt 2 Die Reihenfolge ist hier entscheidend.
Schritt 3 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
15.08.2014, 08:45
| #22 |
| | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Oh Mensch Mathias , ich danke dir und werde mich erkenntlich zeigen. Finde ich echt total das hier Hilfe angeboten wird :-D Die +R Taste hab ich nicht gefunden,finde ich noch..meinen alten flashplayer ging zwar von meiner programmliste zu entfernen aber nicht aus meinen System :-( CC Cleaner hab ich entfernt und spyblaster installiert und die anderen tips werde ich auch befolgen dafür brauche ich noch einbisschen Zeit. Kann ich , wenn irgendwann noch Probleme auftauchen, dich kontaktieren? Viele Grüße Conny |
|
15.08.2014, 12:39
| #23 |
| /// TB-Ausbilder | TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe [gelöst] Klar kannst du mich noch kontaktieren.  Ich bin froh, dass wir helfen konnten  In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank!  Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
|
| Themen zu TR/Buzy.4089.3 C:/ Windows/ bsfvc64.exe |
| .exe, leute, liebe, scan, scanner, stelle, troja, trojaner, virenscan, virenscanner, windows, windows 8 |
Linear-Darstellung
