|
Plagegeister aller Art und deren Bekämpfung: PUP.Optional.Snapdo.T gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.09.2014, 22:28 | #1 |
| PUP.Optional.Snapdo.T gefunden Guten Abend Community, vor kurzem ploppte ein Pop-up fenster auf, wollte es wieder schließen und dann kam die Meldung, wenn ich die Seite schließe, müsse ich 88 Dollar zahlen. Ich habe den kompletten Browser über den Task Manager geschlossen (Da ich nicht wusste, was passiert, wenn ich auf "Seite verlassen" klicken würde). Da ich etwas Muffensausen bekam, machte ich einen Virenscan mit Avira und mit "Malwarebytes" einen Scan (mit Malwarebytes einen "Bedrohungssuchlauf"). Dieser hat insg. 31 Dateien gefunden. Ich verschob diese in Quarantäne und startete den PC neu. Leider ist jetzt mein Latein am Ende und jetzt weiß ich nicht, wie ich weiter vorgehen soll. Bevor es zu umfangreich wird, würde ich den PC formatieren, aber falls es einen leichten Lösungsweg gibt, würde ich diesen natürlich bevorzugen. Anbei noch das Ergebnis des Suchlaufs von Malwarebytes Vielen Dank schon mal im Voraus Mit freundlichen Grüßen Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 04.09.2014 Suchlauf-Zeit: 22:55:07 Logdatei: txt.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.04.09 Rootkit Datenbank: v2014.08.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Markus Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 308714 Verstrichene Zeit: 10 Min, 16 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 7 PUP.Optional.Snapdo.T, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [35748762ed8e51e588906e4a41c137c9], PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, In Quarantäne, [35748762ed8e51e588906e4a41c137c9], PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [9118e7027308c1759ed5b393689cce32], PUP.Optional.Aartemis.A, HKLM\SOFTWARE\WOW6432NODE\AARTEMISSOFTWARE\aartemishp, In Quarantäne, [e3c6c4251b6046f0762b9096897a6799], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [66438564cab170c675fa31f32ed539c7], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [802949a036457fb7f2da3dfd4cb814ec], PUP.Optional.Linkury.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR, In Quarantäne, [2188a8415a2121159bbcf7ff4fb38977], Registrierungswerte: 5 PUP.Optional.SmartBar, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, In Quarantäne, [2b7eb732b0cbb87e96839063b64cac54] PUP.Optional.SmartBar, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{ae07101b-46d4-4a98-af68-0333ea26e113}, Smartbar, In Quarantäne, [10991acf7a01fe38d2474ea5857dfa06] PUP.Optional.InstallCore.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, In Quarantäne, [802949a036457fb7f2da3dfd4cb814ec] PUP.Optional.Snapdo.T, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [1990d41584f7290d905d817b3dc56898] PUP.Optional.Linkury.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR|publisher, YahooOC, In Quarantäne, [2188a8415a2121159bbcf7ff4fb38977] Registrierungsdaten: 8 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[2f7acd1cc1ba51e50162747ab94b45bb] PUP.Optional.HelperBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jMseOWirmhAlS59Uj0Q,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jMseOWirmhAlS59Uj0Q,,&q={searchTerms}),Ersetzt,[15946f7a403bd561fd850ed664a0ca36] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}),Ersetzt,[6c3d39b0d2a991a582033aaa08fc946c] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf_6e96IsMxtcV8TsUVqeZo56YoKOXrRUMfq5WzEVRP_sNWi0QEHK9csBYuxzBGnnBXQbRVFdNf8Wrmmbdod11_0ryH6thShtF_A,,, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf_6e96IsMxtcV8TsUVqeZo56YoKOXrRUMfq5WzEVRP_sNWi0QEHK9csBYuxzBGnnBXQbRVFdNf8Wrmmbdod11_0ryH6thShtF_A,,),Ersetzt,[d9d09158c0bb64d23a4c826245bfb34d] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}),Ersetzt,[cfda12d7c2b94cea97edc51fb054a35d] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}),Ersetzt,[436634b51467f83ea5e2a1430ef6d729] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}),Ersetzt,[f9b0cd1c1962be78e6a263814db736ca] PUP.Optional.HelperBar.A, HKU\S-1-5-21-2514168357-242773097-3200024215-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q={searchTerms}),Ersetzt,[7e2b4c9d7b004beb057e885cb74db64a] Ordner: 3 PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log, In Quarantäne, [7b2e9158f58642f46d4f9090bb4848b8], PUP.Optional.OpenCandy, C:\Users\Markus\AppData\Roaming\OpenCandy, In Quarantäne, [c4e50adfbac1b284eb0fcdfa48ba6d93], PUP.Optional.OpenCandy, C:\Users\Markus\AppData\Roaming\OpenCandy\2957D5BB807B4AD482C15FF2BB18B5C0, In Quarantäne, [c4e50adfbac1b284eb0fcdfa48ba6d93], Dateien: 8 PUP.Optional.SmartBar.A, C:\Users\Markus\AppData\Roaming\OpenCandy\2957D5BB807B4AD482C15FF2BB18B5C0\Packer.exe, In Quarantäne, [a5047970cead9f97b7218ef34cb5f30d], PUP.Optional.RegCleanerPro, C:\Users\Markus\AppData\Local\Temp\is1275519350\293310_stp\rcpsetup_adppi4_adppi4.exe, In Quarantäne, [efbac3265229d85e957836e3639e629e], PUP.Optional.Aartemis.A, C:\Users\Markus\AppData\Local\Temp\is1275519350\293347_stp\cor_aartemis.exe, In Quarantäne, [dbce866303781224f5e46ed4639e7f81], PUP.Optional.OpenCandy, C:\Users\Markus\Downloads\DTLite4491-0356.exe, In Quarantäne, [6d3caa3f106bcc6a812e21f2c243ed13], PUP.Optional.WebSearch.A, C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\searchplugins\Web Search.xml, In Quarantäne, [1f8ada0fb5c64fe7118432e8f112e020], PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log\eGdpSvc.LOG, In Quarantäne, [7b2e9158f58642f46d4f9090bb4848b8], PUP.Optional.HelperBar.A, C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf_6e96IsMxtcV8TsUVqeZo56YoKOXrRUMfq5WzEVRP_sNWi0QEHK9csBYuxzBGnnBXQbRVFdNf8WrmmbdprWlBLiNXpRpcw4k2g,,",), Ersetzt,[694062879ae1da5c47dd61c07491b947] PUP.Optional.HelperBar.A, C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDJ67jFfFbVMftvbWiaEmC2YrGA_-j-PIQa-oDl9BIAWVfSiGZkkxm7KBWo1eyXb_AFdKvHpi0jeTbJMbpH5jlyFEf80WojBATBwNxEA68EYuS8-fkEtR08HotzeogGmjx3WrQlFZXFEVD5GbesKfIvetNYfbsQhXSb2J36K5jNQ-QnwtNKoegIbjHsQ,,&q=");), Ersetzt,[7138c42535461d191238948c14f1b050] Physische Sektoren: 0 (No malicious items detected) (end) |
04.09.2014, 22:49 | #2 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden Hallo Cornholio01
__________________Mein Name ist Timo und ich werde Dir bei deinem Problem behilflich sein.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist immer der sicherste Weg. Wir "arbeiten" hier alle freiwillig und in unserer Freizeit *hust*. Daher kann es bei Antworten zu Verzögerungen kommen. Solltest du innerhalb 48 Std keine Antwort von mir erhalten, dann schreib mit eine PM Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis ich oder jemand vom Team sagt, dass Du clean bist. Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
05.09.2014, 19:23 | #3 |
| PUP.Optional.Snapdo.T gefunden Hallo Timo, vielen Dank für die schnelle Antwort.
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 02 Ran by Markus (administrator) on MARKUS-PC on 05-09-2014 20:19:53 Running from C:\Users\Markus\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Spotify Ltd) C:\Users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe () C:\Users\Markus\AppData\Local\Amazon Music\Amazon Music Helper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-06] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3802448 2014-09-04] (LogMeIn Inc.) HKU\S-1-5-21-2514168357-242773097-3200024215-1000\...\Run: [Spotify Web Helper] => C:\Users\Markus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-07-20] (Spotify Ltd) HKU\S-1-5-21-2514168357-242773097-3200024215-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-21-2514168357-242773097-3200024215-1000\...\Run: [Amazon Music] => C:\Users\Markus\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] () HKU\S-1-5-21-2514168357-242773097-3200024215-1000\...\MountPoints2: {6cbf803b-ef3c-11e3-bf0c-002421f1c7bf} - I:\setup\rsrc\Autorun.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8D88D01EC3E2CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1384604392&from=cor&uid=HitachiXHDT721010SLA360_STF607MS14KS3K14KS3KX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1384604392&from=cor&uid=HitachiXHDT721010SLA360_STF607MS14KS3K14KS3KX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1384604392&from=cor&uid=HitachiXHDT721010SLA360_STF607MS14KS3K14KS3KX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1384604392&from=cor&uid=HitachiXHDT721010SLA360_STF607MS14KS3K14KS3KX&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) FireFox: ======== FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default FF DefaultSearchEngine: Web Search FF SelectedSearchEngine: Web Search FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF user.js: detected! => C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\user.js FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira Browser Safety - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\Extensions\abs@avira.com [2014-09-04] FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-10] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-23] CHR Extension: (Google Drive) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-23] CHR Extension: (YouTube) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-23] CHR Extension: (Google-Suche) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-23] CHR Extension: (Google Wallet) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-23] CHR Extension: (Google Mail) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-23] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-06] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-06] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-08-08] (LogMeIn, Inc.) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed] R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-24] (Avira Operations GmbH & Co. KG) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-05 20:19 - 2014-09-05 20:20 - 00013410 _____ () C:\Users\Markus\Downloads\FRST.txt 2014-09-05 20:19 - 2014-09-05 20:19 - 00000000 ____D () C:\FRST 2014-09-05 20:15 - 2014-09-05 20:16 - 02104832 _____ (Farbar) C:\Users\Markus\Downloads\FRST64.exe 2014-09-04 23:06 - 2014-09-04 23:06 - 00011342 _____ () C:\Users\Markus\Desktop\txt.txt 2014-09-04 22:48 - 2014-09-04 22:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-04 22:47 - 2014-09-04 22:47 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-04 22:47 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-04 22:47 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-04 22:47 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-04 22:42 - 2014-09-04 22:42 - 01101648 _____ () C:\Users\Markus\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe 2014-09-04 15:08 - 2014-09-04 15:08 - 00000997 _____ () C:\Users\Markus\Desktop\Glyph.lnk 2014-09-04 15:08 - 2014-09-04 15:08 - 00000000 ____D () C:\Program Files (x86)\Glyph 2014-09-04 14:01 - 2014-09-04 14:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-09-04 14:01 - 2014-09-04 14:01 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi 2014-08-30 12:56 - 2014-08-30 12:56 - 00000221 _____ () C:\Users\Markus\Desktop\RIFT.url 2014-08-28 12:36 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 12:36 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 12:36 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-27 20:30 - 2014-09-04 15:08 - 00000000 ____D () C:\Users\Markus\AppData\Local\Glyph 2014-08-27 20:30 - 2014-09-04 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glyph 2014-08-27 20:30 - 2014-08-27 20:30 - 00000000 ____D () C:\ProgramData\Glyph 2014-08-27 20:28 - 2014-08-27 20:29 - 31901296 _____ (Trion Worlds Inc.) C:\Users\Markus\Downloads\GlyphInstall-0-1.exe 2014-08-27 20:22 - 2014-08-27 20:22 - 00000000 ____D () C:\Users\Markus\Documents\RIFT 2014-08-27 19:34 - 2014-08-27 20:40 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\RIFT 2014-08-14 14:22 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-14 14:22 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-14 14:22 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-14 14:22 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-14 14:22 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-14 14:22 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-14 14:22 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-14 14:22 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-14 10:25 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-14 10:25 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-14 10:25 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-14 10:25 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-14 10:25 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-14 10:25 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-14 10:25 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-14 10:25 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-14 10:25 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-14 10:25 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-14 10:25 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-14 10:25 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-14 10:25 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-14 10:25 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-14 10:25 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-14 10:25 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-14 10:25 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-14 10:25 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-14 10:25 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-14 10:25 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-14 10:25 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-14 10:25 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-14 10:25 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-14 10:25 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-14 10:25 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-14 10:25 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-14 10:25 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-14 10:25 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-14 10:25 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-14 10:25 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-14 10:25 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-14 10:25 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-14 10:25 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-14 10:25 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-14 10:25 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-14 10:25 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-14 10:25 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-14 10:25 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-14 10:25 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-14 10:25 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-14 10:25 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-14 10:25 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-14 10:25 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-14 10:25 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-14 10:25 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-14 10:25 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-14 10:25 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-14 10:25 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-14 10:25 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-14 10:25 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-14 10:25 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-14 10:25 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-14 10:25 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-14 10:25 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-14 10:25 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-14 10:25 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-14 10:25 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-14 10:25 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-14 10:25 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-14 10:25 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-14 10:25 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-14 10:25 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-14 10:25 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-14 10:25 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-14 10:25 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-14 10:25 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-14 10:23 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-14 10:23 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-08 15:38 - 2014-08-08 15:38 - 00004790 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log 2014-08-08 15:38 - 2014-08-08 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-08-08 15:38 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-08-08 15:38 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-08-08 15:38 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-08-08 15:38 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-08-07 11:42 - 2014-08-23 16:14 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-05 20:20 - 2014-09-05 20:19 - 00013410 _____ () C:\Users\Markus\Downloads\FRST.txt 2014-09-05 20:19 - 2014-09-05 20:19 - 00000000 ____D () C:\FRST 2014-09-05 20:16 - 2014-09-05 20:15 - 02104832 _____ (Farbar) C:\Users\Markus\Downloads\FRST64.exe 2014-09-05 20:16 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-05 20:16 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-05 20:13 - 2013-11-16 13:54 - 01102291 _____ () C:\Windows\WindowsUpdate.log 2014-09-05 20:12 - 2013-11-16 18:20 - 00000000 ____D () C:\Users\Markus\AppData\Local\LogMeIn Hamachi 2014-09-05 20:11 - 2013-11-16 14:36 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype 2014-09-05 20:07 - 2013-11-23 22:55 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-05 20:07 - 2009-07-14 06:51 - 00106195 _____ () C:\Windows\setupact.log 2014-09-05 20:06 - 2013-11-16 17:57 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-09-05 20:06 - 2010-11-21 05:47 - 00110954 _____ () C:\Windows\PFRO.log 2014-09-05 20:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-04 23:31 - 2013-12-17 22:08 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-04 23:29 - 2013-11-23 22:55 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-04 23:07 - 2014-04-13 18:53 - 00000000 ____D () C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP 2014-09-04 23:06 - 2014-09-04 23:06 - 00011342 _____ () C:\Users\Markus\Desktop\txt.txt 2014-09-04 23:06 - 2013-11-16 14:20 - 00000000 ____D () C:\ProgramData\eSafe 2014-09-04 22:48 - 2014-09-04 22:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-04 22:47 - 2014-09-04 22:47 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-04 22:47 - 2014-09-04 22:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-04 22:42 - 2014-09-04 22:42 - 01101648 _____ () C:\Users\Markus\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe 2014-09-04 22:10 - 2013-12-02 20:24 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-09-04 15:08 - 2014-09-04 15:08 - 00000997 _____ () C:\Users\Markus\Desktop\Glyph.lnk 2014-09-04 15:08 - 2014-09-04 15:08 - 00000000 ____D () C:\Program Files (x86)\Glyph 2014-09-04 15:08 - 2014-08-27 20:30 - 00000000 ____D () C:\Users\Markus\AppData\Local\Glyph 2014-09-04 15:08 - 2014-08-27 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glyph 2014-09-04 14:01 - 2014-09-04 14:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-09-04 14:01 - 2014-09-04 14:01 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi 2014-09-02 10:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-30 12:56 - 2014-08-30 12:56 - 00000221 _____ () C:\Users\Markus\Desktop\RIFT.url 2014-08-30 10:42 - 2009-07-14 06:45 - 00292456 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 20:40 - 2014-08-27 19:34 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\RIFT 2014-08-27 20:30 - 2014-08-27 20:30 - 00000000 ____D () C:\ProgramData\Glyph 2014-08-27 20:29 - 2014-08-27 20:28 - 31901296 _____ (Trion Worlds Inc.) C:\Users\Markus\Downloads\GlyphInstall-0-1.exe 2014-08-27 20:22 - 2014-08-27 20:22 - 00000000 ____D () C:\Users\Markus\Documents\RIFT 2014-08-27 20:13 - 2013-12-03 00:15 - 00000000 ____D () C:\Users\Markus\Documents\My Games 2014-08-27 11:09 - 2014-04-22 11:33 - 00000000 ____D () C:\Users\Markus\Desktop\alte spiele 2014-08-23 16:15 - 2013-12-02 22:01 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-23 16:14 - 2014-08-07 11:42 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-08-23 16:14 - 2013-11-16 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-23 16:14 - 2013-11-16 14:03 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-23 04:07 - 2014-08-28 12:36 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 12:36 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 12:36 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-18 15:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-16 11:34 - 2013-11-23 22:56 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-08-15 10:49 - 2013-12-17 22:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-08-15 10:49 - 2013-11-16 15:25 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-08-15 10:49 - 2013-11-16 15:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-08-14 17:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-14 14:26 - 2013-12-07 12:28 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-14 14:25 - 2013-12-07 12:28 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-12 11:24 - 2013-11-16 14:36 - 00000000 ____D () C:\ProgramData\Skype 2014-08-11 20:03 - 2014-04-08 14:59 - 00000000 ____D () C:\Users\Markus\AppData\Local\Amazon Cloud Player 2014-08-11 19:57 - 2013-11-21 16:15 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Spotify 2014-08-10 20:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-08-08 15:39 - 2013-11-16 18:09 - 00000000 ____D () C:\ProgramData\Oracle 2014-08-08 15:38 - 2014-08-08 15:38 - 00004790 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log 2014-08-08 15:38 - 2014-08-08 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-08-08 15:38 - 2013-11-16 18:09 - 00000000 ____D () C:\Program Files (x86)\Java 2014-08-07 11:42 - 2013-11-16 14:03 - 00000000 ____D () C:\ProgramData\Avira 2014-08-06 13:32 - 2013-11-21 16:16 - 00000000 ____D () C:\Users\Markus\AppData\Local\Spotify Some content of TEMP: ==================== C:\Users\Markus\AppData\Local\Temp\avgnt.exe C:\Users\Markus\AppData\Local\Temp\BackupSetup.exe C:\Users\Markus\AppData\Local\Temp\drm_dialogs.dll C:\Users\Markus\AppData\Local\Temp\drm_dyndata_7410004.dll C:\Users\Markus\AppData\Local\Temp\fp_pl_pfs_installer-1.exe C:\Users\Markus\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\Markus\AppData\Local\Temp\Gw2.exe C:\Users\Markus\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Markus\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\Markus\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe C:\Users\Markus\AppData\Local\Temp\swt-win32-3349.dll C:\Users\Markus\AppData\Local\Temp\vcredist_x64.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-27 12:11 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2014 02 Ran by Markus at 2014-09-05 20:20:22 Running from C:\Users\Markus\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated) Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios) Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version: - Ensemble Studios) Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC) Avira (HKLM-x32\...\{e67154a7-9cc5-4167-b782-f3982bc6c70d}) (Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Avira (x32 Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Hidden Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira) Banished (HKLM-x32\...\Steam App 242920) (Version: - Shining Rock Software LLC) Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve) Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve) GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.) HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP) HP Photosmart 7520 series - Grundlegende Software für das Gerät (HKLM\...\{62883BA5-32F6-44D0-AF9D-9CBED778F36F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) HP Photosmart 7520 series Hilfe (HKLM-x32\...\{2230C40A-ADE0-4231-98EC-7AAFC14BC7F3}) (Version: 28.0.0 - Hewlett Packard) HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard) Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.670 - Oracle) Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.236 - LogMeIn, Inc.) LogMeIn Hamachi (x32 Version: 2.2.0.236 - LogMeIn, Inc.) Hidden Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft) Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) Mozilla Thunderbird 24.1.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.1.0 (x86 de)) (Version: 24.1.0 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Neverwinter (HKLM-x32\...\Steam App 109600) (Version: - Cryptic Studios) NVIDIA 3D Vision Controller-Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.65 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation) NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation) OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation) RIFT™ (HKLM-x32\...\Steam App 39120) (Version: - Trion Worlds) Sacred 2 - Fallen Angel (HKLM-x32\...\{7D0AEAD8-07FA-4C4D-9347-E7FBC5534B73}) (Version: 2.43.0.0 - Deep Silver) SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) Spotify (HKCU\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB) Starbound (HKLM-x32\...\Steam App 211820) (Version: - ) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) Street Fighter X Tekken (HKLM-x32\...\{43430FA5-AF68-4A2D-A7D4-891000008200}) (Version: 1.0.0000.130 - CAPCOM U.S.A., INC) Street Fighter X Tekken (x32 Version: 1.0.0004.130 - CAPCOM U.S.A., INC) Hidden Studie zur Verbesserung von HP Photosmart 7520 series Produkten (HKLM\...\{D662A279-973A-42A0-8D4B-8747C56C0501}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH) The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios) Torchlight II (HKLM-x32\...\{55F7D521-17CA-454D-9D4D-975EF2E10708}_is1) (Version: - White Rabbit Interactive) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 28-08-2014 16:57:07 Windows Update 03-09-2014 09:09:55 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {014F121B-59E4-4DED-A29C-507359A6B3DD} - System32\Tasks\HPCustParticipation HP Photosmart 7520 series => C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.) Task: {6D91CED7-C1D1-4CEE-A4DA-AB7F2E7EB2DF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.) Task: {BFE830DD-23B6-449E-90CF-0B1D716115EE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-23] (Google Inc.) Task: {D35786EA-BF0B-4598-B355-C743612A8C94} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-15] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-11-16 17:57 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-08-11 20:03 - 2014-07-22 22:46 - 03356480 _____ () C:\Users\Markus\AppData\Local\Amazon Music\Amazon Music Helper.exe 2014-08-07 11:42 - 2014-08-04 14:20 - 00052472 _____ () C:\Users\Markus\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll 2014-08-04 14:20 - 2014-08-04 14:20 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll 2014-08-04 14:20 - 2014-08-04 14:20 - 00067832 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll 2014-07-30 12:18 - 2014-07-30 12:18 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData:gs5sys AlternateDataStreams: C:\Users\All Users:gs5sys AlternateDataStreams: C:\Users\Markus:gs5sys AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys AlternateDataStreams: C:\ProgramData\Application Data:gs5sys AlternateDataStreams: C:\ProgramData\Templates:gs5sys AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\Cookies:gs5sys AlternateDataStreams: C:\Users\Markus\Lokale Einstellungen:gs5sys AlternateDataStreams: C:\Users\Markus\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Desktop\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Roaming:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Verlauf:gs5sys AlternateDataStreams: C:\Users\Markus\Documents\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/05/2014 08:08:42 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:31:28 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (09/04/2014 11:09:29 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 10:37:19 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 08:26:18 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 03:28:49 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (09/04/2014 02:01:38 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:38:39 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:08:40 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/03/2014 08:08:17 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (09/04/2014 11:13:10 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "Windows Update" wurde nicht richtig gestartet. Error: (09/04/2014 11:06:39 PM) (Source: DCOM) (EventID: 10010) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (09/04/2014 02:01:12 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (09/04/2014 11:37:56 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (08/31/2014 10:34:15 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (08/31/2014 10:33:24 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht. Error: (08/30/2014 00:45:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (08/30/2014 00:45:39 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error: (08/27/2014 07:19:23 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.24 registriert werden. Der Computer mit IP-Adresse 192.168.178.21 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (08/24/2014 03:15:33 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "SEBASTIAN-PC", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{DC663608-BA2C-40F4-8FDE-B475F05A2705}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Microsoft Office Sessions: ========================= Error: (09/05/2014 08:08:42 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:31:28 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (09/04/2014 11:09:29 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 10:37:19 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 08:26:18 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 03:28:49 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (09/04/2014 02:01:38 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:38:39 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/04/2014 11:08:40 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/03/2014 08:08:17 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz Percentage of memory in use: 32% Total physical RAM: 6135.12 MB Available physical RAM: 4145.04 MB Total Pagefile: 12268.41 MB Available Pagefile: 10009.01 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.41 GB) (Free:769.64 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E01ED30C) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Mit freundlichen Grüßen Cornholio01 |
05.09.2014, 20:39 | #4 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter AlternateDataStreams: C:\ProgramData:gs5sys AlternateDataStreams: C:\Users\All Users:gs5sys AlternateDataStreams: C:\Users\Markus:gs5sys AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys AlternateDataStreams: C:\ProgramData\Application Data:gs5sys AlternateDataStreams: C:\ProgramData\Templates:gs5sys AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\Cookies:gs5sys AlternateDataStreams: C:\Users\Markus\Lokale Einstellungen:gs5sys AlternateDataStreams: C:\Users\Markus\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Desktop\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Roaming:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Verlauf:gs5sys AlternateDataStreams: C:\Users\Markus\Documents\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Downloade Dir bitte Malwarebytes Anti-Malware
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
05.09.2014, 21:21 | #5 |
| PUP.Optional.Snapdo.T gefunden Der Adw Cleaner hat kurz geladen, nachdem ich auf Suchen geklickt habe und nun steht da "Warte ab. Bitte wählen sie alle Elemente ab, die sie nicht entfernen wollen. Muss ich da etwas beachten, oder soll ich schon auf Löschen klicken? Gruß Markus |
05.09.2014, 21:29 | #6 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden Sobald oben der Blaue Balken von Links nach Rechts durchgelaufen ist, ist AdwCleaner fertig mit der Suche. Dann klickst du auf "Löschen". Dann gibst einen Neustart und nach dem Neustart öffnet sich das Logfile.
__________________ --> PUP.Optional.Snapdo.T gefunden |
05.09.2014, 22:07 | #7 |
| PUP.Optional.Snapdo.T gefunden Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 02 Ran by Markus at 2014-09-05 22:14:37 Run:1 Running from C:\Users\Markus\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** AlternateDataStreams: C:\ProgramData:gs5sys AlternateDataStreams: C:\Users\All Users:gs5sys AlternateDataStreams: C:\Users\Markus:gs5sys AlternateDataStreams: C:\ProgramData\Anwendungsdaten:gs5sys AlternateDataStreams: C:\ProgramData\Application Data:gs5sys AlternateDataStreams: C:\ProgramData\Templates:gs5sys AlternateDataStreams: C:\ProgramData\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\Cookies:gs5sys AlternateDataStreams: C:\Users\Markus\Lokale Einstellungen:gs5sys AlternateDataStreams: C:\Users\Markus\Vorlagen:gs5sys AlternateDataStreams: C:\Users\Markus\Desktop\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Roaming:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Anwendungsdaten:gs5sys AlternateDataStreams: C:\Users\Markus\AppData\Local\Verlauf:gs5sys AlternateDataStreams: C:\Users\Markus\Documents\desktop.ini:gs5sys AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys ***************** C:\ProgramData => ":gs5sys" ADS removed successfully. "C:\Users\All Users" => ":gs5sys" ADS not found. C:\Users\Markus => ":gs5sys" ADS removed successfully. "C:\ProgramData\Anwendungsdaten" => ":gs5sys" ADS not found. "C:\ProgramData\Application Data" => ":gs5sys" ADS not found. "C:\ProgramData\Templates" => ":gs5sys" ADS not found. "C:\ProgramData\Vorlagen" => ":gs5sys" ADS not found. "C:\Users\Markus\Anwendungsdaten" => ":gs5sys" ADS not found. "C:\Users\Markus\Cookies" => ":gs5sys" ADS not found. "C:\Users\Markus\Lokale Einstellungen" => ":gs5sys" ADS not found. "C:\Users\Markus\Vorlagen" => ":gs5sys" ADS not found. C:\Users\Markus\Desktop\desktop.ini => ":gs5sys" ADS removed successfully. C:\Users\Markus\AppData\Local => ":gs5sys" ADS removed successfully. C:\Users\Markus\AppData\Roaming => ":gs5sys" ADS removed successfully. "C:\Users\Markus\AppData\Local\Anwendungsdaten" => ":gs5sys" ADS not found. "C:\Users\Markus\AppData\Local\Verlauf" => ":gs5sys" ADS not found. C:\Users\Markus\Documents\desktop.ini => ":gs5sys" ADS removed successfully. C:\Users\Public\Documents\desktop.ini => ":gs5sys" ADS removed successfully. ==== End of Fixlog ==== ADW Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 05/09/2014 um 22:39:51 # Aktualisiert 02/09/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Markus - MARKUS-PC # Gestartet von : C:\Users\Markus\Downloads\adwcleaner_3.309.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\eSafe [/!\] Nicht Gelöscht ( Junction ) : C:\Program Files\Gemeinsame Dateien Ordner Gelöscht : C:\Users\Markus\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\Systweak Datei Gelöscht : C:\Windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\user.js ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** Verknüpfung Desinfiziert : C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKLM\SOFTWARE\aartemisSoftware Schlüssel Gelöscht : HKLM\SOFTWARE\systweak Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964 Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467 ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17239 Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] -\\ Mozilla Firefox v31.0 (x86 de) [ Datei : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\fz9rhsby.default\prefs.js ] Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search"); Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search"); Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false); Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false); Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false); Zeile gelöscht : user_pref("extensions.helperbar.Visibility", false); Zeile gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3); Zeile gelöscht : user_pref("extensions.helperbar.backPageCounter", 0); Zeile gelöscht : user_pref("extensions.helperbar.backPageDay", 9); Zeile gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1402092737218"); Zeile gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15); Zeile gelöscht : user_pref("extensions.helperbar.barcodeid", "139911"); Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de"); Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "yahoooc_pkr"); Zeile gelöscht : user_pref("extensions.helperbar.fromautoupdate", "false"); Zeile gelöscht : user_pref("extensions.helperbar.installationid", "7ddacac3-5cde-486f-a69e-2ece76e7441e"); Zeile gelöscht : user_pref("extensions.helperbar.installdate", "08/06/2014"); Zeile gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1402265525"); Zeile gelöscht : user_pref("extensions.helperbar.publisher", "yahoooc"); -\\ Google Chrome v37.0.2062.103 [ Datei : C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5289 octets] - [05/09/2014 22:16:59] AdwCleaner[R1].txt - [5349 octets] - [05/09/2014 22:36:35] AdwCleaner[R2].txt - [5409 octets] - [05/09/2014 22:39:26] AdwCleaner[S0].txt - [4609 octets] - [05/09/2014 22:39:51] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4669 octets] ########## Der Rest kommt gleich nach :-) Nun kommt Teil 2 :-) JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by Markus on 05.09.2014 at 22:46:59,10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin" ~~~ FireFox Emptied folder: C:\Users\Markus\AppData\Roaming\mozilla\firefox\profiles\fz9rhsby.default\minidumps [133 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 05.09.2014 at 22:50:58,95 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.09.2014 Suchlauf-Zeit: 22:55:10 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.05.09 Rootkit Datenbank: v2014.08.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Markus Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 309397 Verstrichene Zeit: 9 Min, 40 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) |
05.09.2014, 22:14 | #8 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden Ok. So gehts weiter: Downloade Dir bitte SecurityCheck und:
Achtung, ESET Scan dauert lang ! ESET Online Scanner
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
06.09.2014, 10:55 | #9 |
| PUP.Optional.Snapdo.T gefunden Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.87 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 67 Adobe Flash Player 14.0.0.179 Mozilla Firefox (31.0) Mozilla Thunderbird (24.1.0) Google Chrome 36.0.1985.143 Google Chrome 37.0.2062.103 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=4ce9298aba74c142ba61cb75b7761da3 # engine=20028 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-09-06 09:03:06 # local_time=2014-09-06 11:03:06 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Avira Desktop' # compatibility_mode=1810 16777213 100 100 4090 26753868 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 53439 161624036 0 0 # scanned=171336 # found=4 # cleaned=0 # scan_time=3361 sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Markus\AppData\Local\Temp\OCS\ocs_v71a.exe.vir" sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Markus\AppData\Local\Temp\OCS\ocs_v71b.exe.vir" sh=558C365776AD71C812363E30D7880CF564028A06 ft=1 fh=e10f04e359590fdb vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir" sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Markus\AppData\Local\Temp\is1275519350\293140_stp\wajam_validate.exe" |
07.09.2014, 11:24 | #10 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden Noch den einen Fix um die temporären Daten aufzuräumen: Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter emptytemp: Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Ansonsten sind die Logs soweit sauber ! Die Reihenfolge ist hier entscheidend.
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
08.09.2014, 08:40 | #11 |
| PUP.Optional.Snapdo.T gefunden Hallo erstmal, also vielen Dank für die tolle Hilfe, finde ich echt stark. Desweiteren hab ich keine Fragen mehr, außer eine.... Ist es möglich, diesen Thread dann zu löschen? Da ja viele meiner Daten jetzt hier drin sind. Würde mich besser fühlen. Nochmals vielen Dank Gruß Markus |
08.09.2014, 09:18 | #12 |
/// TB-Ausbilder | PUP.Optional.Snapdo.T gefunden
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |