| |
| |||||||
Log-Analyse und Auswertung: PC läuft langsam, Textdatei lässt sich nicht löschenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
01.09.2014, 05:09
| #1 |
 |  PC läuft langsam, Textdatei lässt sich nicht löschen Hallo, seit einigen Tagen läuft mein PC ziemlich langsam. Hier schonmal die Logfiles: FRST Logfile: HTML-Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Corki (administrator) on SPEEDLINE_HP on 01-09-2014 06:00:14
Running from C:\Users\Corki\Downloads\FRST-OlderVersion\FRST-OlderVersion\FRST-OlderVersion
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
() C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
() C:\Program Files (x86)\LPT\srpts.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\mqtgsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files (x86)\puush\puush.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
() C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [489472 2010-09-27] (IDT, Inc.)
HKLM\...\Run: [MsmqIntCert] => regsvr32 /s mqrt.dll
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [664600 2010-09-28] (PDF Complete Inc)
HKLM-x32\...\Run: [RoccatKoneXTD] => C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [558944 2012-11-30] (ROCCAT GmbH)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [KPeerNexonEU] => C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [438272 2013-07-19] (NEXON Inc.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2013-10-27] ()
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [Browser Infrastructure Helper] => C:\Users\Corki\AppData\Local\Smartbar\Application\SnapDo.exe [28192 2014-04-08] (Smartbar)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-08-31] (Electronic Arts)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [521216 2014-07-18] (LOL Replay)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3NYnTOqpuAS3I9zzHB7osEXiEti4UVInLRg0TQK0-aizhplySMmc9G5au8EmlOW
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SB&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SB&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0EtDyCzyzyyDzztB0CtCyDzztDyE0AtBtN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFzztFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StC0DyE0F0Fzz0D0FtGtBtA0B0EtGyE0B0CyBtG0B0CtDyEtGyDyEyEtC0D0D0FyEyC0E0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzz0F0C0C0A0F0BtGyEtB0F0CtG0EzztCtAtGtByEtD0DtGyD0CtDtAyCyC0CtC0A0EyEtC2Q&cr=1138014053&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dvd_14_14_ch&cd=2XzuyEtN2Y1L1Qzu0EtDyCzyzyyDzztB0CtCyDzztDyE0AtBtN0D0Tzu0SzztByDtN1L2XzutBtFtCzztFzztFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StC0DyE0F0Fzz0D0FtGtBtA0B0EtGyE0B0CyBtG0B0CtDyEtGyDyEyEtC0D0D0FyEyC0E0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzz0F0C0C0A0F0BtGyEtB0F0CtG0EzztCtAtGtByEtD0DtGyD0CtDtAyCyC0CtC0A0EyEtC2Q&cr=1138014053&ir=
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Desktops
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SC&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SC&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SB&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SB&q={searchTerms}
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: SmartbarInternetExplorerBHOEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: SmartbarInternetExplorerBHOEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name -> {b98ad8da-3cad-e9ae-132a-6e1efbb9a65c} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-05-10] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default
FF NewTab: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3Vr5_ckKf7R5Wh_IGzm3OY2v3vbvklpe2ocBOlG3hKOACR2j2WbwidAXkmiJm9f
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3NYnTOqpuAS3I9zzHB7osEXiEti4UVInLRg0TQK0-aizhplySMmc9G5au8EmlOW
FF Keyword.URL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461DudoywGYogxjokoZP0acqFS1LJhX_kLWB1mP6OxLfrcg7q1Yrtr0SB&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF user.js: detected! => C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default\user.js
FF SearchPlugin: C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: z - C:\Program Files (x86)\Mozilla Firefox\extensions\{652f37d2-5d36-2a41-489e-6bc2164ee11e} [2014-07-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-07-08]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-05]
Chrome:
=======
CHR HomePage: Default -> D45302D67FF5F9D21CA9617E67F7DCBCF88461A86D0D4A2048AC9F9B0D3A0F46
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> FDDED5A1A7CD04F89A2326AD258BECFDE31B1FC1CDB13339845AE615B744B8BB
CHR DefaultSearchURL: Default -> AE7A6153352D002BE91817E5B6F5CC4959BD918EB758BB0A609919E0E5439350
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\npBFHUpdater.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\BFHUpdater.exe No File
CHR Plugin: (NielsenOnline) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh\1.3.0_0\chrometracker.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Relevant-Knowledge) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0\plugins/rlcm.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-12-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (AdBlock) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-04]
CHR Extension: (Google Wallet) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-29]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-04-05]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2231616 2010-07-19] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-30] (IObit)
R2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [37920 2014-04-08] ()
R2 MSMQ; C:\Windows\system32\mqsvc.exe [9216 2009-07-14] (Microsoft Corporation)
R2 MSMQTriggers; C:\Windows\system32\mqtgsvc.exe [189440 2010-11-20] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1119768 2010-09-28] (PDF Complete Inc)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-08-02] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2014-08-02] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S2 otshot; C:\program files\otshot\ZalmanUpdateService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S0 hdhw; C:\Windows\SysWOW64\drivers\erfw.sys [61440 2014-09-01] () [File not signed]
S0 helo; C:\Windows\SysWOW64\drivers\ponr.sys [61440 2014-09-01] () [File not signed]
S0 kkrajfcv; C:\Windows\SysWOW64\drivers\rvpnn.sys [61440 2014-09-01] () [File not signed]
S3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
S3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-01] (Malwarebytes Corporation)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [189440 2009-07-14] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S0 qzzstw; C:\Windows\SysWOW64\drivers\wthkc.sys [61440 2014-09-01] () [File not signed]
S0 ydnaa; C:\Windows\SysWOW64\drivers\ebqoqsc.sys [61440 2014-09-01] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 03:12 - 2014-09-01 05:25 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-01 03:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-01 03:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-01 03:11 - 2014-09-01 03:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 03:11 - 2014-09-01 03:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Corki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
2014-09-01 01:54 - 2014-09-01 05:00 - 00003608 _____ () C:\avenger.txt
2014-09-01 01:42 - 2014-09-01 01:42 - 00000000 ____D () C:\Users\Corki\Downloads\avenger
2014-09-01 01:41 - 2014-09-01 01:41 - 00724952 _____ () C:\Users\Corki\Downloads\avenger.zip
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-28 14:25 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 14:25 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 14:25 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 20:38 - 2014-08-26 20:38 - 01519241 _____ () C:\Users\Corki\Downloads\LOLReplay-0.8.9.9.exe
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-24 21:45 - 2014-08-24 21:45 - 01113077 _____ () C:\Users\Corki\Downloads\22433 (1).zip
2014-08-24 04:24 - 2014-08-24 04:24 - 00239907 _____ () C:\Users\Corki\Downloads\5415.zip
2014-08-14 18:35 - 2014-08-14 18:36 - 32166680 _____ (Any-Video-Converter.com ) C:\Users\Corki\Downloads\avc-free-5.6.6.exe
2014-08-14 03:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 03:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 03:02 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 03:02 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 03:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 18:04 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 18:04 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 18:04 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 18:04 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 18:04 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 18:04 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 18:04 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 18:04 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 18:04 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 18:04 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 18:04 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 18:04 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 18:04 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 18:04 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 18:04 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 18:04 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 18:04 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 18:04 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 18:04 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 18:04 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 18:00 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 17:57 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 17:57 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 17:57 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 17:57 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 17:57 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 17:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 17:52 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 17:52 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 17:52 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 17:52 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-11 16:20 - 2014-08-13 00:27 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2014-08-11 16:19 - 2014-08-11 16:19 - 00339968 _____ () C:\Users\Corki\Downloads\Warframe.msi
2014-08-11 01:37 - 2014-08-11 01:37 - 00000000 _____ () C:\Windows\SysWOW64\sho1B4B.tmp
2014-08-09 18:25 - 2014-09-01 01:44 - 00216064 ___SH () C:\Users\Corki\Downloads\Thumbs.db
2014-08-02 19:43 - 2014-08-02 19:43 - 00001176 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-08-02 19:43 - 2014-08-02 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-01 06:00 - 2014-04-23 15:23 - 00000000 ____D () C:\FRST
2014-09-01 05:57 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-01 05:57 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-01 05:53 - 2011-05-10 01:43 - 02056744 _____ () C:\Windows\WindowsUpdate.log
2014-09-01 05:52 - 2011-10-03 15:49 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Skype
2014-09-01 05:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv
2014-09-01 05:51 - 2014-05-29 10:34 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-01 05:50 - 2013-12-28 18:35 - 00051710 _____ () C:\Windows\setupact.log
2014-09-01 05:50 - 2011-09-05 09:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-01 05:50 - 2011-05-10 01:38 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-01 05:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:46 - 2011-09-05 09:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-01 05:25 - 2014-09-01 03:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-01 05:25 - 2014-05-29 10:34 - 00000000 ____D () C:\ProgramData\Origin
2014-09-01 05:25 - 2012-10-30 17:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 05:00 - 2014-09-01 01:54 - 00003608 _____ () C:\avenger.txt
2014-09-01 04:41 - 2013-12-28 18:34 - 01128304 _____ () C:\Windows\PFRO.log
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-09-01 03:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 03:11 - 2014-09-01 03:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Corki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-01 02:12 - 2012-10-30 17:44 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-01 02:12 - 2012-10-30 17:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-01 02:12 - 2011-09-05 09:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 01:57 - 2013-07-13 14:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
2014-09-01 01:56 - 2012-08-30 18:16 - 00000000 ____D () C:\Users\Corki\AppData\Local\PMB Files
2014-09-01 01:44 - 2014-08-09 18:25 - 00216064 ___SH () C:\Users\Corki\Downloads\Thumbs.db
2014-09-01 01:42 - 2014-09-01 01:42 - 00000000 ____D () C:\Users\Corki\Downloads\avenger
2014-09-01 01:41 - 2014-09-01 01:41 - 00724952 _____ () C:\Users\Corki\Downloads\avenger.zip
2014-09-01 01:03 - 2013-08-02 18:43 - 00000000 ____D () C:\Program Files (x86)\DevPro
2014-09-01 00:47 - 2013-04-01 10:48 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\YGOPro
2014-09-01 00:12 - 2012-02-19 15:54 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\TS3Client
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-31 22:13 - 2012-02-06 18:52 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForCorki
2014-08-31 22:13 - 2012-02-06 18:52 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForCorki.job
2014-08-31 16:36 - 2011-05-10 01:52 - 00000000 ____D () C:\ProgramData\PDFC
2014-08-31 16:11 - 2012-08-30 18:16 - 00000000 ____D () C:\ProgramData\PMB Files
2014-08-31 15:35 - 2013-12-30 13:23 - 00000000 ____D () C:\ProgramData\ProductData
2014-08-29 20:49 - 2011-09-05 09:19 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-29 15:28 - 2011-09-05 04:25 - 00000000 ____D () C:\Users\Corki\AppData\Local\CrashDumps
2014-08-29 15:26 - 2009-07-14 06:45 - 00472008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 17:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-27 04:56 - 2013-10-30 13:07 - 00000000 ____D () C:\Users\Corki\AppData\Local\Battle.net
2014-08-26 20:38 - 2014-08-26 20:38 - 01519241 _____ () C:\Users\Corki\Downloads\LOLReplay-0.8.9.9.exe
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-25 05:49 - 2014-04-14 21:59 - 00000941 _____ () C:\Users\Corki\Desktop\Open Broadcaster Software.lnk
2014-08-25 05:49 - 2014-04-14 21:59 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\OBS
2014-08-24 21:50 - 2012-06-20 18:33 - 00000000 ____D () C:\Users\Corki\Downloads\SIU 3.332-Lite
2014-08-24 21:45 - 2014-08-24 21:45 - 01113077 _____ () C:\Users\Corki\Downloads\22433 (1).zip
2014-08-24 04:24 - 2014-08-24 04:24 - 00239907 _____ () C:\Users\Corki\Downloads\5415.zip
2014-08-24 01:12 - 2013-10-30 13:07 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-23 04:07 - 2014-08-28 14:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 14:25 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 14:25 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 15:40 - 2013-10-26 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-20 03:21 - 2013-10-30 13:08 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-14 23:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 18:36 - 2014-08-14 18:35 - 32166680 _____ (Any-Video-Converter.com ) C:\Users\Corki\Downloads\avc-free-5.6.6.exe
2014-08-14 03:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 03:11 - 2013-07-13 18:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 03:07 - 2012-06-15 13:41 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 03:01 - 2014-05-09 22:15 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 00:27 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:21 - 2014-06-08 00:12 - 00019279 _____ () C:\Windows\DirectX.log
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2014-08-11 16:19 - 2014-08-11 16:19 - 00339968 _____ () C:\Users\Corki\Downloads\Warframe.msi
2014-08-11 01:37 - 2014-08-11 01:37 - 00000000 _____ () C:\Windows\SysWOW64\sho1B4B.tmp
2014-08-07 04:06 - 2014-08-13 17:52 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 17:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-04 18:33 - 2014-05-29 10:36 - 00000000 ____D () C:\Users\Corki\AppData\Local\Origin
2014-08-02 20:02 - 2011-10-04 12:39 - 00003226 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForSPEEDLINE_HP$
2014-08-02 20:02 - 2011-10-04 12:39 - 00000350 _____ () C:\Windows\Tasks\HPCeeScheduleForSPEEDLINE_HP$.job
2014-08-02 19:43 - 2014-08-02 19:43 - 00001176 _____ () C:\Users\Public\Desktop\Battlefield 3.lnk
2014-08-02 19:43 - 2014-08-02 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3
2014-08-02 19:43 - 2011-12-19 01:26 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-08-02 19:43 - 2011-12-19 01:26 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-08-02 19:43 - 2011-12-19 01:26 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-08-02 19:43 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
Some content of TEMP:
====================
C:\Users\Corki\AppData\Local\Temp\anvir.exe
C:\Users\Corki\AppData\Local\Temp\avgnt.exe
C:\Users\Corki\AppData\Local\Temp\HiPatchSelfUpdateWindow.exe
C:\Users\Corki\AppData\Local\Temp\HiRezLauncherControls.dll
C:\Users\Corki\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\Corki\AppData\Local\Temp\promote-upx.exe
C:\Users\Corki\AppData\Local\Temp\tmp6478.exe
C:\Users\Corki\AppData\Local\Temp\updatepackasc.exe
C:\Users\Corki\AppData\Local\Temp\YgoUpdater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-27 18:18
==================== End Of Log ============================ Addition Logfile: HTML-Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Corki at 2014-09-01 06:00:49
Running from C:\Users\Corki\Downloads\FRST-OlderVersion\FRST-OlderVersion\FRST-OlderVersion
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
Allods Online 4.0.02.43 (HKLM-x32\...\AstrumNival Allods) (Version: 4.0.02.43 - gPotato)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden
Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.16 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CPUID CPU-Z 1.67.1 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3210 - CyberLink Corp.)
CyberLink DVD Suite Deluxe (x32 Version: 7.0.3210 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Der Herr der Ringe Online v03.07.00.8037 (HKLM-x32\...\12bbe590-c890-11d9-9669-0800200c9a66_is1) (Version: 03.07.00.8037 - Turbine, Inc.)
devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 1.0 - devolo AG)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
dLAN Cockpit (x32 Version: 1.19.07 - devolo AG) Hidden
DVD Menu Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 4.2.4412 - Hewlett-Packard)
DVD Menu Pack for HP MediaSmart Video (x32 Version: 4.2.4412 - Hewlett-Packard) Hidden
EdenEternal-DE (HKLM-x32\...\EdenEternal-DE) (Version: - )
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Final Exam Early Access (HKLM-x32\...\Steam App 237130) (Version: - )
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.102 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hama Wireless LAN Adapter (HKLM-x32\...\{E91E8912-769D-42F0-8408-0E329443BABC}) (Version: 1.00.0000 - Hama)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
HP Auto (Version: 1.0.12494.3472 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.0.12656.3472 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Game Console (x32 Version: - WildTangent) Hidden
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.1.5 - WildTangent)
HP MAINSTREAM KEYBOARD (HKLM-x32\...\{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}) (Version: 1.4.3.0 - Hewlett-Packard)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 4.2.4725 - Hewlett-Packard)
HP MediaSmart DVD (x32 Version: 4.2.4725 - Hewlett-Packard) Hidden
HP MediaSmart Music (HKLM-x32\...\InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}) (Version: 4.2.4517 - Hewlett-Packard)
HP MediaSmart Music (x32 Version: 4.2.4517 - Hewlett-Packard) Hidden
HP MediaSmart Photo (HKLM-x32\...\InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}) (Version: 4.2.4513 - Hewlett-Packard)
HP MediaSmart Photo (x32 Version: 4.2.4513 - Hewlett-Packard) Hidden
HP MediaSmart SmartMenu (HKLM\...\{A40F60B1-F1E1-452E-96A5-FF97F9A2D102}) (Version: 3.1.2.4 - Hewlett-Packard)
HP MediaSmart Video (HKLM-x32\...\InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}) (Version: 4.2.4522 - Hewlett-Packard)
HP MediaSmart Video (x32 Version: 4.2.4522 - Hewlett-Packard) Hidden
HP Setup (HKLM-x32\...\{53469506-A37E-4314-A9D9-38724EC23A75}) (Version: 8.4.4400.3525 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.0.12844.3519 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{DE77FE3F-A33D-499A-87AD-5FC406617B40}) (Version: 5.002.003.003 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.1.6.0 - Hewlett-Packard)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6302.0 - IDT)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version: - Hammerpoint Interactive)
Insaniquarium Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.0.4.922 - IObit)
Java 7 Update 21 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417021FF}) (Version: 7.0.210 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java 8 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418000FF}) (Version: 8.0.0 - Oracle Corporation)
Java Auto Updater (x32 Version: 2.8.00.132 - Oracle, Inc.) Hidden
Java(TM) 6 Update 27 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416027FF}) (Version: 6.0.270 - Oracle)
Jewel Quest II (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3130 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.3130 - CyberLink Corp.) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LightScribe System Software (HKLM-x32\...\{FD7F0DB8-0E96-4D64-AD4D-9B5A936AF2A8}) (Version: 1.18.20.1 - LightScribe)
Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
Logitech Gaming Software (Version: 8.40.83 - Logitech Inc.) Hidden
Logitech Gaming Software 8.40 (HKLM\...\Logitech Gaming Software) (Version: 8.40.83 - Logitech Inc.)
LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.9.9 - www.leaguereplays.com)
LPT System Updater Service (x32 Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.1.177.0 - Microsoft Corporation) Hidden
Moorhuhn Kart 2 XXL (HKLM-x32\...\{7A2FD295-38D2-4AAF-BF41-2C95EBB96126}) (Version: - )
Moorhuhn Kart Extra XXL (HKLM-x32\...\{DE60CAE2-4CA8-4A6A-A557-0668004FE889}) (Version: - )
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Movie Theme Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 4.2.4412 - Hewlett-Packard)
Movie Theme Pack for HP MediaSmart Video (x32 Version: 4.2.4412 - Hewlett-Packard) Hidden
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MusicStation (HKLM-x32\...\MusicStationNetstaller) (Version: 1.0.1.5 - Hewlett-Packard)
NC Launcher (GameForge) (HKLM-x32\...\NCLauncher_GameForge) (Version: - NCsoft)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 326.01 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 326.01 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.23 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5936 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.23 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2723 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 327.23 (Version: 327.23 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.9 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 1.0.3.30295 - Grinding Gear Games)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version: - Grinding Gear Games)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r4600) (Version: - )
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.9 - PDF Complete, Inc)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.7717 - CyberLink Corp.) Hidden
PictureMover (HKLM-x32\...\{264FE20A-757B-492a-B0C3-4009E2997D8A}) (Version: 3.5.0.33 - Hewlett-Packard Company)
PlanetSide 2 (HKCU\...\soe-PlanetSide 2 PSG) (Version: 1.0.3.183 - Sony Online Entertainment)
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4329 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4329 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3129 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3129 - CyberLink Corp.) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
RaiderZ (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219436}_is1) (Version: 1.0.0.36787 - Gameforge)
Recovery Manager (x32 Version: 5.5.3219 - CyberLink Corp.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
ROCCAT Kone XTD Mouse Driver (HKLM-x32\...\{7133137D-DF48-4522-AD88-13C82B7D0A63}) (Version: - Roccat GmbH)
Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
SecondLifeViewer (remove only) (HKLM-x32\...\SecondLifeViewer) (Version: - )
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2247.4 - Hi-Rez Studios)
SPORE™ (HKLM-x32\...\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}) (Version: 1.02.0000 - Electronic Arts)
SPORE™ Süß & Schrecklich Ergänzungs-Pack (HKLM-x32\...\{C07F8D75-7A8D-400E-A8F9-A3F396B49BB1}) (Version: 1.00.0000 - Electronic Arts)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
TmUnitedForever (HKLM-x32\...\TmUnitedForever_is1) (Version: - Nadeo)
TrackMania United 0.2.0.8 (HKLM-x32\...\TmUnited_is1) (Version: - Nadeo)
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton)
Vindictus EU (HKLM-x32\...\Vindictus EU) (Version: - )
Virtual Audio Cable 4.10 (HKLM\...\Virtual Audio Cable 4.10) (Version: - )
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
War Thunder Launcher 1.0.1.335 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
War Thunder Launcher 1.0.1.336 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8b72e9}}_is1) (Version: - Gaijin Entertainment)
Warframe (HKLM-x32\...\{4265EC65-8B00-47C9-8688-24FD0FD8ED3D}) (Version: 1.0.0 - Digital Extremes)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
Zinio Reader 4 (HKLM-x32\...\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1) (Version: 4.0.3184 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.0.3184 - Zinio LLC) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3131910065-3854824008-1126967849-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Corki\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3131910065-3854824008-1126967849-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Corki\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3131910065-3854824008-1126967849-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Corki\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3131910065-3854824008-1126967849-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Corki\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3131910065-3854824008-1126967849-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Corki\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
31-08-2014 17:00:01 Windows-Sicherung
31-08-2014 21:29:39 Revo Uninstaller's restore point - Snap.Do
31-08-2014 21:39:18 Revo Uninstaller's restore point - Snap.Do Engine
01-09-2014 01:02:14 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.2.1012
01-09-2014 02:05:02 Revo Uninstaller's restore point - Avira Free Antivirus
01-09-2014 03:20:43 Windows Modules Installer
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-03-29 23:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {00C81739-A08E-4C56-A4A2-320847E5AD45} - \QtraxPlayer No Task File <==== ATTENTION
Task: {0DD9F833-99C6-4596-A243-5F216B49568D} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {1509FEFE-0A45-4F3C-9252-C44181C00DE3} - System32\Tasks\{78300E04-CBCE-4EF0-97ED-ECF6D66B480B} => Chrome.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
Task: {1A0EB7A0-470A-4CD0-88A9-078AB079D993} - System32\Tasks\HPCeeScheduleForSPEEDLINE_HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {2367F94F-9B9A-411E-9A77-3D1DB192095E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-01] (Adobe Systems Incorporated)
Task: {26D157B8-D47D-486C-BAB5-6756F092640C} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {33D2DABE-E8CD-43E5-B2BF-EE27C76453F6} - System32\Tasks\{10233D4A-6C0E-483A-8961-6016B4863411} => C:\Users\Corki\Downloads\setup_FluidSIM_MecLab_19.exe [2011-10-03] ()
Task: {3524866C-B344-4482-854D-B1D524FF38F2} - \DSite No Task File <==== ATTENTION
Task: {49EFE793-5B2E-4CF3-8CA3-84ED0AEBAF8C} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {50205732-64CF-476E-BA69-B123C0E65352} - System32\Tasks\{A20D444F-C731-4240-8068-0F8A3D858849} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.119.259/de/abandoninstall?source=lightinstaller&page=tsInstall&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;systemlevelpresent
Task: {5F97CB27-1B6D-48E6-8A1F-2C2636930E85} - System32\Tasks\Hewlett-Packard\HP Support Assistant\First Boot => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe [2013-11-04] (Hewlett-Packard Company)
Task: {6221C8D7-ECB9-4A96-981E-7FD20A699416} - System32\Tasks\HPCeeScheduleForCorki => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {6345A064-2C50-4DDA-B8F0-D0D911484094} - \DealPly No Task File <==== ATTENTION
Task: {6DB6D65B-CD0C-4D34-85F9-81F019D933AA} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: {71766A8F-4794-4304-A51D-468666614AE1} - System32\Tasks\{879C0237-06D7-47FD-9D49-F9AE1907D0D8} => C:\Users\Corki\Downloads\setup_FluidSIM_MecLab_19.exe [2011-10-03] ()
Task: {ADA81366-62F0-4D13-B4FA-A5A0E3D91623} - System32\Tasks\HPOSIAPP64 => C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe [2009-02-28] ()
Task: {B10E19AB-A117-49B8-A87C-D4DE151D23F8} - System32\Tasks\AnVir Task Manager => C:\Program Files (x86)\AnVir Task Manager Free\anvir.exe
Task: {B5132B36-E386-46C8-9836-61B55368F4B0} - System32\Tasks\{5F9B925C-8521-47EB-A62B-9A625E42F8A6} => C:\Riot Games\League of Legends\lol.launcher.exe [2013-06-12] ()
Task: {B5FABB95-707A-429E-B849-DC6CA7AD4CFC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-05] (Google Inc.)
Task: {B80837C6-09FE-4E7D-9BC2-F99CCC912F0F} - System32\Tasks\{B98D5539-E401-43F7-98FD-5EAFAD90C715} => C:\Users\Corki\Downloads\setup_FluidSIM_MecLab_19.exe [2011-10-03] ()
Task: {B87A16B6-377D-4E98-97BE-37DC0277CB0D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {C6E01C82-8C37-41FD-9646-B48E723A7417} - System32\Tasks\{99521F94-364C-49ED-A8F3-0C800F9186CD} => C:\Riot Games\League of Legends\lol.launcher.exe [2013-06-12] ()
Task: {CE20FB53-1E0B-4780-B9AD-CA72AFB6F41F} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {D1436E42-872B-4243-A9EA-F74D43F9C453} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-05] (Google Inc.)
Task: {D184898B-0809-42C1-99F5-67165654C54B} - System32\Tasks\{83A2DD81-ADA2-4672-8B50-84C8192D7D17} => C:\Users\Corki\Downloads\dotNetFx35setup.exe [2012-08-08] (Microsoft Corporation)
Task: {D7F8E428-AB3D-4750-9CAD-8CA7182195C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {D91FAF33-BB18-433D-A1E6-1C10B53075AA} - System32\Tasks\{060A3662-234E-48AC-96A6-E1C861CB370C} => C:\Users\Corki\Downloads\setup_FluidSIM_MecLab_19.exe [2011-10-03] ()
Task: {E3FA7199-1E6C-457D-8071-EFA1450F6260} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E5CFD553-FDBC-406A-BF8C-6165587C3C2B} - System32\Tasks\{D2216B41-3EE4-4E48-BB5C-D0EF5C948749} => C:\Riot Games\League of Legends\lol.launcher.exe [2013-06-12] ()
Task: {FB38BEF5-32B7-4393-8309-CC0EF8797432} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-09-27] ()
Task: {FC8DB7D9-A495-40B2-933E-FD55C678FE23} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {FF2FABCD-1EF6-4D5C-A880-3FFB315DD4B1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForSPEEDLINE_HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForCorki.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2013-09-04 22:55 - 2013-09-12 09:25 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-07-19 20:57 - 2010-07-19 20:57 - 02231616 _____ () C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
2014-04-08 11:26 - 2014-04-08 11:26 - 00037920 _____ () C:\Program Files (x86)\LPT\srpts.exe
2011-12-19 01:26 - 2014-08-02 19:43 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2011-12-19 01:26 - 2014-08-02 19:43 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2011-05-10 01:52 - 2009-02-28 04:13 - 00053248 _____ () C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
2012-01-10 15:41 - 2013-10-27 13:44 - 00567880 _____ () C:\Program Files (x86)\puush\puush.exe
2013-07-19 13:10 - 2013-07-19 13:10 - 01992328 _____ () C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe
2014-04-08 11:26 - 2014-04-08 11:26 - 00081952 _____ () C:\Program Files (x86)\LPT\srpt.dll
2014-04-08 11:26 - 2014-04-08 11:26 - 00023072 _____ () C:\Program Files (x86)\LPT\srptc.dll
2014-04-08 11:26 - 2014-04-08 11:26 - 00018976 _____ () C:\Program Files (x86)\LPT\Smartbar.Common.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00962560 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00024064 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00025088 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00217088 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00261632 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00019968 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00302592 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2014-05-29 10:36 - 2014-08-31 15:35 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2014-07-18 10:29 - 2014-07-18 10:29 - 00420352 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll
2013-03-31 13:13 - 2012-06-17 11:20 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\hiddriver.dll
2014-08-29 20:49 - 2014-08-28 06:54 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\libglesv2.dll
2014-08-29 20:49 - 2014-08-28 06:53 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\libegl.dll
2014-08-29 20:49 - 2014-08-28 06:54 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\pdf.dll
2014-08-29 20:49 - 2014-08-28 06:54 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\ppGoogleNaClPluginChrome.dll
2014-08-29 20:49 - 2014-08-28 06:53 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.102\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:AD022376
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Hama Wireless LAN Utility.lnk => C:\Windows\pss\Hama Wireless LAN Utility.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish PictureMover.lnk => C:\Windows\pss\Snapfish PictureMover.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Corki^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent
MSCONFIG\startupreg: AVG_UI => "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY
MSCONFIG\startupreg: BATINDICATOR => C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\BATINDICATOR.exe
MSCONFIG\startupreg: BeatsOSDApp => C:\Program Files\IDT\WDM\beats64.exe
MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_9ED998646215A7B2837127291A244E96 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: HP Software Update => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: Launch LCore => C:\Program Files\Logitech Gaming Software\LCore.exe /minimized
MSCONFIG\startupreg: LaunchHPOSIAPP => C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: Magic Desktop for HP notification => "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
MSCONFIG\startupreg: Nvtmru => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: SmartMenu => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: Sweetpacks Communicator => C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
MSCONFIG\startupreg: UnlockerAssistant => "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/01/2014 02:57:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.16.0.105 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11f4
Startzeit: 01cfc578fb3c66fb
Endzeit: 3
Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe
Berichts-ID:
Error: (09/01/2014 00:50:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.0.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1690
Startzeit: 01cfc56500226106
Endzeit: 3
Anwendungspfad: C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Berichts-ID:
Error: (08/29/2014 03:27:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Origin.exe, Version: 9.4.21.2812, Zeitstempel: 0x53f25743
Name des fehlerhaften Moduls: Origin.exe, Version: 9.4.21.2812, Zeitstempel: 0x53f25743
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c4e6
ID des fehlerhaften Prozesses: 0x15b0
Startzeit der fehlerhaften Anwendung: 0xOrigin.exe0
Pfad der fehlerhaften Anwendung: Origin.exe1
Pfad des fehlerhaften Moduls: Origin.exe2
Berichtskennung: Origin.exe3
Error: (08/26/2014 07:36:36 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (08/20/2014 03:41:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Hearthstone.exe, Version 1.1.0.6284 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1788
Startzeit: 01cfbc7c58e1c756
Endzeit: 55
Anwendungspfad: C:\Program Files (x86)\Hearthstone\Hearthstone.exe
Berichts-ID: b1ba0a99-286f-11e4-826c-e0699582c158
System errors:
=============
Error: (09/01/2014 05:50:39 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
hdhw
helo
kkrajfcv
qzzstw
ydnaa
Error: (09/01/2014 05:50:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "otshot" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/01/2014 05:24:06 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
hdhw
kkrajfcv
qzzstw
ydnaa
Error: (09/01/2014 05:23:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "otshot" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/01/2014 05:03:34 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
hdhw
kkrajfcv
qzzstw
ydnaa
Error: (09/01/2014 05:03:07 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "otshot" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/01/2014 04:42:32 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
hdhw
kkrajfcv
ydnaa
Error: (09/01/2014 04:42:10 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "otshot" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/01/2014 03:55:43 AM) (Source: iaStor) (EventID: 9) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.
Error: (09/01/2014 03:55:08 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
kkrajfcv
ydnaa
Microsoft Office Sessions:
=========================
Error: (09/01/2014 02:57:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.16.0.10511f401cfc578fb3c66fb3C:\Program Files (x86)\Skype\Phone\Skype.exe
Error: (09/01/2014 00:50:39 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: mbam.exe1.0.0.500169001cfc565002261063C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
Error: (08/29/2014 03:27:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Origin.exe9.4.21.281253f25743Origin.exe9.4.21.281253f25743c00000050002c4e615b001cfc38d01519879C:\Program Files (x86)\Origin\Origin.exeC:\Program Files (x86)\Origin\Origin.exe41540d47-2f80-11e4-b243-e0699582c158
Error: (08/26/2014 07:36:36 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (08/20/2014 03:41:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hearthstone.exe1.1.0.6284178801cfbc7c58e1c75655C:\Program Files (x86)\Hearthstone\Hearthstone.exeb1ba0a99-286f-11e4-826c-e0699582c158
CodeIntegrity Errors:
===================================
Date: 2014-03-29 22:19:50.906
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-03-29 22:19:50.853
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:36.356
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:36.329
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:36.301
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:36.272
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:25.810
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:25.783
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:25.755
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-06-11 19:26:25.728
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Unlocker\UnlockerDriver5.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 37%
Total physical RAM: 6126.53 MB
Available physical RAM: 3813.21 MB
Total Pagefile: 12251.24 MB
Available Pagefile: 9537.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:917.57 GB) (Free:526.67 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:13.84 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (SPORE) (CDROM) (Total:0.74 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 5AC84F54)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=917.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================ Viele Grüße, Corki. |
|
01.09.2014, 06:39
| #2 |
| /// the machine /// TB-Ausbilder    | PC läuft langsam, Textdatei lässt sich nicht löschen hi,
__________________Adware & Co. deinstallieren
Scan mit Combofix
__________________ |
|
01.09.2014, 16:15
| #3 |
| | PC läuft langsam, Textdatei lässt sich nicht löschen Hi, danke für die Antwort.
__________________Die Programme mit dem Zusatz Addition lassen sich im Uninstaller nicht auffinden. Hinzu kommt, dass Combofix nach Schritt 50 nicht mehr weiter arbeitet. Ich habe jetzt über 2 Stunden gewartet, aber es tut sich nichts :/ |
|
02.09.2014, 11:46
| #4 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen Dann versuch die Dinger über Windows normal zu deinstallieren. Combofix abbrechen, löschen, neu laden, nochmal versuchen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.09.2014, 16:59
| #5 |
| | PC läuft langsam, Textdatei lässt sich nicht löschen Also, ich kann den LPT System Updater Service und die Scheduled Tasks nirgends auf dem PC finden... Combofix habe ich jetzt zweimal neu runtergeladen und laufen lassen und es geht immer nur bis fertiggestellt stufe_50. Was auch seltsam ist: Wenn Combofix läuft, bricht meine W-Lan Verbindung ab, also ich habe kein Internet mehr. W-Lan stick raus und wieder rein und dann geht es wieder. Ist nur eine Anmerkung, vielleicht ist das ja auch normal. |
|
03.09.2014, 10:39
| #6 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> PC läuft langsam, Textdatei lässt sich nicht löschen |
|
03.09.2014, 16:13
| #7 | |
| | PC läuft langsam, Textdatei lässt sich nicht löschenZitat:
|
|
04.09.2014, 11:21
| #8 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen genau 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.09.2014, 16:29
| #9 |
| | PC läuft langsam, Textdatei lässt sich nicht löschenCode:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 04/09/2014 um 17:04:43
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Corki - SPEEDLINE_HP
# Gestartet von : C:\Users\Corki\Downloads\adwcleaner_3.309.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : LPTSystemUpdater
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\LPT
Ordner Gelöscht : C:\Users\Corki\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Corki\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Corki\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Corki\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Corki\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Corki\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Corki\Documents\PC Speed Maximizer
Datei Gelöscht : C:\Users\Corki\daemonprocess.txt
Datei Gelöscht : C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage
Datei Gelöscht : C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal
***** [ Tasks ] *****
Task Gelöscht : Dealply
Task Gelöscht : DSite
Task Gelöscht : QtraxPlayer
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Corki\Desktop\Search.lnk
Verknüpfung Desinfiziert : C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabMaint_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{997E3BFB-F821-411C-8B96-D61D415EC8FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44FC7A33-2E5C-48DC-B6F5-B81E8005D122}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{997E3BFB-F821-411C-8B96-D61D415EC8FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4B8D46C-4EEE-401B-8607-DC03025F34B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{27CE191D-733B-4450-AFCD-096D105288C3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit
Schlüssel Gelöscht : HKLM\SOFTWARE\InstallCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12BF94BD06C95F343A77631402B9556A
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2124D8A8CF720FD44866190AF560228E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A325ACED8CA4743A30127638591ADB
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\350D17402BD84234EAF7D32F08172D7C
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE8C5F419057E1478A654868CEE60B5
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4735D908D66E1BA46B6C2D7185A12B2B
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D8378E2DDAED3428720A631F6E3BF0
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A001B259DB7D694E818BE29B973992C
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BAE2EC163C6A68A48921573E0E7E199D
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C06C6662FA5B04646829E4A460857770
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CEEB3E14ABE8270419B0FD762E18F7C6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1B5E9A3BDB51349BF96E842C062D98
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FECBC2BC14DA6CD459BD59A041709836
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\16FE85B52F587794795A481CF9295697
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\254796BF4AC84B64891B61C529A2E23F
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3Vr5_ckK[...]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3N[...]
Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", false);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCounter", 0);
Zeile gelöscht : user_pref("extensions.helperbar.backPageDay", 25);
Zeile gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1400796695767");
Zeile gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
Zeile gelöscht : user_pref("extensions.helperbar.barcodeid", "127028");
Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "snapdoocybch");
Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\",\\\".search.yahoo.com\\\\\\/yhs\\\\\\/search?hspart=lkry\\\",\\\"www.only-apart[...]
Zeile gelöscht : user_pref("extensions.helperbar.fromautoupdate", "false");
Zeile gelöscht : user_pref("extensions.helperbar.installationid", "8af37651-0439-be27-86f6-116a5cd0213d");
Zeile gelöscht : user_pref("extensions.helperbar.installdate", "24/05/2014");
Zeile gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1400969495");
Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1409101330516");
Zeile gelöscht : user_pref("extensions.helperbar.publisher", "snapdoocyb");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0BoSdjO3Ztb1gBxHUOyHUDHFhUfOrhwuGqBAZnyy0zr27MLQz_aL5Lab3QJrPHxMPp3_5LtV461Dudoyw[...]
-\\ Google Chrome v37.0.2062.103
[ Datei : C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : cekcjpgehmohobmdiikfnopibipmgnml
Gelöscht [Extension] : dhkplhfnhceodhffomolpfigojocbpcb
*************************
AdwCleaner[R0].txt - [19620 octets] - [04/09/2014 14:09:50]
AdwCleaner[S0].txt - [17046 octets] - [04/09/2014 17:04:43]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [17107 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Corki on 04.09.2014 at 17:09:58,59
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho1B4B.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho2B5C.tmp
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Corki\AppData\Roaming\mozilla\firefox\profiles\ml1u9hrs.default\minidumps [3 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.09.2014 at 17:14:08,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Edit: Soll ich es dann nochmal mit Combofix probieren? |
|
05.09.2014, 10:00
| #10 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen Nö passt schon. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.09.2014, 08:19
| #11 |
| | PC läuft langsam, Textdatei lässt sich nicht löschen Eset Online Scanner läuft schon seit stolzen 10 Stunden, aber immerhin läuft er noch^^ Ist es normal, dass das so lange dauert? Ich bin mal gespannt, wie lange der noch braucht. Eset: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c256bfd2ed4e904cb1b26a536fe73c82
# engine=20016
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-05 03:13:14
# local_time=2014-09-05 05:13:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 259376 161559844 0 0
# scanned=314538
# found=43
# cleaned=0
# scan_time=9200
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srpt.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srpt.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=DACF7A43ADCE9AE4AD35075D46E89DBBBFB7D97F ft=1 fh=bba0fe6f55ae09fd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spbl.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\srbu.dll.vir"
sh=CD050DC163422C58EED7FA8F8942D861BD9ED6B5 ft=1 fh=73cadc4c7328be1d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=6AFD48E209016E5B0928DA35A0F383206629542E ft=1 fh=800e2df4756163bc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=9D6A05550D4EDAAE21426963E1D7E29B1128E6A3 ft=1 fh=03f53be6abe181a5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=359650C7CEBE8C147CC3A52B9746AB33F546D259 ft=1 fh=bc065b51744671b9 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=AF8E4B402FDD1252B8AD1A6F392E01CE017FCC2D ft=1 fh=1b562d08d2c329d2 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=2900AFF2E6279E11CFA1C94202C993EF0999F8E9 ft=1 fh=05be29e2431ae2cc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=ADC5A8D352C6B68C69F1999C71B39F546E0B6A59 ft=1 fh=6a51156b8cffa57a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=19DC837674578FA95327EE2C06C906BDFB64C440 ft=1 fh=84d2bf3110b45a14 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Roaming\OpenCandy\33383FAC29F948A7B1D017C030EC43EA\Installer.exe.vir"
sh=815CE918A2CF57F5E0A3A9346FD9A6F6B3D03D30 ft=1 fh=028c167410bf2336 vn="Win32/InstallCore.GI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exe"
sh=175A8A0C7650EF29B0E1AE7137F5F48FDFCD6588 ft=1 fh=deea2a09617af006 vn="Variante von Win32/AdWare.SpeedingUpMyPC.G Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\Temp\is1158881826\5204070_stp.EXE"
sh=055D14C8C32C5946CABE52519EE517923832C0C8 ft=1 fh=1608365a163b8a32 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avc-free-5.6.6.exe"
sh=99D2EA99C2B71797087BE9F1948D3606A1E2AA12 ft=1 fh=9ee0c8c2572ae7fd vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avira_free_antivirus_de_14.0.3.350.exe"
sh=EC38A071476860D3DA681052AF62B3BE377FEC73 ft=1 fh=68c299741b777df3 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (1).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (2).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (3).exe"
sh=3DF621DDBF63ABE9E8632D73EA87FDED137D71FB ft=1 fh=1c88a728f9455b03 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (4).exe"
sh=FA85DB367546515697172741B51A75A0DE498575 ft=1 fh=a4ac0d07a953f3fb vn="Win32/Conduit.SearchProtect.K evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter.exe"
sh=310FC83D948C7E28CA4604D63FFBC5E98E2AAD1A ft=1 fh=2db0ab73841f9ed6 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader (1).exe"
sh=89ADF6F040191019680458BA800DE0D5900126B9 ft=1 fh=8e85da63172fbe31 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader.exe"
sh=BFF8C66D5C8FD8ABE652CD1A6B1501D95FA16D0E ft=1 fh=c1001cbbdbe1d37f vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\LogMeIn Hamachi - CHIP-Installer.exe"
sh=E0EBCAF5F460151901F4151DAA4335225575BB99 ft=1 fh=badaf63b861d9aa3 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\MP3Gain - CHIP-Downloader.exe"
sh=ABD6CFDE0FCDD744A3EACC609F9C36BE860A516B ft=1 fh=8f7e84d301c6d77b vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (1).exe"
sh=770740A0A03DF764C2D4D3047809F28C365DDC23 ft=1 fh=5845e534cbf67f62 vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (2).exe"
sh=3890DD41BD63EA93FD63BE849D5A4ACF4C0D4EFB ft=1 fh=3fc95607c646dc19 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\TeamViewer - CHIP-Downloader.exe"
sh=E79EEEDF7254A368F254F406E9928C414428208C ft=1 fh=438b997b441854aa vn="Variante von Win32/AdWare.iBryte.AF Anwendung" ac=I fn="C:\Users\Corki\Downloads\torrent.exe"
sh=5DE3C90FFD48803B4E3924FF37DC7EB6E5FC3285 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\94677.msi"
sh=8C9C2A779C40E6FE3FAF38F4FCE8E3266842BD59 ft=0 fh=0000000000000000 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\9467e.msi"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c256bfd2ed4e904cb1b26a536fe73c82
# engine=20022
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-06 03:24:11
# local_time=2014-09-06 05:24:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 303233 161603701 0 0
# scanned=1203663
# found=43
# cleaned=0
# scan_time=22659
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srpt.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srpt.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=DACF7A43ADCE9AE4AD35075D46E89DBBBFB7D97F ft=1 fh=bba0fe6f55ae09fd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spbl.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\srbu.dll.vir"
sh=CD050DC163422C58EED7FA8F8942D861BD9ED6B5 ft=1 fh=73cadc4c7328be1d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=6AFD48E209016E5B0928DA35A0F383206629542E ft=1 fh=800e2df4756163bc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=9D6A05550D4EDAAE21426963E1D7E29B1128E6A3 ft=1 fh=03f53be6abe181a5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=359650C7CEBE8C147CC3A52B9746AB33F546D259 ft=1 fh=bc065b51744671b9 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=AF8E4B402FDD1252B8AD1A6F392E01CE017FCC2D ft=1 fh=1b562d08d2c329d2 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=2900AFF2E6279E11CFA1C94202C993EF0999F8E9 ft=1 fh=05be29e2431ae2cc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=ADC5A8D352C6B68C69F1999C71B39F546E0B6A59 ft=1 fh=6a51156b8cffa57a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=19DC837674578FA95327EE2C06C906BDFB64C440 ft=1 fh=84d2bf3110b45a14 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Roaming\OpenCandy\33383FAC29F948A7B1D017C030EC43EA\Installer.exe.vir"
sh=815CE918A2CF57F5E0A3A9346FD9A6F6B3D03D30 ft=1 fh=028c167410bf2336 vn="Win32/InstallCore.GI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exe"
sh=175A8A0C7650EF29B0E1AE7137F5F48FDFCD6588 ft=1 fh=deea2a09617af006 vn="Variante von Win32/AdWare.SpeedingUpMyPC.G Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\Temp\is1158881826\5204070_stp.EXE"
sh=055D14C8C32C5946CABE52519EE517923832C0C8 ft=1 fh=1608365a163b8a32 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avc-free-5.6.6.exe"
sh=99D2EA99C2B71797087BE9F1948D3606A1E2AA12 ft=1 fh=9ee0c8c2572ae7fd vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avira_free_antivirus_de_14.0.3.350.exe"
sh=EC38A071476860D3DA681052AF62B3BE377FEC73 ft=1 fh=68c299741b777df3 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (1).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (2).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (3).exe"
sh=3DF621DDBF63ABE9E8632D73EA87FDED137D71FB ft=1 fh=1c88a728f9455b03 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (4).exe"
sh=FA85DB367546515697172741B51A75A0DE498575 ft=1 fh=a4ac0d07a953f3fb vn="Win32/Conduit.SearchProtect.K evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter.exe"
sh=310FC83D948C7E28CA4604D63FFBC5E98E2AAD1A ft=1 fh=2db0ab73841f9ed6 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader (1).exe"
sh=89ADF6F040191019680458BA800DE0D5900126B9 ft=1 fh=8e85da63172fbe31 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader.exe"
sh=BFF8C66D5C8FD8ABE652CD1A6B1501D95FA16D0E ft=1 fh=c1001cbbdbe1d37f vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\LogMeIn Hamachi - CHIP-Installer.exe"
sh=E0EBCAF5F460151901F4151DAA4335225575BB99 ft=1 fh=badaf63b861d9aa3 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\MP3Gain - CHIP-Downloader.exe"
sh=ABD6CFDE0FCDD744A3EACC609F9C36BE860A516B ft=1 fh=8f7e84d301c6d77b vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (1).exe"
sh=770740A0A03DF764C2D4D3047809F28C365DDC23 ft=1 fh=5845e534cbf67f62 vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (2).exe"
sh=3890DD41BD63EA93FD63BE849D5A4ACF4C0D4EFB ft=1 fh=3fc95607c646dc19 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\TeamViewer - CHIP-Downloader.exe"
sh=E79EEEDF7254A368F254F406E9928C414428208C ft=1 fh=438b997b441854aa vn="Variante von Win32/AdWare.iBryte.AF Anwendung" ac=I fn="C:\Users\Corki\Downloads\torrent.exe"
sh=5DE3C90FFD48803B4E3924FF37DC7EB6E5FC3285 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\94677.msi"
sh=8C9C2A779C40E6FE3FAF38F4FCE8E3266842BD59 ft=0 fh=0000000000000000 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\9467e.msi"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c256bfd2ed4e904cb1b26a536fe73c82
# engine=20025
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-06 10:28:56
# local_time=2014-09-07 12:28:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 72477 161672386 0 0
# scanned=6555140
# found=43
# cleaned=0
# scan_time=61779
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srpt.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srbu.dll.vir"
sh=3B891FB4439090E525592DA51C74817DD028ABA2 ft=1 fh=977e1d7009e33685 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\LPT\srpt.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll.vir"
sh=B2AC265EEC4EED9029B2971C4B42A3CA0117CE3B ft=1 fh=c9e1d0648e2c6dec vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll.vir"
sh=DACF7A43ADCE9AE4AD35075D46E89DBBBFB7D97F ft=1 fh=bba0fe6f55ae09fd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spbl.dll.vir"
sh=EA22C913C8530E9BF265CE6BF15C3297B496359F ft=1 fh=db5b5695b2d8eabd vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\sppsm.dll.vir"
sh=D64BE51BC298BE6C853CEE912B5976ACC5DC56BB ft=1 fh=98537e06a52ce4c4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\spusm.dll.vir"
sh=958C81E92F36909177860DF7CE6C7AFB46386FC9 ft=1 fh=ad3a2a8565751473 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\srbu.dll.vir"
sh=CD050DC163422C58EED7FA8F8942D861BD9ED6B5 ft=1 fh=73cadc4c7328be1d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=6AFD48E209016E5B0928DA35A0F383206629542E ft=1 fh=800e2df4756163bc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_24.dll.vir"
sh=9D6A05550D4EDAAE21426963E1D7E29B1128E6A3 ft=1 fh=03f53be6abe181a5 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_25.dll.vir"
sh=359650C7CEBE8C147CC3A52B9746AB33F546D259 ft=1 fh=bc065b51744671b9 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=AF8E4B402FDD1252B8AD1A6F392E01CE017FCC2D ft=1 fh=1b562d08d2c329d2 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=2900AFF2E6279E11CFA1C94202C993EF0999F8E9 ft=1 fh=05be29e2431ae2cc vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=ADC5A8D352C6B68C69F1999C71B39F546E0B6A59 ft=1 fh=6a51156b8cffa57a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=19DC837674578FA95327EE2C06C906BDFB64C440 ft=1 fh=84d2bf3110b45a14 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Corki\AppData\Roaming\OpenCandy\33383FAC29F948A7B1D017C030EC43EA\Installer.exe.vir"
sh=815CE918A2CF57F5E0A3A9346FD9A6F6B3D03D30 ft=1 fh=028c167410bf2336 vn="Win32/InstallCore.GI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exe"
sh=175A8A0C7650EF29B0E1AE7137F5F48FDFCD6588 ft=1 fh=deea2a09617af006 vn="Variante von Win32/AdWare.SpeedingUpMyPC.G Anwendung" ac=I fn="C:\Users\Corki\AppData\Local\Temp\is1158881826\5204070_stp.EXE"
sh=055D14C8C32C5946CABE52519EE517923832C0C8 ft=1 fh=1608365a163b8a32 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avc-free-5.6.6.exe"
sh=99D2EA99C2B71797087BE9F1948D3606A1E2AA12 ft=1 fh=9ee0c8c2572ae7fd vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\avira_free_antivirus_de_14.0.3.350.exe"
sh=EC38A071476860D3DA681052AF62B3BE377FEC73 ft=1 fh=68c299741b777df3 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (1).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (2).exe"
sh=F92141EF608DA973E2F6CE5243DA083C11A54163 ft=1 fh=c71c001168966611 vn="Win32/InstallCore.ME evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (3).exe"
sh=3DF621DDBF63ABE9E8632D73EA87FDED137D71FB ft=1 fh=1c88a728f9455b03 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter (4).exe"
sh=FA85DB367546515697172741B51A75A0DE498575 ft=1 fh=a4ac0d07a953f3fb vn="Win32/Conduit.SearchProtect.K evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\FreeYouTubeToMP3Converter.exe"
sh=310FC83D948C7E28CA4604D63FFBC5E98E2AAD1A ft=1 fh=2db0ab73841f9ed6 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader (1).exe"
sh=89ADF6F040191019680458BA800DE0D5900126B9 ft=1 fh=8e85da63172fbe31 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\Java Runtime Environment 64 Bit - CHIP-Downloader.exe"
sh=BFF8C66D5C8FD8ABE652CD1A6B1501D95FA16D0E ft=1 fh=c1001cbbdbe1d37f vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\LogMeIn Hamachi - CHIP-Installer.exe"
sh=E0EBCAF5F460151901F4151DAA4335225575BB99 ft=1 fh=badaf63b861d9aa3 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\MP3Gain - CHIP-Downloader.exe"
sh=ABD6CFDE0FCDD744A3EACC609F9C36BE860A516B ft=1 fh=8f7e84d301c6d77b vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (1).exe"
sh=770740A0A03DF764C2D4D3047809F28C365DDC23 ft=1 fh=5845e534cbf67f62 vn="Win32/OutBrowse.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\setup (2).exe"
sh=3890DD41BD63EA93FD63BE849D5A4ACF4C0D4EFB ft=1 fh=3fc95607c646dc19 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Corki\Downloads\TeamViewer - CHIP-Downloader.exe"
sh=E79EEEDF7254A368F254F406E9928C414428208C ft=1 fh=438b997b441854aa vn="Variante von Win32/AdWare.iBryte.AF Anwendung" ac=I fn="C:\Users\Corki\Downloads\torrent.exe"
sh=5DE3C90FFD48803B4E3924FF37DC7EB6E5FC3285 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\94677.msi"
sh=8C9C2A779C40E6FE3FAF38F4FCE8E3266842BD59 ft=0 fh=0000000000000000 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\9467e.msi"
|
|
07.09.2014, 17:48
| #12 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen dann noch den Rest bitte
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.09.2014, 23:00
| #13 |
| | PC läuft langsam, Textdatei lässt sich nicht löschen Wie gesagt, bei Security Check kommt eine Fehlermeldung. FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2014 01
Ran by Corki (administrator) on SPEEDLINE_HP on 07-09-2014 21:40:26
Running from C:\Users\Corki\Downloads\FRST-OlderVersion\FRST-OlderVersion\FRST-OlderVersion
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
() C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files (x86)\puush\puush.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
() C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\mqtgsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.218\deploy\LoLLauncher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.2\deploy\LoLPatcher.exe
() C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.105\deploy\LolClient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.53\deploy\League of Legends.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [489472 2010-09-27] (IDT, Inc.)
HKLM\...\Run: [MsmqIntCert] => regsvr32 /s mqrt.dll
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [664600 2010-09-28] (PDF Complete Inc)
HKLM-x32\...\Run: [RoccatKoneXTD] => C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [558944 2012-11-30] (ROCCAT GmbH)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [KPeerNexonEU] => C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [438272 2013-07-19] (NEXON Inc.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2013-10-27] ()
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-08-31] (Electronic Arts)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [521216 2014-07-18] (LOL Replay)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Desktops
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name -> {b98ad8da-3cad-e9ae-132a-6e1efbb9a65c} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-05-10] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: z - C:\Program Files (x86)\Mozilla Firefox\extensions\{652f37d2-5d36-2a41-489e-6bc2164ee11e} [2014-07-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-07-08]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-05]
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> FDDED5A1A7CD04F89A2326AD258BECFDE31B1FC1CDB13339845AE615B744B8BB
CHR DefaultSearchURL: Default -> AE7A6153352D002BE91817E5B6F5CC4959BD918EB758BB0A609919E0E5439350
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\npBFHUpdater.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\BFHUpdater.exe No File
CHR Plugin: (NielsenOnline) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh\1.3.0_0\chrometracker.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Relevant-Knowledge) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0\plugins/rlcm.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-12-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (AdBlock) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-04]
CHR Extension: (Google Wallet) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-29]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2231616 2010-07-19] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-30] (IObit)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [9216 2009-07-14] (Microsoft Corporation)
R2 MSMQTriggers; C:\Windows\system32\mqtgsvc.exe [189440 2010-11-20] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1119768 2010-09-28] (PDF Complete Inc)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-08-02] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2014-08-02] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S2 otshot; C:\program files\otshot\ZalmanUpdateService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S0 hdhw; C:\Windows\SysWOW64\drivers\erfw.sys [61440 2014-09-01] () [File not signed]
S0 helo; C:\Windows\SysWOW64\drivers\ponr.sys [61440 2014-09-01] () [File not signed]
S0 kkrajfcv; C:\Windows\SysWOW64\drivers\rvpnn.sys [61440 2014-09-01] () [File not signed]
S3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
S3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [189440 2009-07-14] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S0 qzzstw; C:\Windows\SysWOW64\drivers\wthkc.sys [61440 2014-09-01] () [File not signed]
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S0 ydnaa; C:\Windows\SysWOW64\drivers\ebqoqsc.sys [61440 2014-09-01] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-07 10:55 - 2014-09-07 10:55 - 00002958 _____ () C:\Windows\System32\Tasks\{6EA205EA-12EC-4557-980D-B384DDD3C9E6}
2014-09-07 09:17 - 2014-09-07 09:17 - 00854417 _____ () C:\Users\Corki\Downloads\SecurityCheck (1).exe
2014-09-07 09:16 - 2014-09-07 09:16 - 00854417 _____ () C:\Users\Corki\Desktop\SecurityCheck.exe
2014-09-06 10:54 - 2014-09-06 10:55 - 01655080 _____ (techPowerUp (www.techpowerup.com)) C:\Users\Corki\Downloads\GPU-Z.0.7.9.exe
2014-09-05 14:36 - 2014-09-05 14:36 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-05 14:35 - 2014-09-05 14:35 - 02347384 _____ (ESET) C:\Users\Corki\Downloads\esetsmartinstaller_deu.exe
2014-09-04 17:14 - 2014-09-04 17:14 - 00000884 _____ () C:\Users\Corki\Desktop\JRT.txt
2014-09-04 17:09 - 2014-09-04 17:09 - 01016261 _____ (Thisisu) C:\Users\Corki\Downloads\JRT.exe
2014-09-04 14:09 - 2014-09-04 17:04 - 00000000 ____D () C:\AdwCleaner
2014-09-04 14:09 - 2014-09-04 14:09 - 01370483 _____ () C:\Users\Corki\Downloads\adwcleaner_3.309.exe
2014-09-02 17:47 - 2014-09-02 17:54 - 00000000 ___SD () C:\ComboFix
2014-09-01 14:28 - 2014-09-01 14:28 - 00000000 ____D () C:\Qoobox
2014-09-01 14:28 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-01 14:28 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-01 14:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 03:12 - 2014-09-04 17:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-01 03:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-01 03:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-01 03:11 - 2014-09-01 03:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 03:11 - 2014-09-01 03:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Corki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
2014-09-01 01:54 - 2014-09-01 05:00 - 00003608 _____ () C:\avenger.txt
2014-09-01 01:42 - 2014-09-01 01:42 - 00000000 ____D () C:\Users\Corki\Downloads\avenger
2014-09-01 01:41 - 2014-09-01 01:41 - 00724952 _____ () C:\Users\Corki\Downloads\avenger.zip
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-28 14:25 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 14:25 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 14:25 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 20:38 - 2014-08-26 20:38 - 01519241 _____ () C:\Users\Corki\Downloads\LOLReplay-0.8.9.9.exe
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-24 21:45 - 2014-08-24 21:45 - 01113077 _____ () C:\Users\Corki\Downloads\22433 (1).zip
2014-08-24 04:24 - 2014-08-24 04:24 - 00239907 _____ () C:\Users\Corki\Downloads\5415.zip
2014-08-14 18:35 - 2014-08-14 18:36 - 32166680 _____ (Any-Video-Converter.com ) C:\Users\Corki\Downloads\avc-free-5.6.6.exe
2014-08-14 03:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 03:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 03:02 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 03:02 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 03:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 18:04 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 18:04 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 18:04 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 18:04 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 18:04 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 18:04 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 18:04 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 18:04 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 18:04 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 18:04 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 18:04 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 18:04 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 18:04 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 18:04 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 18:04 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 18:04 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 18:04 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 18:04 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 18:04 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 18:04 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 18:00 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 17:57 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 17:57 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 17:57 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 17:57 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 17:57 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 17:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 17:52 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 17:52 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 17:52 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 17:52 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-11 16:20 - 2014-08-13 00:27 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2014-08-11 16:19 - 2014-08-11 16:19 - 00339968 _____ () C:\Users\Corki\Downloads\Warframe.msi
2014-08-09 18:25 - 2014-09-01 01:44 - 00216064 ___SH () C:\Users\Corki\Downloads\Thumbs.db
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-07 21:40 - 2014-04-23 15:23 - 00000000 ____D () C:\FRST
2014-09-07 21:35 - 2011-10-03 15:49 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Skype
2014-09-07 21:25 - 2012-10-30 17:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-07 20:46 - 2011-09-05 09:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-07 20:17 - 2012-08-30 18:16 - 00000000 ____D () C:\Users\Corki\AppData\Local\PMB Files
2014-09-07 18:46 - 2011-09-05 09:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-07 18:07 - 2011-05-10 01:52 - 00000000 ____D () C:\ProgramData\PDFC
2014-09-07 18:04 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-07 18:04 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-07 18:01 - 2011-05-10 01:43 - 01352819 _____ () C:\Windows\WindowsUpdate.log
2014-09-07 16:12 - 2012-02-19 15:54 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\TS3Client
2014-09-07 10:55 - 2014-09-07 10:55 - 00002958 _____ () C:\Windows\System32\Tasks\{6EA205EA-12EC-4557-980D-B384DDD3C9E6}
2014-09-07 09:17 - 2014-09-07 09:17 - 00854417 _____ () C:\Users\Corki\Downloads\SecurityCheck (1).exe
2014-09-07 09:16 - 2014-09-07 09:16 - 00854417 _____ () C:\Users\Corki\Desktop\SecurityCheck.exe
2014-09-06 10:55 - 2014-09-06 10:54 - 01655080 _____ (techPowerUp (www.techpowerup.com)) C:\Users\Corki\Downloads\GPU-Z.0.7.9.exe
2014-09-05 23:05 - 2012-08-30 18:16 - 00000000 ____D () C:\ProgramData\PMB Files
2014-09-05 22:44 - 2011-09-05 04:25 - 00000000 ____D () C:\Users\Corki\AppData\Local\CrashDumps
2014-09-05 14:36 - 2014-09-05 14:36 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-05 14:35 - 2014-09-05 14:35 - 02347384 _____ (ESET) C:\Users\Corki\Downloads\esetsmartinstaller_deu.exe
2014-09-04 22:13 - 2012-02-06 18:52 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForCorki
2014-09-04 22:13 - 2012-02-06 18:52 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForCorki.job
2014-09-04 17:17 - 2014-09-01 03:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-04 17:14 - 2014-09-04 17:14 - 00000884 _____ () C:\Users\Corki\Desktop\JRT.txt
2014-09-04 17:09 - 2014-09-04 17:09 - 01016261 _____ (Thisisu) C:\Users\Corki\Downloads\JRT.exe
2014-09-04 17:08 - 2014-05-24 23:05 - 00001360 _____ () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-09-04 17:08 - 2014-05-24 23:05 - 00001313 _____ () C:\Users\Corki\Desktop\Search.lnk
2014-09-04 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv
2014-09-04 17:06 - 2014-05-29 10:34 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-04 17:06 - 2013-12-28 18:35 - 00052550 _____ () C:\Windows\setupact.log
2014-09-04 17:05 - 2013-12-28 18:34 - 01131544 _____ () C:\Windows\PFRO.log
2014-09-04 17:05 - 2011-05-10 01:38 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-04 17:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-04 17:04 - 2014-09-04 14:09 - 00000000 ____D () C:\AdwCleaner
2014-09-04 17:04 - 2011-09-03 20:45 - 00000000 ____D () C:\Users\Corki
2014-09-04 14:09 - 2014-09-04 14:09 - 01370483 _____ () C:\Users\Corki\Downloads\adwcleaner_3.309.exe
2014-09-03 17:48 - 2011-09-05 09:19 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-03 17:08 - 2014-05-29 10:34 - 00000000 ____D () C:\ProgramData\Origin
2014-09-03 17:07 - 2013-12-30 13:23 - 00000000 ____D () C:\ProgramData\ProductData
2014-09-02 17:54 - 2014-09-02 17:47 - 00000000 ___SD () C:\ComboFix
2014-09-01 20:02 - 2011-10-04 12:39 - 00003226 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForSPEEDLINE_HP$
2014-09-01 20:02 - 2011-10-04 12:39 - 00000350 _____ () C:\Windows\Tasks\HPCeeScheduleForSPEEDLINE_HP$.job
2014-09-01 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-01 17:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-01 14:28 - 2014-09-01 14:28 - 00000000 ____D () C:\Qoobox
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 05:00 - 2014-09-01 01:54 - 00003608 _____ () C:\avenger.txt
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-09-01 03:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 03:11 - 2014-09-01 03:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Corki\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-01 02:12 - 2012-10-30 17:44 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-01 02:12 - 2012-10-30 17:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-01 02:12 - 2011-09-05 09:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 01:57 - 2013-07-13 14:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
2014-09-01 01:44 - 2014-08-09 18:25 - 00216064 ___SH () C:\Users\Corki\Downloads\Thumbs.db
2014-09-01 01:42 - 2014-09-01 01:42 - 00000000 ____D () C:\Users\Corki\Downloads\avenger
2014-09-01 01:41 - 2014-09-01 01:41 - 00724952 _____ () C:\Users\Corki\Downloads\avenger.zip
2014-09-01 01:03 - 2013-08-02 18:43 - 00000000 ____D () C:\Program Files (x86)\DevPro
2014-09-01 00:47 - 2013-04-01 10:48 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\YGOPro
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-29 15:26 - 2009-07-14 06:45 - 00472008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 04:56 - 2013-10-30 13:07 - 00000000 ____D () C:\Users\Corki\AppData\Local\Battle.net
2014-08-26 20:38 - 2014-08-26 20:38 - 01519241 _____ () C:\Users\Corki\Downloads\LOLReplay-0.8.9.9.exe
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-25 05:49 - 2014-04-14 21:59 - 00000941 _____ () C:\Users\Corki\Desktop\Open Broadcaster Software.lnk
2014-08-25 05:49 - 2014-04-14 21:59 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\OBS
2014-08-24 21:50 - 2012-06-20 18:33 - 00000000 ____D () C:\Users\Corki\Downloads\SIU 3.332-Lite
2014-08-24 21:45 - 2014-08-24 21:45 - 01113077 _____ () C:\Users\Corki\Downloads\22433 (1).zip
2014-08-24 04:24 - 2014-08-24 04:24 - 00239907 _____ () C:\Users\Corki\Downloads\5415.zip
2014-08-24 01:12 - 2013-10-30 13:07 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-23 04:07 - 2014-08-28 14:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 14:25 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 14:25 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 15:40 - 2013-10-26 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-20 03:21 - 2013-10-30 13:08 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-14 18:36 - 2014-08-14 18:35 - 32166680 _____ (Any-Video-Converter.com ) C:\Users\Corki\Downloads\avc-free-5.6.6.exe
2014-08-14 03:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 03:11 - 2013-07-13 18:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 03:07 - 2012-06-15 13:41 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 03:01 - 2014-05-09 22:15 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 00:27 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:21 - 2014-06-08 00:12 - 00019279 _____ () C:\Windows\DirectX.log
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2014-08-11 16:19 - 2014-08-11 16:19 - 00339968 _____ () C:\Users\Corki\Downloads\Warframe.msi
Some content of TEMP:
====================
C:\Users\Corki\AppData\Local\Temp\avgnt.exe
C:\Users\Corki\AppData\Local\Temp\Quarantine.exe
C:\Users\Corki\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-27 18:18
==================== End Of Log ============================
|
|
08.09.2014, 19:04
| #14 |
| /// the machine /// TB-Ausbilder | PC läuft langsam, Textdatei lässt sich nicht löschen Download Ordner leeren. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S0 qzzstw; C:\Windows\SysWOW64\drivers\wthkc.sys [61440 2014-09-01] () [File not signed]
S0 ydnaa; C:\Windows\SysWOW64\drivers\ebqoqsc.sys [61440 2014-09-01] () [File not signed]
C:\Windows\SysWOW64\drivers\wthkc.sys
C:\Windows\SysWOW64\drivers\ebqoqsc.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.09.2014, 01:52
| #15 |
| | PC läuft langsam, Textdatei lässt sich nicht löschen Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-09-2014 01
Ran by Corki at 2014-09-09 02:47:08 Run:1
Running from C:\Users\Corki\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S0 qzzstw; C:\Windows\SysWOW64\drivers\wthkc.sys [61440 2014-09-01] () [File not signed]
S0 ydnaa; C:\Windows\SysWOW64\drivers\ebqoqsc.sys [61440 2014-09-01] () [File not signed]
C:\Windows\SysWOW64\drivers\wthkc.sys
C:\Windows\SysWOW64\drivers\ebqoqsc.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ponr.sys
2014-09-01 05:48 - 2014-09-01 05:48 - 00000208 _____ () C:\Program Files (x86)\jjab.txt
2014-09-01 05:01 - 2014-09-01 05:01 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\wthkc.sys
2014-09-01 05:01 - 2014-09-01 05:01 - 00000206 _____ () C:\Program Files (x86)\ymbul.txt
2014-09-01 04:40 - 2014-09-01 04:40 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\erfw.sys
2014-09-01 04:40 - 2014-09-01 04:40 - 00000272 _____ () C:\Windows\tetqy.txt
2014-09-01 03:52 - 2014-09-01 03:52 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\rvpnn.sys
2014-09-01 03:52 - 2014-09-01 03:52 - 00000208 _____ () C:\sfhk.txt
2014-09-01 01:56 - 2014-09-01 01:56 - 00061440 _____ () C:\Windows\SysWOW64\Drivers\ebqoqsc.sys
2014-09-01 01:56 - 2014-09-01 01:56 - 00000218 _____ () C:\vkxe.txt
*****************
qzzstw => Service deleted successfully.
ydnaa => Service deleted successfully.
C:\Windows\SysWOW64\drivers\wthkc.sys => Moved successfully.
C:\Windows\SysWOW64\drivers\ebqoqsc.sys => Moved successfully.
C:\Windows\SysWOW64\Drivers\ponr.sys => Moved successfully.
C:\Program Files (x86)\jjab.txt => Moved successfully.
"C:\Windows\SysWOW64\Drivers\wthkc.sys" => File/Directory not found.
C:\Program Files (x86)\ymbul.txt => Moved successfully.
C:\Windows\SysWOW64\Drivers\erfw.sys => Moved successfully.
C:\Windows\tetqy.txt => Moved successfully.
C:\Windows\SysWOW64\Drivers\rvpnn.sys => Moved successfully.
C:\sfhk.txt => Moved successfully.
"C:\Windows\SysWOW64\Drivers\ebqoqsc.sys" => File/Directory not found.
C:\vkxe.txt => Moved successfully.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2014 01
Ran by Corki (administrator) on SPEEDLINE_HP on 09-09-2014 02:48:01
Running from C:\Users\Corki\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\Program Files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files (x86)\puush\puush.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
() C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [489472 2010-09-27] (IDT, Inc.)
HKLM\...\Run: [MsmqIntCert] => regsvr32 /s mqrt.dll
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [664600 2010-09-28] (PDF Complete Inc)
HKLM-x32\...\Run: [RoccatKoneXTD] => C:\Program Files (x86)\ROCCAT\Kone XTD Mouse\KoneXTDMonitor.EXE [558944 2012-11-30] (ROCCAT GmbH)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [KPeerNexonEU] => C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [438272 2013-07-19] (NEXON Inc.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [567880 2013-10-27] ()
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600216 2014-08-31] (Electronic Arts)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Run: [LOLReplay Recorder] => C:\Program Files (x86)\LOLReplay\LOLRecorder.exe [521216 2014-07-18] (LOL Replay)
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3131910065-3854824008-1126967849-1000\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {d944bb61-2e34-4dbf-a683-47e505c587dc} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-0/4?satitle={searchTerms}&mfe=Desktops
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name -> {b98ad8da-3cad-e9ae-132a-6e1efbb9a65c} -> No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-05-10] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Corki\AppData\Roaming\Mozilla\Firefox\Profiles\ml1u9hrs.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.0.2 -> C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: z - C:\Program Files (x86)\Mozilla Firefox\extensions\{652f37d2-5d36-2a41-489e-6bc2164ee11e} [2014-07-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-07-08]
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-04-05]
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchKeyword: Default -> FDDED5A1A7CD04F89A2326AD258BECFDE31B1FC1CDB13339845AE615B744B8BB
CHR DefaultSearchURL: Default -> AE7A6153352D002BE91817E5B6F5CC4959BD918EB758BB0A609919E0E5439350
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\npBFHUpdater.dll No File
CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.137.0_0\BFHUpdater.exe No File
CHR Plugin: (NielsenOnline) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh\1.3.0_0\chrometracker.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Relevant-Knowledge) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0\plugins/rlcm.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2013-12-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (AdBlock) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-04]
CHR Extension: (Google Wallet) - C:\Users\Corki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-29]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2231616 2010-07-19] ()
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-30] (IObit)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [9216 2009-07-14] (Microsoft Corporation)
R2 MSMQTriggers; C:\Windows\system32\mqtgsvc.exe [189440 2010-11-20] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1119768 2010-09-28] (PDF Complete Inc)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-08-02] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2014-08-02] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S2 otshot; C:\program files\otshot\ZalmanUpdateService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
S3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [189440 2009-07-14] (Microsoft Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S0 hdhw; system32\drivers\erfw.sys [X]
S0 helo; system32\drivers\ponr.sys [X]
S0 kkrajfcv; system32\drivers\rvpnn.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-09 02:48 - 2014-09-09 02:48 - 00017886 _____ () C:\Users\Corki\Downloads\FRST.txt
2014-09-09 02:44 - 2014-09-09 02:44 - 02105344 _____ (Farbar) C:\Users\Corki\Downloads\FRST64.exe
2014-09-07 10:55 - 2014-09-07 10:55 - 00002958 _____ () C:\Windows\System32\Tasks\{6EA205EA-12EC-4557-980D-B384DDD3C9E6}
2014-09-07 09:16 - 2014-09-07 09:16 - 00854417 _____ () C:\Users\Corki\Desktop\SecurityCheck.exe
2014-09-04 17:14 - 2014-09-04 17:14 - 00000884 _____ () C:\Users\Corki\Desktop\JRT.txt
2014-09-04 14:09 - 2014-09-04 17:04 - 00000000 ____D () C:\AdwCleaner
2014-09-02 17:47 - 2014-09-02 17:54 - 00000000 ___SD () C:\ComboFix
2014-09-01 14:28 - 2014-09-01 14:28 - 00000000 ____D () C:\Qoobox
2014-09-01 14:28 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-01 14:28 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-01 14:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-01 14:28 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-01 03:12 - 2014-09-04 17:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-01 03:12 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-01 03:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-01 03:11 - 2014-09-01 03:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 01:54 - 2014-09-01 05:00 - 00003608 _____ () C:\avenger.txt
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-28 14:25 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 14:25 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 14:25 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-14 03:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 03:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 03:02 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 03:02 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 03:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 03:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 18:04 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 18:04 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 18:04 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 18:04 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 18:04 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 18:04 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 18:04 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 18:04 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 18:04 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 18:04 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 18:04 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 18:04 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 18:04 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 18:04 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 18:04 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 18:04 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 18:04 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 18:04 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 18:04 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 18:04 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 18:04 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 18:04 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 18:04 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 18:04 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 18:04 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 18:04 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 18:04 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 18:04 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 18:04 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 18:04 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 18:04 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 18:04 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 18:04 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 18:04 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 18:04 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 18:04 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 18:04 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 18:00 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 18:00 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 18:00 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 17:57 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 17:57 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 17:57 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 17:57 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 17:57 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:57 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 17:57 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 17:57 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 17:57 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 17:52 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 17:52 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 17:52 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 17:52 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-11 16:20 - 2014-08-13 00:27 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-09 02:49 - 2014-09-09 02:48 - 00017886 _____ () C:\Users\Corki\Downloads\FRST.txt
2014-09-09 02:48 - 2014-04-23 15:23 - 00000000 ____D () C:\FRST
2014-09-09 02:46 - 2011-09-05 09:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-09 02:44 - 2014-09-09 02:44 - 02105344 _____ (Farbar) C:\Users\Corki\Downloads\FRST64.exe
2014-09-09 02:40 - 2014-08-09 18:25 - 00503296 ___SH () C:\Users\Corki\Downloads\Thumbs.db
2014-09-09 02:37 - 2011-10-03 15:49 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Skype
2014-09-09 02:25 - 2012-10-30 17:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-09 00:58 - 2012-08-30 18:16 - 00000000 ____D () C:\Users\Corki\AppData\Local\PMB Files
2014-09-08 22:13 - 2012-02-06 18:52 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForCorki
2014-09-08 22:13 - 2012-02-06 18:52 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForCorki.job
2014-09-08 18:46 - 2011-09-05 09:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-08 13:08 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-08 13:08 - 2009-07-14 06:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-08 13:03 - 2011-05-10 01:43 - 01406251 _____ () C:\Windows\WindowsUpdate.log
2014-09-08 12:35 - 2014-05-29 10:34 - 00000000 ____D () C:\ProgramData\Origin
2014-09-08 12:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv
2014-09-08 12:34 - 2013-12-30 13:23 - 00000000 ____D () C:\ProgramData\ProductData
2014-09-08 12:34 - 2013-12-28 18:35 - 00052718 _____ () C:\Windows\setupact.log
2014-09-08 12:33 - 2014-05-29 10:34 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-08 12:33 - 2013-12-28 18:34 - 01132362 _____ () C:\Windows\PFRO.log
2014-09-08 12:33 - 2011-05-10 01:38 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-08 12:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-08 00:00 - 2012-02-19 15:54 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\TS3Client
2014-09-07 18:07 - 2011-05-10 01:52 - 00000000 ____D () C:\ProgramData\PDFC
2014-09-07 10:55 - 2014-09-07 10:55 - 00002958 _____ () C:\Windows\System32\Tasks\{6EA205EA-12EC-4557-980D-B384DDD3C9E6}
2014-09-07 09:16 - 2014-09-07 09:16 - 00854417 _____ () C:\Users\Corki\Desktop\SecurityCheck.exe
2014-09-05 23:05 - 2012-08-30 18:16 - 00000000 ____D () C:\ProgramData\PMB Files
2014-09-05 22:44 - 2011-09-05 04:25 - 00000000 ____D () C:\Users\Corki\AppData\Local\CrashDumps
2014-09-04 17:17 - 2014-09-01 03:12 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-04 17:14 - 2014-09-04 17:14 - 00000884 _____ () C:\Users\Corki\Desktop\JRT.txt
2014-09-04 17:08 - 2014-05-24 23:05 - 00001360 _____ () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-09-04 17:08 - 2014-05-24 23:05 - 00001313 _____ () C:\Users\Corki\Desktop\Search.lnk
2014-09-04 17:04 - 2014-09-04 14:09 - 00000000 ____D () C:\AdwCleaner
2014-09-04 17:04 - 2011-09-03 20:45 - 00000000 ____D () C:\Users\Corki
2014-09-03 17:48 - 2011-09-05 09:19 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-02 17:54 - 2014-09-02 17:47 - 00000000 ___SD () C:\ComboFix
2014-09-01 20:02 - 2011-10-04 12:39 - 00003226 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForSPEEDLINE_HP$
2014-09-01 20:02 - 2011-10-04 12:39 - 00000350 _____ () C:\Windows\Tasks\HPCeeScheduleForSPEEDLINE_HP$.job
2014-09-01 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-01 17:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-01 14:28 - 2014-09-01 14:28 - 00000000 ____D () C:\Qoobox
2014-09-01 05:00 - 2014-09-01 01:54 - 00003608 _____ () C:\avenger.txt
2014-09-01 03:12 - 2014-09-01 03:12 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-01 03:12 - 2014-09-01 03:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-01 03:12 - 2014-09-01 03:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-01 02:12 - 2012-10-30 17:44 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-01 02:12 - 2012-10-30 17:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-01 02:12 - 2011-09-05 09:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 01:57 - 2013-07-13 14:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-01 01:03 - 2013-08-02 18:43 - 00000000 ____D () C:\Program Files (x86)\DevPro
2014-09-01 00:47 - 2013-04-01 10:48 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\YGOPro
2014-08-31 23:50 - 2014-08-31 23:50 - 00000017 _____ () C:\Users\Corki\AppData\Local\resmon.resmoncfg
2014-08-29 15:26 - 2009-07-14 06:45 - 00472008 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 04:56 - 2013-10-30 13:07 - 00000000 ____D () C:\Users\Corki\AppData\Local\Battle.net
2014-08-26 20:38 - 2014-08-26 20:38 - 00001919 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00001907 _____ () C:\Users\Public\Desktop\LOL Recorder.lnk
2014-08-26 20:38 - 2014-08-26 20:38 - 00000000 ____D () C:\Program Files (x86)\LOLReplay
2014-08-25 05:49 - 2014-04-14 21:59 - 00000941 _____ () C:\Users\Corki\Desktop\Open Broadcaster Software.lnk
2014-08-25 05:49 - 2014-04-14 21:59 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\OBS
2014-08-24 01:12 - 2013-10-30 13:07 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-23 04:07 - 2014-08-28 14:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 14:25 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 14:25 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 15:40 - 2013-10-26 13:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-20 03:21 - 2013-10-30 13:08 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-08-14 03:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 03:11 - 2013-07-13 18:34 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 03:07 - 2012-06-15 13:41 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 03:01 - 2014-05-09 22:15 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 00:27 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Local\Warframe
2014-08-11 16:21 - 2014-06-08 00:12 - 00019279 _____ () C:\Windows\DirectX.log
2014-08-11 16:20 - 2014-08-11 16:20 - 00002319 _____ () C:\Users\Corki\Desktop\Warframe.lnk
2014-08-11 16:20 - 2014-08-11 16:20 - 00000000 ____D () C:\Users\Corki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
Some content of TEMP:
====================
C:\Users\Corki\AppData\Local\Temp\avgnt.exe
C:\Users\Corki\AppData\Local\Temp\Quarantine.exe
C:\Users\Corki\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-08 15:50
==================== End Of Log ============================
--- --- --- Keine Probleme mehr, PC läuft wieder mit normaler Geschwindigkeit Vielen, vielen Dank! |
|
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
WARNUNG an die MITLESER: 
Linear-Darstellung
