| |
| |||||||
Log-Analyse und Auswertung: Werbe-Spams Internet Explorer und Reaktionsprobleme Win8Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
02.09.2014, 17:39
| #1 |
 |  Werbe-Spams Internet Explorer und Reaktionsprobleme Win8 Hallo Liebes Trojaner Board Team! Ich bekomme im Internet Explorer ständig diese nervigen Werbe-Banner. Der Laptop gehört der Schwiegermutter und sie ist ein Anfänger in Sachen Computer  Zusätzlich funktionieren die Websites einfach nicht. PC lädt zwar die Seite komplett aber es lassen sich keine Artikel auswählen bzw. Buttons klicken. Mann muss die Seite 2-3 mal neu laden bis sie dann einwandfrei funktioniert. Habe dich Log Dateien laut Checkliste erstellt: defogger_disable.txt Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:08 on 02/09/2014 (Karin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Karin (administrator) on KNEIDINGER on 02-09-2014 18:11:00
Running from C:\Users\Karin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R32EUG6O
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe
(Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2890640 2013-04-22] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13550152 2013-05-30] (Realtek Semiconductor)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-15] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] ( (Atheros Communications))
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-2038010720-557612607-978313770-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-2038010720-557612607-978313770-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM - DefaultScope {F6AF832B-A36D-4B21-9874-3502757735F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://at.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM - {F6AF832B-A36D-4B21-9874-3502757735F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - DefaultScope {F6AF832B-A36D-4B21-9874-3502757735F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://at.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 - {F6AF832B-A36D-4B21-9874-3502757735F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - DefaultScope {F6AF832B-A36D-4B21-9874-3502757735F8} URL =
SearchScopes: HKCU - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL =
SearchScopes: HKCU - {F6AF832B-A36D-4B21-9874-3502757735F8} URL =
BHO: Speed Test Analysis -> {310D38FE-EB4C-467C-8781-B7C2AEB7847D} -> C:\Program Files (x86)\Speed Test Analysis\ScriptHost64.dll (SpeedAnalysis.com)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: No Name -> {0f21b1e5-5afc-43c9-9c66-515046e92ec2} -> No File
BHO-x32: Speed Test Analysis -> {310D38FE-EB4C-467C-8781-B7C2AEB7847D} -> C:\Program Files (x86)\Speed Test Analysis\ScriptHost.dll (SpeedAnalysis.com)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF HKLM-x32\...\Firefox\Extensions: [speedtestanalysis@SpeedAnalysis.com] - C:\Users\Karin\AppData\Roaming\Mozilla\Extensions\speedtestanalysis@SpeedAnalysis.com
FF Extension: Speed Test Analysis - C:\Users\Karin\AppData\Roaming\Mozilla\Extensions\speedtestanalysis@SpeedAnalysis.com [2013-12-14]
FF HKCU\...\Firefox\Extensions: [speedtestanalysis@SpeedAnalysis.com] - C:\Users\Karin\AppData\Roaming\Mozilla\Extensions\speedtestanalysis@SpeedAnalysis.com
Chrome:
=======
CHR Profile: C:\Users\Karin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (SaveSense) - C:\Users\Karin\AppData\Local\Google\Chrome\User Data\Default\Extensions\khcceooakamlehbimaepcldnnlnkcmfk [2013-12-14]
CHR HKLM-x32\...\Chrome\Extension: [kckgnnipheglejoddfhekdjpbdbinhmb] - C:\Users\Karin\AppData\Roaming\SpeedTestAnalysis\SpeedTestAnalysis.crx [2013-09-30]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-15] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-27] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [470056 2013-05-01] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2013-04-22] (ELAN Microelectronics Corp.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-01-14] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [431656 2013-06-18] (Acer Incorporate)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4230016 2013-01-28] (Symantec Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0403000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-01-10] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [15704 2013-01-10] (Acer Incorporated)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-02 18:10 - 2014-09-02 18:11 - 00000000 ____D () C:\FRST
2014-09-02 18:08 - 2014-09-02 18:08 - 00000472 _____ () C:\Users\Karin\Desktop\defogger_disable.log
2014-09-02 18:08 - 2014-09-02 18:08 - 00000244 _____ () C:\Users\Karin\Desktop\defogger_enable.log
2014-08-31 10:13 - 2014-08-31 10:13 - 00002287 _____ () C:\Users\Karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acer Games.lnk
2014-08-31 10:13 - 2014-08-31 10:13 - 00002113 _____ () C:\Users\Karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2014-08-30 12:11 - 2014-08-30 12:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-30 12:00 - 2014-08-30 12:00 - 00004150 _____ () C:\Users\Karin\Downloads\JRT.txt
2014-08-30 12:00 - 2014-08-30 12:00 - 00004150 _____ () C:\Users\Karin\Desktop\JRT.txt
2014-08-30 11:54 - 2014-08-30 11:54 - 00000000 ____D () C:\Windows\ERUNT
2014-08-22 21:41 - 2014-05-15 03:02 - 00059424 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-22 21:41 - 2014-05-15 00:43 - 03286528 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-22 21:41 - 2014-05-15 00:43 - 01623040 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-22 21:41 - 2014-05-15 00:43 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-08-22 21:41 - 2014-05-15 00:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-08-20 12:17 - 2014-08-20 12:17 - 00012800 ___SH () C:\Users\Karin\Downloads\Thumbs.db
2014-08-17 22:30 - 2014-07-16 00:51 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-08-17 22:25 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-17 22:25 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 20:57 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 20:57 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-15 20:56 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-15 20:56 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-15 20:56 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-15 20:56 - 2014-07-24 14:10 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-08-15 20:56 - 2014-07-24 14:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-15 20:56 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-15 20:56 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-15 20:56 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-15 20:56 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-15 20:56 - 2014-07-24 12:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-15 20:56 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-15 20:56 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-15 20:56 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-15 20:56 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-15 20:56 - 2014-07-24 10:03 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-08-15 20:56 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-15 20:56 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-15 20:56 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 20:56 - 2014-06-05 19:30 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-08-15 20:56 - 2014-06-05 19:29 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 20:56 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 20:56 - 2014-06-05 19:28 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 20:56 - 2014-06-05 19:28 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-08-15 20:56 - 2014-06-05 15:12 - 08857600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-08-15 20:56 - 2014-06-05 15:11 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 20:56 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 20:56 - 2014-06-05 15:10 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 20:56 - 2014-06-05 15:10 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-08-15 20:56 - 2014-05-29 06:04 - 00094552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2014-08-15 20:56 - 2014-05-08 03:34 - 00328024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-08-15 20:55 - 2014-08-07 08:33 - 00712192 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-15 20:55 - 2014-08-07 05:09 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-09 09:34 - 2014-08-19 22:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-02 18:11 - 2014-09-02 18:10 - 00000000 ____D () C:\FRST
2014-09-02 18:08 - 2014-09-02 18:08 - 00000472 _____ () C:\Users\Karin\Desktop\defogger_disable.log
2014-09-02 18:08 - 2014-09-02 18:08 - 00000244 _____ () C:\Users\Karin\Desktop\defogger_enable.log
2014-09-02 18:08 - 2013-12-13 15:50 - 00000000 ____D () C:\Users\Karin
2014-09-02 18:01 - 2013-11-21 10:11 - 01784996 _____ () C:\Windows\WindowsUpdate.log
2014-09-02 18:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-09-01 17:59 - 2013-12-13 15:50 - 00000000 ____D () C:\Users\Karin\AppData\Local\Pokki
2014-08-31 21:04 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-08-31 20:56 - 2013-12-14 10:56 - 00000314 _____ () C:\Windows\Tasks\SaveSense.job
2014-08-31 10:23 - 2013-12-14 10:42 - 00002283 _____ () C:\Users\Karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-08-31 10:13 - 2014-08-31 10:13 - 00002287 _____ () C:\Users\Karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acer Games.lnk
2014-08-31 10:13 - 2014-08-31 10:13 - 00002113 _____ () C:\Users\Karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Start Menu.lnk
2014-08-30 12:11 - 2014-08-30 12:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-30 12:00 - 2014-08-30 12:00 - 00004150 _____ () C:\Users\Karin\Downloads\JRT.txt
2014-08-30 12:00 - 2014-08-30 12:00 - 00004150 _____ () C:\Users\Karin\Desktop\JRT.txt
2014-08-30 11:54 - 2014-08-30 11:54 - 00000000 ____D () C:\Windows\ERUNT
2014-08-27 20:15 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-08-20 13:20 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-08-20 12:17 - 2014-08-20 12:17 - 00012800 ___SH () C:\Users\Karin\Downloads\Thumbs.db
2014-08-20 12:03 - 2013-11-21 18:50 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-08-20 12:03 - 2013-11-21 18:50 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-08-20 12:03 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-19 22:45 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-19 22:42 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-08-19 22:39 - 2014-08-09 09:34 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-19 22:39 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-08-19 22:39 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\WinStore
2014-08-17 22:42 - 2013-12-25 12:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-17 22:40 - 2013-12-25 12:25 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-09 09:36 - 2013-10-15 09:15 - 00127700 _____ () C:\Windows\PFRO.log
2014-08-07 21:39 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-08-07 08:33 - 2014-08-15 20:55 - 00712192 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 05:09 - 2014-08-15 20:55 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\Karin\AppData\Local\Temp\avgnt.exe
C:\Users\Karin\AppData\Local\Temp\COMAP.EXE
C:\Users\Karin\AppData\Local\Temp\FreeZip920.exe
C:\Users\Karin\AppData\Local\Temp\install_helper.exe
C:\Users\Karin\AppData\Local\Temp\oct1E2F.tmp.exe
C:\Users\Karin\AppData\Local\Temp\octC7D9.tmp.exe
C:\Users\Karin\AppData\Local\Temp\sas.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-20 12:39
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Karin at 2014-09-02 18:12:14
Running from C:\Users\Karin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R32EUG6O
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
clear.fi SDK - Video 2 (x32 Version: 2.1.2606 - CyberLink Corp.) Hidden
clear.fi SDK- Movie 2 (x32 Version: 2.1.2606 - CyberLink Corp.) Hidden
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3013 - Acer Incorporated)
Acer Games (HKCU\...\Pokki_03d432a7e610c3e908213e7689d4342ce2111caf) (Version: 1.1.7.42206 - Pokki)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.3005 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3013 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3016 - Acer Incorporated)
AcerCloud Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.01.2008 - Acer Incorporated)
AcerCloud Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.02.2022 - Acer Incorporated)
Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{123A22CB-6D84-4135-A71F-886C9119E996}) (Version: 99.9 - Eyeo GmbH)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Broadcom Card Reader Driver Installer (HKLM\...\{67AA948F-8D83-4566-B84A-7CAABCF64E3F}) (Version: 16.0.2.6 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{D1D7ED66-5C08-40A0-AEC0-B6DF977697BB}) (Version: 16.0.2.4 - Broadcom Corporation)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.02.2012 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.02.2016 - Acer Incorporated)
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
eBay Worldwide (HKLM-x32\...\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM)
ETDWare PS/2-X64 11.6.23.203_WHQL (HKLM\...\Elantech) (Version: 11.6.23.203 - ELAN Microelectronic Corp.)
Free Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - Somoto Ltd) <==== ATTENTION
Google Update Helper (x32 Version: 1.3.23.0 - SaveSense) Hidden <==== ATTENTION
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Host App Service (HKCU\...\Pokki) (Version: 0.269.3.181 - Pokki)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3006 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.30.1349 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2963 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.4.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.757.1 - Intel Corporation) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3010 - Acer Incorporated)
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Math Problem Solver (HKCU\...\Math Problem Solver) (Version: - ) <==== ATTENTION
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Nero BackItUp (x32 Version: 12.5.5000 - Nero AG) Hidden
Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{4CA8F973-6377-4ABF-9ED5-CC2323B3C000}) (Version: 12.5.00500 - Nero AG)
Nero BackItUp Help (CHM) (x32 Version: 12.0.10000 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.15600 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.20200 - Nero AG) Hidden
Nero Launcher (x32 Version: 12.2.7000 - Nero AG) Hidden
Nero RescueAgent (x32 Version: 12.0.3001 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.7.0.24 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.3.0.14 - Symantec Corporation) Hidden
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.02.2008 - Acer)
Office Addin 2003 (HKLM-x32\...\{1FCC073B-CC01-4443-AD20-E559F66E6E83}) (Version: 2.02.2008 - Acer)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Pokki Start Menu (HKCU\...\Pokki_Start_Menu) (Version: 0.269.3.181 - )
Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6927 - Realtek Semiconductor Corp.)
SaveSense (HKCU\...\SaveSense) (Version: - SaveSense) <==== ATTENTION
SaveSense (remove only) (HKLM-x32\...\SaveSense) (Version: 5.3.0.6 - SaveSense) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Speed Test Analysis (HKLM-x32\...\Speed Test Analysis) (Version: 1.0.0.5 - Speed Analysis) <==== ATTENTION
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.4.99.ga249b5f1 - Spotify AB)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
22-05-2014 19:44:17 Windows Update
12-06-2014 19:49:22 Windows Update
14-07-2014 15:20:07 Windows Update
18-07-2014 21:20:38 Windows Update
07-08-2014 19:37:51 Windows Update
17-08-2014 20:23:27 Windows Update
22-08-2014 19:38:07 Windows Update
30-08-2014 10:11:07 Installed Adblock Plus for IE (32-bit and 64-bit)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1CA96768-E6CC-4E70-9275-1CD8D1CB302D} - System32\Tasks\SaveSense => C:\Users\Karin\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {4CCB6EB5-A2EE-41A9-AC5D-F4108358B7DD} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {A56DF548-3892-4F47-8DEC-242CE2092779} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2013-03-15] (Acer Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {B292DDA5-3F0B-4F41-901B-264E02CFB387} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-08-17] (Microsoft Corporation)
Task: {B5A63E71-35B2-4DC2-94F2-DE9E1AEC3118} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-03-13] ()
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CC816502-C452-45B0-9D15-44B358C5D2A3} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {EBE022A8-B96D-4C06-A7D9-EB01BF78511F} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2013-06-18] (Acer Incorporate)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {F7190960-4987-4D67-A92B-2A5684922365} - System32\Tasks\Math Problem Solver CPU => C:\Users\Karin\AppData\Local\Math Problem Solver\cpu\Solve.exe [2013-07-10] () <==== ATTENTION
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Karin\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2013-10-15 09:32 - 2013-07-02 09:43 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-09-07 02:48 - 2013-09-07 02:48 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 02:45 - 2013-09-07 02:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-10-15 10:11 - 2013-01-16 22:27 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-07 02:52 - 2013-09-07 02:52 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-09-30 11:32 - 2013-09-30 11:32 - 00333632 _____ () C:\Program Files (x86)\Speed Test Analysis\ButtonSite64.dll
2013-09-30 11:32 - 2013-09-30 11:32 - 00475456 _____ () C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe
2013-11-21 10:19 - 2013-01-14 20:25 - 01200088 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKCU\...\StartupApproved\Run: => "Pokki"
HKCU\...\StartupApproved\Run: => "Skype"
==================== Faulty Device Manager Devices =============
Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/02/2014 05:57:47 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (08/30/2014 00:14:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.17054 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 3aec
Startzeit: 01cfc43b11273b95
Endzeit: 4
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: 68f74ddb-302e-11e4-be87-201a06b141f2
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (09/02/2014 05:57:47 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (08/30/2014 00:14:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE10.0.9200.170543aec01cfc43b11273b954C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE68f74ddb-302e-11e4-be87-201a06b141f2
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz
Percentage of memory in use: 42%
Total physical RAM: 3985.27 MB
Available physical RAM: 2288.25 MB
Total Pagefile: 4689.27 MB
Available Pagefile: 2685.74 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:683.19 GB) (Free:636.08 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 64B2CE2E)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter MER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-02 18:21:03
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000037 TOSHIBA_MQ01ABD075 rev.AX003J 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Karin\AppData\Local\Temp\pgddyuod.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\System32\dwm.exe[12996] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\System32\dwm.exe[12996] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\System32\dwm.exe[12996] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\System32\dwm.exe[12996] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\system32\taskhostex.exe[7420] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\system32\taskhostex.exe[7420] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\system32\taskhostex.exe[7420] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\system32\taskhostex.exe[7420] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Elantech\ETDCtrl.exe[8360] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Elantech\ETDCtrl.exe[8360] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Elantech\ETDCtrl.exe[8360] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Elantech\ETDCtrl.exe[8360] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\Explorer.EXE[15224] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\Explorer.EXE[15224] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\Explorer.EXE[15224] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\Explorer.EXE[15224] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Elantech\ETDTouch.exe[12032] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Elantech\ETDTouch.exe[12032] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Elantech\ETDTouch.exe[12032] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Elantech\ETDTouch.exe[12032] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[12928] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[12928] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[12928] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Elantech\ETDCtrlHelper.exe[12928] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe[11064] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe[11064] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe[11064] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe[11064] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[10640] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\system32\wbem\unsecapp.exe[10640] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\system32\wbem\unsecapp.exe[10640] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\system32\wbem\unsecapp.exe[10640] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Acer\Acer Launch Manager\LMTray.exe[5828] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Acer\Acer Launch Manager\LMTray.exe[5828] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Acer\Acer Launch Manager\LMTray.exe[5828] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Acer\Acer Launch Manager\LMTray.exe[5828] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fa7ec31b32 4 bytes [C3, 7E, FA, 07]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[14160] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fa7ec31b3a 4 bytes [C3, 7E, FA, 07]
.text C:\Windows\System32\igfxtray.exe[17916] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\System32\igfxtray.exe[17916] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\System32\igfxtray.exe[17916] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\System32\igfxtray.exe[17916] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\System32\hkcmd.exe[11296] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\System32\hkcmd.exe[11296] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\System32\hkcmd.exe[11296] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\System32\hkcmd.exe[11296] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fa874d177a 4 bytes [4D, 87, FA, 07]
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fa874d1782 4 bytes [4D, 87, FA, 07]
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\System32\igfxpers.exe[4436] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[12824] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[12824] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[12824] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[12824] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[16084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[16084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[16084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[16084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe[11708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe[11708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe[11708] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files (x86)\Speed Test Analysis\BackgroundHost64.exe[11708] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\system32\igfxext.exe[5040] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\system32\igfxext.exe[5040] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\system32\igfxext.exe[5040] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\system32\igfxext.exe[5040] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\system32\igfxsrvc.exe[13368] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\system32\igfxsrvc.exe[13368] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\system32\igfxsrvc.exe[13368] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\system32\igfxsrvc.exe[13368] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[8832] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Windows\system32\wbem\unsecapp.exe[8832] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Windows\system32\wbem\unsecapp.exe[8832] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Windows\system32\wbem\unsecapp.exe[8832] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[10704] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa80e61532 1 byte [E6]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[10704] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 692 000007fa80e61534 2 bytes [FA, 07]
.text ... * 3
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[10704] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa80e6165a 1 byte [E6]
.text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[10704] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 248 000007fa80e6165c 2 bytes [FA, 07]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [4496:6268] fffff9600083d5e8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Karin on 30.08.2014 at 11:55:04,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
Successfully stopped: [Service] savesenselive
Successfully deleted: [Service] savesenselive
Successfully stopped: [Service] savesenselivem
Successfully deleted: [Service] savesenselivem
~~~ Registry Values
Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?
Value Name Type Value Data
========================================================================================
Pokki REG_EXPAND_SZ C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{562B9317-C08A-444A-9482-62080DD851AE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\addonsframework.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\buttonsite.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthost.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{998745A3-2AE4-488D-8092-B98FB20A00C2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{C1424421-D274-491E-9D47-11C8D8CB5F9A}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealplylive
~~~ Files
Successfully deleted: [File] C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
Successfully deleted: [File] C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\savesenselive"
Successfully deleted: [Folder] "C:\Users\Karin\AppData\Roaming\savesense"
Successfully deleted: [Folder] "C:\Program Files (x86)\savesense"
Successfully deleted: [Folder] "C:\Program Files (x86)\savesenselive"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.08.2014 at 12:00:27,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Danke! mfg, florian |
| Themen zu Werbe-Spams Internet Explorer und Reaktionsprobleme Win8 |
| antivir, antivirus, avira, browser, checkliste, computer, installation, internet, internet explorer, launch, mozilla, object, problem, programm, realtek, registry, rundll, scan, security, software, svchost.exe, symantec, system, trojaner, trojaner board, usb, windows, windowsapps |
Baum-Darstellung