| |
| |||||||
Log-Analyse und Auswertung: Windows 8: langsames Internet und Umleitungen auf WerbeseitenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
| |
16.10.2014, 20:20
| #1 |
 |  Windows 8: langsames Internet und Umleitungen auf Werbeseiten Guten Abend! Ich habe seit neustem das Problem, dass das Streamen von Videos sehr langsam geworden ist. Ausserdem werde ich, wenn ich bestimmte Seiten besuche, auf unseriöse Seiten umgeleitet und daher kommt der Verdacht das ich mir wohl etwas eingefangen habe. Für Hilfe wäre ich sehr dankbar. FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014
Ran by Elias (administrator) on ELIAS-PC on 16-10-2014 20:38:03
Running from C:\Users\Elias\Downloads
Loaded Profiles: UpdatusUser & Elias (Available profiles: UpdatusUser & Elias)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Elias\Downloads\Defogger.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191312 2012-08-07] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-10] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-10] (Atheros Communications)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2862448 2012-08-06] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3777642976-2438380877-1723110391-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1939136 2014-08-28] (Valve Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {29B1A520-C273-44ED-A82A-DB524E785CA0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM - {29B1A520-C273-44ED-A82A-DB524E785CA0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {29B1A520-C273-44ED-A82A-DB524E785CA0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - {29B1A520-C273-44ED-A82A-DB524E785CA0} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Elias\AppData\Roaming\Mozilla\Firefox\Profiles\cyltjadc.default
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: å¡å·Žæ–¯åŸºç¶²å€é¡§å• - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-02-18]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬éµç›€ - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-02-18]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡æ„網站攔截噚 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-02-18]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-02-18]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-02-18]
Chrome:
=======
CHR HomePage: Default -> https://www.google.de/
CHR Profile: C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-12-21]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (Kaspersky Protection) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-03-26]
CHR Extension: (YouTube) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-21]
CHR Extension: (Google-Suche) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-21]
CHR Extension: (AdBlock) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-07-12]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-02-18]
CHR Extension: (Modul zum Sperren von gefÀhrlichen Webseiten) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-02-18]
CHR Extension: (Virtual Keyboard) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-02-18]
CHR Extension: (Google Wallet) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (Google Mail) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-21]
CHR Extension: (Anti-Banner) - C:\Users\Elias\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-02-18]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa []
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-09-05] (Samsung Electronics CO., LTD.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2014-02-26] (LogMeIn Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-02-18] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-02-18] (Kaspersky Lab)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-26] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-03-26] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-02-18] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-03-26] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-02-18] (Kaspersky Lab ZAO)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-09-15] (Windows (R) 2003 DDK 3790 provider)
S3 SBIOSIO; \??\C:\windiag\SBIOSIO64.SYS [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-16 20:38 - 2014-10-16 20:38 - 00020603 _____ () C:\Users\Elias\Downloads\FRST.txt
2014-10-16 20:37 - 2014-10-16 20:38 - 00000000 ____D () C:\FRST
2014-10-16 20:36 - 2014-10-16 20:36 - 02112000 _____ (Farbar) C:\Users\Elias\Downloads\FRST64.exe
2014-10-16 20:35 - 2014-10-16 20:35 - 00000472 _____ () C:\Users\Elias\Downloads\defogger_disable.log
2014-10-16 20:35 - 2014-10-16 20:35 - 00000000 _____ () C:\Users\Elias\defogger_reenable
2014-10-16 20:33 - 2014-10-16 20:33 - 00050477 _____ () C:\Users\Elias\Downloads\Defogger.exe
2014-10-16 19:28 - 2014-10-16 19:28 - 00000000 ___RD () C:\Users\Elias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-10-16 19:27 - 2014-10-16 19:27 - 00449032 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-16 17:11 - 2014-09-30 00:49 - 00705480 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 17:11 - 2014-09-30 00:49 - 00104904 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-16 17:01 - 2014-10-16 17:01 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\Elias\Downloads\avira_de_av___ws.exe
2014-10-16 13:49 - 2014-07-12 06:41 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\KBDRUM.DLL
2014-10-16 13:49 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2014-10-16 13:49 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2014-10-16 13:49 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2014-10-16 13:49 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2014-10-16 13:49 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2014-10-16 13:49 - 2014-07-12 06:16 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRUM.DLL
2014-10-16 13:49 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2014-10-16 13:49 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2014-10-16 13:49 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2014-10-16 13:49 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2014-10-16 13:49 - 2014-07-12 06:15 - 00006144 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2014-10-16 13:49 - 2014-07-12 02:02 - 00478352 _____ () C:\windows\SysWOW64\locale.nls
2014-10-16 13:49 - 2014-07-12 02:00 - 00478352 _____ () C:\windows\system32\locale.nls
2014-10-16 13:49 - 2014-07-09 00:33 - 00181248 _____ (Microsoft Corp.) C:\windows\system32\Defrag.exe
2014-10-16 13:49 - 2014-07-09 00:32 - 01539584 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
2014-10-16 13:49 - 2014-07-09 00:32 - 00340480 _____ (Microsoft Corporation) C:\windows\system32\defragsvc.dll
2014-10-16 13:49 - 2014-07-09 00:30 - 01220608 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
2014-10-16 13:49 - 2014-07-07 07:52 - 00263680 _____ (Microsoft Corporation) C:\windows\system32\wcmsvc.dll
2014-10-16 13:49 - 2014-07-07 07:52 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\wcmcsp.dll
2014-10-16 13:49 - 2014-07-04 12:52 - 00328000 _____ (Microsoft Corporation) C:\windows\system32\Drivers\volsnap.sys
2014-10-16 13:49 - 2014-07-03 03:59 - 01824784 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2014-10-16 13:49 - 2014-07-03 02:30 - 01408952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2014-10-16 13:49 - 2014-06-28 09:01 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll
2014-10-16 13:49 - 2014-06-28 08:57 - 00209920 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2014-10-16 13:49 - 2014-06-28 08:56 - 00117248 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
2014-10-16 13:49 - 2014-06-25 09:09 - 00733184 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2014-10-16 13:49 - 2014-06-25 09:07 - 01023488 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
2014-10-16 13:49 - 2014-06-18 01:27 - 02032640 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
2014-10-16 13:49 - 2014-06-18 01:23 - 02238464 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2014-10-16 13:49 - 2014-06-11 16:47 - 02842112 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2014-10-16 13:49 - 2014-06-11 06:40 - 02620928 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2014-10-16 13:49 - 2014-06-11 00:44 - 01403896 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2014-10-16 13:49 - 2014-05-30 01:31 - 00323072 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-10-16 13:49 - 2014-05-30 01:03 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-10-16 13:49 - 2014-02-04 12:57 - 01271664 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2014-10-16 13:48 - 2014-10-10 06:47 - 00693248 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-10-16 13:48 - 2014-10-10 06:47 - 00275968 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-10-16 13:48 - 2014-10-08 06:26 - 00556544 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-10-16 13:48 - 2014-09-13 07:29 - 00079360 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-16 13:48 - 2014-09-13 06:02 - 00068096 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-16 13:48 - 2014-09-03 04:48 - 00510464 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-16 13:48 - 2014-09-03 04:21 - 00585728 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-16 13:48 - 2014-08-02 00:08 - 00388729 _____ () C:\windows\system32\ApnDatabase.xml
2014-10-16 13:48 - 2014-07-24 15:50 - 00447296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2014-10-16 13:48 - 2014-07-17 01:28 - 00027648 _____ (Microsoft Corporation) C:\windows\SysWOW64\sscore.dll
2014-10-16 13:48 - 2014-07-17 00:59 - 00305664 _____ (Microsoft Corporation) C:\windows\system32\srvsvc.dll
2014-10-16 13:48 - 2014-07-17 00:59 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\sscore.dll
2014-10-16 13:48 - 2014-07-12 08:45 - 01549824 _____ (Microsoft Corporation) C:\windows\system32\msdtctm.dll
2014-10-16 13:48 - 2014-07-12 06:36 - 00674304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-10-16 13:48 - 2014-07-12 06:36 - 00211456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2014-10-16 13:48 - 2014-07-12 06:34 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2014-10-16 13:48 - 2014-07-12 06:34 - 00250368 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2014-10-16 13:48 - 2014-07-07 07:53 - 01125376 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-16 13:48 - 2014-07-07 07:52 - 03248128 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-16 13:48 - 2014-07-07 07:52 - 00724992 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-16 13:48 - 2014-07-07 07:52 - 00300544 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-16 13:48 - 2014-07-07 07:51 - 05982208 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-16 13:48 - 2014-07-07 06:01 - 01049600 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-16 13:48 - 2014-07-07 06:01 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-16 13:48 - 2014-07-07 06:00 - 05095424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-16 13:48 - 2014-07-07 05:59 - 00269312 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-16 13:48 - 2014-06-28 08:57 - 01341952 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
2014-10-16 13:48 - 2014-06-28 04:23 - 01126400 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
2014-10-16 13:47 - 2014-09-28 06:18 - 04068352 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-16 13:47 - 2014-09-20 07:18 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-16 13:47 - 2014-09-20 07:17 - 02236928 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-16 13:47 - 2014-09-20 07:17 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-16 13:47 - 2014-09-20 07:17 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-10-16 13:47 - 2014-09-20 07:17 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 19280896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 15399424 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-16 13:47 - 2014-09-20 07:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-16 13:47 - 2014-09-20 07:15 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-16 13:47 - 2014-09-20 07:15 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-16 13:47 - 2014-09-20 07:15 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 14368768 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 13757952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 02055168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 01762816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-16 13:47 - 2014-09-20 05:57 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-16 13:47 - 2014-09-20 05:56 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-16 13:47 - 2014-09-20 05:56 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-16 13:47 - 2014-09-20 05:56 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-16 13:47 - 2014-09-20 05:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-16 13:47 - 2014-09-20 05:33 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-16 13:47 - 2014-09-20 03:06 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-10-16 13:47 - 2014-09-18 01:24 - 02416128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-10-16 13:47 - 2014-09-18 00:56 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-10-16 13:47 - 2014-08-30 07:48 - 10115072 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-10-16 13:47 - 2014-08-30 07:46 - 02306560 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-10-16 13:47 - 2014-08-30 06:05 - 08858112 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-10-16 13:47 - 2014-08-30 06:03 - 02037760 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-10-16 13:47 - 2014-06-13 01:34 - 00754176 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-10-16 13:47 - 2014-06-13 01:29 - 02146304 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-10-15 22:59 - 2014-10-16 16:42 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-15 22:59 - 2014-10-15 22:59 - 00001116 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-15 22:59 - 2014-10-15 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-10-15 22:59 - 2014-10-15 22:59 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-10-15 22:59 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-15 22:59 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-15 22:59 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-10-15 22:45 - 2014-10-15 22:58 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Elias\Downloads\mbam-setup-2.0.3.1025.exe
2014-09-25 20:35 - 2014-08-21 01:40 - 00732880 _____ (Microsoft Corporation) C:\windows\system32\NotificationUI.exe
2014-09-25 20:35 - 2014-08-20 19:05 - 00694784 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll
2014-09-25 20:35 - 2014-08-20 19:05 - 00198656 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.dll
2014-09-25 20:35 - 2014-08-20 19:05 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-25 20:35 - 2014-08-20 19:02 - 00567808 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll
2014-09-25 20:35 - 2014-08-20 19:02 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-25 20:35 - 2014-06-24 09:35 - 00010450 _____ () C:\windows\system32\autoconfig.cab
2014-09-25 20:35 - 2014-06-24 08:40 - 00125952 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2014-09-23 14:32 - 2014-08-09 10:30 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\poqexec.exe
2014-09-23 14:32 - 2014-08-09 10:29 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\tssdisai.dll
2014-09-20 14:44 - 2014-08-28 13:34 - 00059400 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2014-09-20 14:44 - 2014-08-28 08:05 - 00630272 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2014-09-20 14:44 - 2014-08-28 08:05 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2014-09-20 14:44 - 2014-08-28 08:05 - 00086528 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 03285504 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 01623552 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00253440 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00176640 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2014-09-20 14:44 - 2014-08-28 08:01 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\wuaext.dll
2014-09-20 14:44 - 2014-08-01 01:40 - 01287680 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
2014-09-20 14:44 - 2014-06-05 03:12 - 00678600 _____ (Microsoft Corporation) C:\windows\system32\msvcp120_clr0400.dll
2014-09-20 14:44 - 2014-06-04 01:12 - 00536776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcp120_clr0400.dll
2014-09-20 14:43 - 2014-08-28 08:05 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2014-09-20 14:43 - 2014-08-28 08:02 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2014-09-20 14:42 - 2014-07-24 05:33 - 00875688 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcr120_clr0400.dll
2014-09-20 14:42 - 2014-07-24 05:33 - 00869544 _____ (Microsoft Corporation) C:\windows\system32\msvcr120_clr0400.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-16 20:35 - 2012-12-18 20:05 - 00000000 ____D () C:\Users\Elias
2014-10-16 20:09 - 2012-12-21 16:10 - 00001126 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-16 20:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-10-16 19:54 - 2012-12-18 20:14 - 00003600 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3777642976-2438380877-1723110391-1002
2014-10-16 19:43 - 2014-02-18 21:26 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-16 19:42 - 2012-09-10 13:53 - 00000360 _____ () C:\windows\Tasks\Xerox PhotoCafe Communicator.job
2014-10-16 19:33 - 2012-09-10 13:47 - 00000000 ____D () C:\ProgramData\WinClon
2014-10-16 19:31 - 2013-01-06 23:19 - 00000000 ____D () C:\Users\Elias\AppData\Local\CrashDumps
2014-10-16 19:28 - 2012-12-21 16:10 - 00001122 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 19:27 - 2012-08-05 23:07 - 02609624 _____ () C:\windows\PFRO.log
2014-10-16 19:27 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-16 19:25 - 2012-09-10 12:50 - 01596177 _____ () C:\windows\WindowsUpdate.log
2014-10-16 17:08 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-10-16 17:06 - 2014-07-12 00:03 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-10-16 17:06 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-16 17:05 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ToastData
2014-10-16 15:20 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-10-16 15:17 - 2013-08-02 13:23 - 00000000 ____D () C:\windows\system32\MRT
2014-10-16 15:13 - 2012-12-19 19:14 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-15 15:58 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-10-14 14:33 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2014-10-14 12:36 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\WinStore
2014-10-13 22:32 - 2013-01-11 22:17 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\CyberLink
2014-10-13 22:07 - 2012-09-10 16:51 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-10-13 22:07 - 2012-09-10 16:51 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-10-13 22:07 - 2012-07-26 09:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-23 03:51 - 2013-08-21 12:37 - 00000000 ____D () C:\Program Files\Microsoft Office 15
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe
Some content of TEMP:
====================
C:\Users\Elias\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-15 15:02
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-10-2014
Ran by Elias at 2014-10-16 20:38:49
Running from C:\Users\Elias\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Allshare Play Link (HKLM-x32\...\{91786428-D4AA-476D-8AF9-A63FFAC2901F}) (Version: 1.0.0 - Samsung)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.1912 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.0.1912 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4421.02 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.4421.02 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Easy File Share (HKLM-x32\...\{A7C37D4B-F37A-42E8-9B6A-B28C18AD4C12}) (Version: 1.3.4 - Samsung Electronics CO.,LTD.)
E-POP (HKLM-x32\...\{F06DD8D9-9DC8-430C-835C-C9BF21E05CC1}) (Version: 1.0.1 - Samsung Electronics CO., LTD.)
ETDWare PS/2-X64 11.7.2.1_WHQL (HKLM\...\Elantech) (Version: 11.7.2.1 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Garry)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Help Desk (HKLM\...\{C85A891D-7AB4-46AE-84F0-B0C3FAC82280}) (Version: 1.0.4 - Samsung Electronics CO., LTD.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33070) (Version: 3.6.1.33070.11 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4649.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4649.1003 - Microsoft Corporation) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.206 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Raccolta foto (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6699 - Realtek Semiconductor Corp.)
Recovery (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.6.1 - Samsung Electronics CO., LTD.)
S Agent (Version: 1.0.7 - Samsung Electronics CO., LTD.) Hidden
Settings (HKLM-x32\...\{52E5DE60-C96B-42CC-9A37-FE04725940AE}) (Version: 2.0.0 - Samsung Electronics CO., LTD.)
Skypeâ„¢ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Support Center (HKLM\...\{C178F0E8-75AF-4C21-9828-98B9BED82470}) (Version: 2.0.10 - Samsung Electronics CO., LTD.)
Support Center FAQ (x32 Version: 1.0.1 - Samsung Electronics CO., LTD.) Hidden
SW Update (HKLM-x32\...\{ADC15B86-A3F8-4DE3-9E0A-047FF12D6941}) (Version: 2.0.18 - Samsung Electronics CO., LTD.)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH)
User Guide (HKLM-x32\...\{039EA659-E421-45C6-8913-BED5D69B5536}) (Version: 1.1.00 - Samsung Electronics CO., LTD.)
Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (07/27/2012 20.57.1.735) (HKLM\...\9F04C462DAB591BDCCE784F77E4D4F1736010B92) (Version: 07/27/2012 20.57.1.735 - Samsung Electronics Co. Ltd.)
Windows Live (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Live (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Xerox PhotoCafe (HKLM-x32\...\Xerox PhotoCafe) (Version: 1.0.0.6162 - Xerox)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Elias\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Elias\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Elias\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Elias\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3777642976-2438380877-1723110391-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Elias\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
23-09-2014 13:21:10 Windows Update
04-10-2014 08:29:21 Geplanter PrÃŒfpunkt
12-10-2014 19:00:25 Geplanter PrÃŒfpunkt
16-10-2014 13:09:17 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1BF73F2F-DE77-455E-8194-684BDF913FD6} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe
Task: {1DC19FEC-9FEB-4E10-80FA-27E0A2CDF341} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-09-05] (Samsung Electronics CO., LTD.)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {25C22EA6-5A35-41DF-AC3E-3F6B66C4C743} - System32\Tasks\SWUpdateAgent => C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2012-09-10] (Samsung Electronics CO., LTD.)
Task: {36AD045A-6280-4E32-AFB7-32522A1ED4D5} - System32\Tasks\Xerox PhotoCafe Communicator => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe [2011-10-26] ()
Task: {5DC1B6AC-055F-4242-9A52-030AB06B1CE0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-21] (Google Inc.)
Task: {724F273E-2E81-457B-9934-46F45BD79D6F} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-09-23] (Microsoft Corporation)
Task: {790C35F3-75F4-4AD0-8650-25BBF86C866A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-21] (Google Inc.)
Task: {7C71EB44-63F4-4D2A-8D3D-5A63BCF6A7A4} - System32\Tasks\WLANStartup => C:\Program Files (x86)\Samsung\Easy Settings\WLANStartup.exe
Task: {8D721332-7930-4B07-929C-520FE7350162} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2012-09-04] (SEC)
Task: {9F878B0D-1EC3-479C-B771-1D6AB6B1092E} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {B72E8F64-0F81-4204-B013-E92D755276B2} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install => C:\windows\system32\NotificationUI.exe [2014-08-21] (Microsoft Corporation)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CC4D69FE-D437-4F9F-BBEE-1141ABE1AB99} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-08-12] (Microsoft Corporation)
Task: {CFB835EF-0519-4369-B45D-2C47640A8D45} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-10-16] (Microsoft Corporation)
Task: {E07DDB21-6967-4443-8E38-0A9E1FA98B88} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe
Task: {E8C85F8D-DD83-4D0F-BEA4-E50FC068ECF5} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe
Task: {E913AE11-2953-4AA1-B2D9-7825FB9A4CC0} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {EA833489-F06D-4081-8B80-F8FEE934AC03} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2012-08-17] (Samsung Electronics CO., LTD.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Xerox PhotoCafe Communicator.job => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe
==================== Loaded Modules (whitelisted) =============
2014-03-19 07:14 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00085112 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
2012-08-10 11:28 - 2012-08-10 11:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-10 11:23 - 2012-08-10 11:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2012-08-16 04:26 - 2012-08-16 04:26 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-09-07 10:57 - 2012-09-07 10:57 - 04238968 _____ () C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
2014-10-16 20:33 - 2014-10-16 20:33 - 00050477 _____ () C:\Users\Elias\Downloads\Defogger.exe
2013-06-17 13:35 - 2013-06-17 13:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 15:52 - 2013-05-08 15:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00028792 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 01012856 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00026744 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00060536 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
2012-09-05 09:50 - 2012-09-05 09:50 - 00103544 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
2012-09-10 13:55 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 04:34 - 2012-06-08 04:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-09-25 02:13 - 2014-09-23 06:06 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libglesv2.dll
2014-09-25 02:13 - 2014-09-23 06:06 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\libegl.dll
2014-09-25 02:13 - 2014-09-23 06:07 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\pdf.dll
2014-09-25 02:13 - 2014-09-23 06:07 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll
2014-09-25 02:13 - 2014-09-23 06:06 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\ffmpegsumo.dll
2012-09-10 13:34 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKCU\...\StartupApproved\Run: => "Steam"
========================= Accounts: ==========================
Administrator (S-1-5-21-3777642976-2438380877-1723110391-500 - Administrator - Disabled)
Elias (S-1-5-21-3777642976-2438380877-1723110391-1002 - Administrator - Enabled) => C:\Users\Elias
Gast (S-1-5-21-3777642976-2438380877-1723110391-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-3777642976-2438380877-1723110391-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/16/2014 07:31:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Name des fehlerhaften Moduls: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Ausnahmecode: 0x40000015
Fehleroffset: 0x001b2fbb
ID des fehlerhaften Prozesses: 0xe10
Startzeit der fehlerhaften Anwendung: 0xSWMAgent.exe0
Pfad der fehlerhaften Anwendung: SWMAgent.exe1
Pfad des fehlerhaften Moduls: SWMAgent.exe2
Berichtskennung: SWMAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: SWMAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SWMAgent.exe5
Error: (10/16/2014 07:29:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Name des fehlerhaften Moduls: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Ausnahmecode: 0x40000015
Fehleroffset: 0x001b2fbb
ID des fehlerhaften Prozesses: 0xe8c
Startzeit der fehlerhaften Anwendung: 0xSWMAgent.exe0
Pfad der fehlerhaften Anwendung: SWMAgent.exe1
Pfad des fehlerhaften Moduls: SWMAgent.exe2
Berichtskennung: SWMAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: SWMAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SWMAgent.exe5
Error: (10/16/2014 07:28:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: BtvStack.exe, Version: 8.0.0.206, Zeitstempel: 0x5024e144
Name des fehlerhaften Moduls: audio.dll, Version: 8.0.0.206, Zeitstempel: 0x5024e1aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001ae08
ID des fehlerhaften Prozesses: 0xc84
Startzeit der fehlerhaften Anwendung: 0xBtvStack.exe0
Pfad der fehlerhaften Anwendung: BtvStack.exe1
Pfad des fehlerhaften Moduls: BtvStack.exe2
Berichtskennung: BtvStack.exe3
VollstÀndiger Name des fehlerhaften Pakets: BtvStack.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: BtvStack.exe5
Error: (10/16/2014 06:37:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm GuaranaMain.exe, Version 2.0.10.0 kann nicht mehr unter Windows ausgefÃŒhrt werden und wurde beendet. ÃœberprÃŒfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 12fc
Startzeit: 01cfe95caa9b0f17
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\Samsung\Support Center\GuaranaMain.exe
Berichts-ID: b5e83bea-5552-11e4-bf2b-20689d6d0e97
VollstÀndiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (10/16/2014 06:18:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Name des fehlerhaften Moduls: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Ausnahmecode: 0x40000015
Fehleroffset: 0x001b2fbb
ID des fehlerhaften Prozesses: 0x764
Startzeit der fehlerhaften Anwendung: 0xSWMAgent.exe0
Pfad der fehlerhaften Anwendung: SWMAgent.exe1
Pfad des fehlerhaften Moduls: SWMAgent.exe2
Berichtskennung: SWMAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: SWMAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SWMAgent.exe5
Error: (10/16/2014 06:17:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CommonAgent.exe, Version: 1.0.7.5, Zeitstempel: 0x502ddd20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x13a8
Startzeit der fehlerhaften Anwendung: 0xCommonAgent.exe0
Pfad der fehlerhaften Anwendung: CommonAgent.exe1
Pfad des fehlerhaften Moduls: CommonAgent.exe2
Berichtskennung: CommonAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: CommonAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CommonAgent.exe5
Error: (10/16/2014 05:27:56 PM) (Source: Python Service) (EventID: 255) (User: )
Description: Exception : HTTPConnectionPool(host='127.0.0.1', port=35600): Max retries exceeded with url: /run_scheduled_task (Caused by <class 'socket.error'>: [Errno 10061] Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte)
Error: (10/16/2014 05:15:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Name des fehlerhaften Moduls: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Ausnahmecode: 0x40000015
Fehleroffset: 0x001b2fbb
ID des fehlerhaften Prozesses: 0x1334
Startzeit der fehlerhaften Anwendung: 0xSWMAgent.exe0
Pfad der fehlerhaften Anwendung: SWMAgent.exe1
Pfad des fehlerhaften Moduls: SWMAgent.exe2
Berichtskennung: SWMAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: SWMAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SWMAgent.exe5
Error: (10/16/2014 05:15:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 37.0.2062.124, Zeitstempel: 0x5420d868
Name des fehlerhaften Moduls: chrome.dll, Version: 37.0.2062.124, Zeitstempel: 0x5420d5a6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00eb51f7
ID des fehlerhaften Prozesses: 0x1004
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
VollstÀndiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5
Error: (10/16/2014 05:14:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Name des fehlerhaften Moduls: SWMAgent.exe, Version: 2.0.18.47, Zeitstempel: 0x504d70fd
Ausnahmecode: 0x40000015
Fehleroffset: 0x001b2fbb
ID des fehlerhaften Prozesses: 0xc28
Startzeit der fehlerhaften Anwendung: 0xSWMAgent.exe0
Pfad der fehlerhaften Anwendung: SWMAgent.exe1
Pfad des fehlerhaften Moduls: SWMAgent.exe2
Berichtskennung: SWMAgent.exe3
VollstÀndiger Name des fehlerhaften Pakets: SWMAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SWMAgent.exe5
System errors:
=============
Error: (10/16/2014 07:32:23 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.
Error: (10/15/2014 01:09:45 AM) (Source: DCOM) (EventID: 10010) (User: Elias-PC)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (10/10/2014 03:19:34 PM) (Source: DCOM) (EventID: 10010) (User: Elias-PC)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (09/25/2014 03:40:12 AM) (Source: DCOM) (EventID: 10010) (User: Elias-PC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (09/25/2014 03:40:12 AM) (Source: DCOM) (EventID: 10010) (User: Elias-PC)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (09/25/2014 03:40:06 AM) (Source: DCOM) (EventID: 10010) (User: Elias-PC)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (09/24/2014 03:49:21 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu fÃŒhren, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden fÃŒr das TLS-Protokoll definierten Code: 70. Der Windows-SChannel-Fehlerstatus lautet: 105.
Error: (09/22/2014 04:12:15 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine TransaktionsrÃŒckmeldung von Dienst ClickToRunSvc erreicht.
Error: (09/11/2014 00:57:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/11/2014 00:57:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Microsoft Office Sessions:
=========================
Error: (10/16/2014 07:31:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SWMAgent.exe2.0.18.47504d70fdSWMAgent.exe2.0.18.47504d70fd40000015001b2fbbe1001cfe966ff80a3fdC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exeC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe4c26524a-555a-11e4-bf2c-20689d6d0e97
Error: (10/16/2014 07:29:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SWMAgent.exe2.0.18.47504d70fdSWMAgent.exe2.0.18.47504d70fd40000015001b2fbbe8c01cfe9668db615e2C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exeC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exef943b12d-5559-11e4-bf2c-20689d6d0e97
Error: (10/16/2014 07:28:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: BtvStack.exe8.0.0.2065024e144audio.dll8.0.0.2065024e1aac0000005000000000001ae08c8401cfe966969fdbd0C:\Program Files (x86)\Bluetooth Suite\BtvStack.exeC:\Program Files (x86)\Bluetooth Suite\Modules\Audio\audio.dlldcba32f3-5559-11e4-bf2c-20689d6d0e97
Error: (10/16/2014 06:37:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: GuaranaMain.exe2.0.10.012fc01cfe95caa9b0f174294967295C:\Program Files\Samsung\Support Center\GuaranaMain.exeb5e83bea-5552-11e4-bf2b-20689d6d0e97
Error: (10/16/2014 06:18:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SWMAgent.exe2.0.18.47504d70fdSWMAgent.exe2.0.18.47504d70fd40000015001b2fbb76401cfe95cd004e046C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exeC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe0fa6214a-5550-11e4-bf2b-20689d6d0e97
Error: (10/16/2014 06:17:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CommonAgent.exe1.0.7.5502ddd20unknown0.0.0.000000000c0000005000000000000000013a801cfe953ad35b791C:\Program Files\Samsung\S Agent\CommonAgent.exeunknownec8b9fd2-554f-11e4-bf2b-20689d6d0e97
Error: (10/16/2014 05:27:56 PM) (Source: Python Service) (EventID: 255) (User: )
Description: Exception : HTTPConnectionPool(host='127.0.0.1', port=35600): Max retries exceeded with url: /run_scheduled_task (Caused by <class 'socket.error'>: [Errno 10061] Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte)
Error: (10/16/2014 05:15:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SWMAgent.exe2.0.18.47504d70fdSWMAgent.exe2.0.18.47504d70fd40000015001b2fbb133401cfe953fbe261ebC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exeC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe39961507-5547-11e4-bf2b-20689d6d0e97
Error: (10/16/2014 05:15:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe37.0.2062.1245420d868chrome.dll37.0.2062.1245420d5a6c000000500eb51f7100401cfe953f278f0efC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\37.0.2062.124\chrome.dll34dc8570-5547-11e4-bf2b-20689d6d0e97
Error: (10/16/2014 05:14:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SWMAgent.exe2.0.18.47504d70fdSWMAgent.exe2.0.18.47504d70fd40000015001b2fbbc2801cfe9538f599693C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exeC:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe222b9798-5547-11e4-bf2b-20689d6d0e97
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 40%
Total physical RAM: 3797.53 MB
Available physical RAM: 2251.03 MB
Total Pagefile: 6869.53 MB
Available Pagefile: 4289.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:440.49 GB) (Free:367.89 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-16 21:00:54
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000003d rev. 0,00MB
Running: Gmer-19357 (1).exe; Driver: C:\Users\Elias\AppData\Local\Temp\kgloapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3760] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8e5371532 4 bytes [37, E5, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3760] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8e537153a 4 bytes [37, E5, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3760] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8e537165a 4 bytes [37, E5, F8, 07]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlLeaveCriticalSection + 61 000007f8eb33104d 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlEnterCriticalSection + 39 000007f8eb331087 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlGetCurrentUmsThread + 77 000007f8eb3310dd 40 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!_local_unwind + 36 000007f8eb331164 32 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!memcmp + 199 000007f8eb331257 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strcat + 144 000007f8eb331300 16 bytes {JMP 0xffffffffffffff8c}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strcpy + 183 000007f8eb3313d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strlen + 168 000007f8eb331558 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strncat + 405 000007f8eb331705 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strncmp + 181 000007f8eb3317d5 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!strncpy + 354 000007f8eb331952 48 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlGetCurrentProcessorNumberEx + 52 000007f8eb3319e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtdllDialogWndProc_W + 601 000007f8eb331dae 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!DbgUserBreakPoint + 99 000007f8eb331e33 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlInterlockedPushListSList + 118 000007f8eb332056 48 bytes {JMP 0xffffffffffffffc0}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!RtlpUmsExecuteYieldThreadEnd + 403 000007f8eb332574 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!__chkstk + 77 000007f8eb3325dd 40 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!_setjmp + 160 000007f8eb3326b0 16 bytes {JMP RAX}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!longjmp + 236 000007f8eb33285c 32 bytes {JMP 0xffffffffffffffb9}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000007f8eb332c70 8 bytes {JMP QWORD [RIP-0xc6]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000007f8eb332df0 8 bytes {JMP QWORD [RIP-0x23e]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8eb332e20 8 bytes {JMP QWORD [RIP-0x317]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8eb332f40 8 bytes {JMP QWORD [RIP-0x39e]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000007f8eb332ff0 8 bytes {JMP QWORD [RIP-0x4df]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000007f8eb3336b1 5 bytes [FF, 25, E5, 0F, 00]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 6 000007f8eb3336b7 2 bytes [90, 90]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread 000007f8eb333991 5 bytes [FF, 25, FD, 0C, 00]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread + 6 000007f8eb333997 2 bytes [90, 90]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8eb334211 8 bytes {JMP QWORD [RIP+0x475]}
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\SYSTEM32\ntdll.dll!NtWaitLowEventPair + 11 000007f8eb33468c 24 bytes [C0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuProcessInit + 616 00000000770e15f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuProcessTerm + 3 00000000770e15fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuResetToConsistentState + 272 00000000770e17d4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuSetContext + 140 00000000770e18c4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000770e18e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000770e1903 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000770e1923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000770e195f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000770e196b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Elias\Downloads\Gmer-19357 (1).exe[5604] C:\windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000770e1977 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\csrss.exe [748:772] fffff960007675e8
---- Processes - GMER 2.1 ----
Library C:\Program Files\WindowsApps\Microsoft.SkypeApp_1.9.0.2016_x86__kzf8qxf38zg5c\LibWrap.dll (*** suspicious ***) @ C:\windows\syswow64\wwahost.exe [4704] (Microsoft Skype/Microsoft Corporation)(2014-02-02 21:03:11) 000000005dd00000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
Disk \Device\Harddisk0\DR0 sector 0: rootkit-like behavior
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 8: langsames Internet und Umleitungen auf Werbeseiten |
| adware, bestimmte seiten, cpu, ebanking, fehlercode 0x40000015, fehlercode 0xc0000005, fehlercode 70, iexplore.exe, installation, internet langsam, kaspersky, mozilla, office 365, problem, programm, realtek, registry, security, software, svchost.exe, system, umleitung auf andere seiten, warnung, win32/installcore.jw, windows, windowsapps |
Baum-Darstellung