| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Große Anzahl an Adware entdeckt.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.11.2014, 20:39
| #1 |
| |  Große Anzahl an Adware entdeckt. Hallo, Seit schon längerer Zeit funktioniert mein Computer nicht mehr so wie ich mir das wünsche. Er hängt sich öfters auf und arbeitet manchmal ziemlich langsam. Manchmal kommt es auch dazu, dass mein Windows explorer sich aufhängt und einfach abstürzt. Oft passiert das wenn ich externe Geräte anschließen und diese öffnen will. Habe heute mal Malwarebytes durchlaufen lassen und erschreckenderweise feststellen müssen, dass bis zu 75 Elemente in Form von Adware gefunden wurden. Geht eine große Gefahr von diesen Elementen aus? Können sie der Grund dafür sein, dass mein Computer nicht mehr so richtig funktioniert? Hier die Logdatei vom Suchlauf: PHP-Code:  |
|
30.11.2014, 20:39
| #2 |
| /// the machine /// TB-Ausbilder    | Große Anzahl an Adware entdeckt. hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
30.11.2014, 21:02
| #3 |
| | Große Anzahl an Adware entdeckt. Hier die Ergebnisse des Scans:
__________________FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-11-2014 Ran by Alex (administrator) on ALEX-PC on 30-11-2014 20:55:29 Running from C:\Users\Alex\Downloads Loaded Profiles: Alex & DefaultAppPool & (Available profiles: Alex & DefaultAppPool) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\System32\CISVC.EXE (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe (Scarlet.Crush Productions) C:\Users\Alex\AppData\Local\Temp\Rar$EXa0.355\ScpServer\bin\ScpService.exe (Microsoft Corporation) C:\Windows\System32\mqsvc.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe (Speedbit Ltd.) C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe (Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe () C:\Spiele\MX Simulator\mx.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-06] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.) HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\Run: [Google Update] => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-08] (Google Inc.) HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\MountPoints2: {fff6b530-57ed-11e2-b9c3-6cf0497154b9} - E:\starter.exe HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Google Update] => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-08] (Google Inc.) HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {fff6b530-57ed-11e2-b9c3-6cf0497154b9} - E:\starter.exe IFEO\jumpflip: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe InternetURL: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.com.url -> C:\ProgramData\27218346293184.exe ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD8B6BF72EABDCD01 HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD8B6BF72EABDCD01 HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1397287622&from=smt&uid=WDCXWD5000AAKS-00UU3A0_WD-WCAYU609058390583&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1397287622&from=smt&uid=WDCXWD5000AAKS-00UU3A0_WD-WCAYU609058390583&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1397287622&from=smt&uid=WDCXWD5000AAKS-00UU3A0_WD-WCAYU609058390583&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1397287622&from=smt&uid=WDCXWD5000AAKS-00UU3A0_WD-WCAYU609058390583&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=102&systemid=473&v=a12627-348&apn_uid=9305348933204234&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKLM -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms} SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=28239e8d-d2ff-4b66-a95b-e8196a206f07&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms} SearchScopes: HKLM-x32 -> {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=102&systemid=473&v=a12627-348&apn_uid=9305348933204234&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> DefaultScope {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=28239e8d-d2ff-4b66-a95b-e8196a206f07&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=102&systemid=473&v=a12627-348&apn_uid=9305348933204234&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=28239e8d-d2ff-4b66-a95b-e8196a206f07&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=102&systemid=473&v=a12627-348&apn_uid=9305348933204234&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll () FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=3 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=9 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\Ask.xml FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\google-maps.xml FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\icqplugin.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml FF Extension: Avira Browser Safety - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\abs@avira.com [2014-11-19] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20] FF Extension: Adblock Plus - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-04] FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2013-02-22] Chrome: ======= CHR HomePage: Default -> CHR DefaultSearchKeyword: Default -> CHR DefaultSearchURL: Default -> CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04] CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-03-04] CHR Extension: (Google Wallet) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08] CHR Extension: (Speedbit New Tab) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\palpbfjgianahgbbeodmcohjdmaelbeo [2013-10-18] CHR HKLM-x32\...\Chrome\Extension: [palpbfjgianahgbbeodmcohjdmaelbeo] - C:\Program Files\Common Files\SpeedBit\SBUpdate\SpeedbitNewTab.crx [2013-10-06] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG) S2 appdrvrem01; C:\Windows\System32\appdrvrem01.exe [551896 2014-08-13] (Protection Technology) R2 Ds3Service; C:\Users\Alex\AppData\Local\Temp\Rar$EXa0.355\ScpServer\bin\ScpService.exe [381952 2014-03-13] (Scarlet.Crush Productions) [File not signed] R2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation) R2 MSMQ; C:\Windows\system32\mqsvc.exe [9216 2009-07-14] (Microsoft Corporation) R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [64512 2010-11-26] (Nalpeiron Ltd.) [File not signed] R2 SBUpd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe [2541688 2014-03-04] (Speedbit Ltd.) R2 simptcp; C:\Windows\SysWOW64\tcpsvcs.exe [9216 2009-07-14] (Microsoft Corporation) R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation) R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation) S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices) S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices) R1 appdrv01; C:\Windows\System32\Drivers\appdrv01.sys [3852976 2014-08-13] (Protection Technology) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG) R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] () R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-01-06] (DT Soft Ltd) R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2010-01-29] (EZB Systems, Inc.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-30] (Malwarebytes Corporation) R3 MQAC; C:\Windows\System32\drivers\mqac.sys [189440 2009-07-14] (Microsoft Corporation) R3 SBUpdd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys [41368 2014-03-04] () R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions) S3 VF0470Vid; C:\Windows\System32\DRIVERS\V0470Vid.sys [183200 2007-05-09] (Creative Technology Ltd.) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-30 20:55 - 2014-11-30 20:55 - 00021868 _____ () C:\Users\Alex\Downloads\FRST.txt 2014-11-30 20:54 - 2014-11-30 20:55 - 00000000 ____D () C:\FRST 2014-11-30 20:54 - 2014-11-30 20:54 - 02117120 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe 2014-11-30 20:43 - 2014-11-30 20:43 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\AMD 2014-11-30 14:27 - 2014-11-30 14:27 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-30 14:05 - 2014-11-30 14:05 - 00000000 ____D () C:\ProgramData\ATI 2014-11-30 14:04 - 2014-11-30 14:04 - 00061880 _____ () C:\Windows\SysWOW64\CCCInstall_201411301404017876.log 2014-11-30 14:04 - 2014-11-30 14:04 - 00000000 ____D () C:\Program Files (x86)\AMD AVT 2014-11-30 14:03 - 2014-11-30 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2014-11-30 13:57 - 2014-11-30 13:59 - 00000000 ____D () C:\Windows\LastGood 2014-11-30 13:41 - 2014-11-30 13:41 - 00891224 _____ (AMD) C:\Users\Alex\Downloads\amddriverdownloader.exe 2014-11-29 21:34 - 2014-11-30 13:59 - 00000551 _____ () C:\Windows\setupact.log 2014-11-29 21:34 - 2014-11-29 21:34 - 00000000 _____ () C:\Windows\setuperr.log 2014-11-29 21:32 - 2014-11-29 21:32 - 00003406 _____ () C:\Windows\PFRO.log 2014-11-29 17:04 - 2014-11-29 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID 2014-11-29 17:04 - 2014-11-29 17:04 - 00000000 ____D () C:\Program Files\CPUID 2014-11-29 17:03 - 2014-11-29 17:03 - 01439184 _____ ( ) C:\Users\Alex\Downloads\cpu-z_1.65-setup-en.exe 2014-11-29 16:10 - 2014-11-29 16:10 - 00000000 ____D () C:\Windows\system32\IO 2014-11-29 14:22 - 2014-11-29 14:22 - 00163004 _____ () C:\Users\Alex\Downloads\ShellExView-1.90.zip 2014-11-29 14:21 - 2014-11-29 14:21 - 01174352 _____ () C:\Users\Alex\Downloads\ShellExView - CHIP-Installer.exe 2014-11-28 19:59 - 2014-11-28 19:59 - 03067725 _____ () C:\Users\Alex\Downloads\bike skins 250 and 450 in pic.rar 2014-11-28 17:13 - 2014-11-28 17:14 - 17522790 _____ () C:\Users\Alex\Downloads\Zyphar - beta (1).rar 2014-11-28 15:05 - 2014-11-28 15:06 - 42925792 _____ () C:\Users\Alex\Downloads\CYCLONE RACEABLE.rar 2014-11-26 22:14 - 2014-11-26 22:16 - 57639524 _____ () C:\Users\Alex\Downloads\Dirtpark Compound.rar 2014-11-25 20:06 - 2014-11-25 20:06 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamNG-Techdemo-0.3 2014-11-25 20:05 - 2014-11-25 20:05 - 00000000 ____D () C:\Users\Alex\AppData\Local\BeamNG 2014-11-25 20:02 - 2014-11-25 20:05 - 98903976 _____ () C:\Users\Alex\Downloads\BeamNG-Techdemo-0.3-setup.exe 2014-11-24 15:00 - 2014-11-24 15:02 - 84544613 _____ () C:\Users\Alex\Downloads\1348750252.rar 2014-11-24 12:20 - 2014-11-24 12:20 - 31705850 _____ () C:\Users\Alex\Downloads\Muddy Creek MX.rar 2014-11-24 12:12 - 2014-11-24 12:13 - 31246928 _____ () C:\Users\Alex\Downloads\The Test Facility 2.zip 2014-11-24 11:56 - 2014-11-24 11:57 - 26234271 _____ () C:\Users\Alex\Downloads\BEAUMONT NATIONAL MX.rar 2014-11-24 11:56 - 2014-11-24 11:57 - 15007119 _____ () C:\Users\Alex\Downloads\Veinge Sand track.rar 2014-11-24 11:31 - 2014-11-24 11:31 - 17241905 _____ () C:\Users\Alex\Downloads\City Sx.rar 2014-11-22 17:06 - 2014-11-22 17:06 - 33274722 _____ () C:\Users\Alex\Downloads\GRS National.rar 2014-11-22 15:47 - 2014-11-22 15:48 - 40020317 _____ () C:\Users\Alex\Downloads\Sand Double.rar 2014-11-17 17:07 - 2014-11-17 17:08 - 23597656 _____ () C:\Users\Alex\Downloads\Revolt Mx.rar 2014-11-17 17:06 - 2014-11-17 17:08 - 17522790 _____ () C:\Users\Alex\Downloads\Zyphar - beta.rar 2014-11-17 17:05 - 2014-11-17 17:08 - 40295355 _____ () C:\Users\Alex\Downloads\Bercy Sx 2014.rar 2014-11-17 12:14 - 2014-11-17 12:15 - 10006992 _____ () C:\Users\Alex\Downloads\BercyLilleParis.rar 2014-11-16 19:22 - 2014-11-16 19:23 - 31939751 _____ () C:\Users\Alex\Downloads\Kinco Komplex SX 1.rar 2014-11-16 16:42 - 2014-11-16 16:42 - 00005269 _____ () C:\Users\Alex\AppData\Local\recently-used.xbel 2014-11-16 16:29 - 2014-07-16 21:40 - 06291510 _____ () C:\Users\Alex\Desktop\MXRider_Jersey_wireframe.bmp 2014-11-16 15:57 - 2014-11-16 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MX Reflex Skin packager 2014-11-16 15:57 - 2014-11-16 15:57 - 00000000 ____D () C:\Program Files (x86)\ReflexSkinDLCCreator 2014-11-15 18:32 - 2014-11-15 18:32 - 01125200 _____ () C:\Users\Alex\Downloads\SharePod - CHIP-Installer.exe 2014-11-14 19:23 - 2014-11-14 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\Program Files\iTunes 2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-11-14 19:22 - 2014-11-14 19:22 - 00000000 ____D () C:\Program Files\iPod 2014-11-14 18:46 - 2014-11-14 18:46 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf 2014-11-14 15:35 - 2014-11-14 15:35 - 00024744 _____ () C:\Users\Alex\Downloads\15million_savegame (1).bxml 2014-11-14 15:34 - 2014-11-14 15:34 - 00024744 _____ () C:\Users\Alex\Downloads\15million_savegame.bxml 2014-11-13 20:22 - 2014-11-29 16:09 - 00000000 ____D () C:\Users\Alex\Documents\RZDB 2014-11-13 20:22 - 2014-11-13 20:22 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mursoft 2014-11-13 20:22 - 2014-11-13 20:22 - 00000000 ____D () C:\Program Files (x86)\MURSOFT 2014-11-13 20:19 - 2014-11-13 20:20 - 16962607 _____ () C:\Users\Alex\Downloads\RZ6DemoSetup.zip 2014-11-12 21:31 - 2014-11-12 21:32 - 11037025 _____ () C:\Users\Alex\Downloads\AMA Bike Skin Pack.zip 2014-11-12 21:31 - 2014-11-12 21:32 - 06352127 _____ () C:\Users\Alex\Downloads\Mototanks bike skin pack 8 1 2014.zip 2014-11-12 21:11 - 2014-11-12 21:13 - 39519896 _____ () C:\Users\Alex\Downloads\2014 Anaheim 3 Supercross.rar 2014-11-12 20:31 - 2014-11-14 20:16 - 00000000 ____D () C:\ProgramData\Norton 2014-11-12 20:05 - 2014-11-12 20:05 - 00000839 _____ () C:\Users\Alex\Downloads\photoelectric_de (1).jnlp 2014-11-12 19:34 - 2014-11-12 19:34 - 00000839 _____ () C:\Users\Alex\Downloads\photoelectric_de.jnlp 2014-11-12 19:31 - 2014-11-12 19:31 - 05008056 _____ (Adobe Systems Inc.) C:\Users\Alex\Downloads\Shockwave_Installer_Slim(1).exe 2014-11-12 19:31 - 2014-11-12 19:31 - 00000000 ____D () C:\Windows\SysWOW64\Adobe 2014-11-12 19:07 - 2014-11-12 19:07 - 05008056 _____ (Adobe Systems Inc.) C:\Users\Alex\Downloads\Shockwave_Installer_Slim.exe 2014-11-12 18:39 - 2014-11-12 18:39 - 00239104 _____ () C:\Users\Alex\Downloads\Abmeldung.dot 2014-11-11 14:48 - 2014-11-11 14:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-09 16:21 - 2014-11-09 16:38 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\TS3Client 2014-11-03 23:20 - 2014-11-24 14:15 - 00016896 _____ () C:\Users\Alex\Documents\Mappe1.xls 2014-11-02 20:04 - 2014-11-02 23:01 - 00000000 ____D () C:\Users\Alex\AppData\Local\Linkage ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-30 20:16 - 2012-11-08 21:24 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA.job 2014-11-30 20:11 - 2013-04-10 13:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-30 19:18 - 2012-11-08 20:09 - 01267809 _____ () C:\Windows\WindowsUpdate.log 2014-11-30 19:16 - 2012-11-08 21:24 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core.job 2014-11-30 14:27 - 2014-05-26 13:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-30 14:27 - 2014-05-26 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-30 14:27 - 2014-05-26 13:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-30 14:04 - 2012-11-08 21:05 - 00000000 ____D () C:\ProgramData\AMD 2014-11-30 14:03 - 2014-01-03 23:32 - 00000000 ____D () C:\Program Files\ATI Technologies 2014-11-30 13:54 - 2014-01-03 23:33 - 00000000 ____D () C:\ProgramData\Package Cache 2014-11-30 13:50 - 2013-02-05 14:28 - 00000000 ____D () C:\AMD 2014-11-30 12:51 - 2012-11-20 21:12 - 00000000 ____D () C:\Users\Alex\AppData\Local\Adobe 2014-11-30 12:48 - 2009-07-14 05:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-30 12:48 - 2009-07-14 05:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-30 12:45 - 2012-11-08 21:22 - 00000000 ____D () C:\Users\Alex\Desktop\Spiele 2014-11-30 12:44 - 2009-07-14 18:58 - 00744870 _____ () C:\Windows\system32\perfh007.dat 2014-11-30 12:44 - 2009-07-14 18:58 - 00162742 _____ () C:\Windows\system32\perfc007.dat 2014-11-30 12:44 - 2009-07-14 06:13 - 01728398 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-30 12:37 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-29 22:16 - 2012-11-08 21:22 - 00000000 ____D () C:\Users\Alex\Desktop\Programme 2014-11-29 22:15 - 2012-11-08 21:28 - 00000000 ____D () C:\Spiele 2014-11-29 16:36 - 2012-11-08 22:47 - 00000000 ____D () C:\ProgramData\Adobe 2014-11-29 16:30 - 2013-11-01 22:01 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-11-29 16:27 - 2012-11-19 07:29 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-11-29 16:26 - 2013-10-13 16:08 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-11-29 16:21 - 2013-11-01 22:05 - 00000000 ____D () C:\Program Files\Adobe 2014-11-29 16:20 - 2014-02-16 18:05 - 00000000 ____D () C:\Users\Alex\AppData\Local\Unity 2014-11-29 16:17 - 2014-05-19 20:36 - 00001615 _____ () C:\Windows\VPNUnInstall.MIF 2014-11-29 16:11 - 2012-11-09 09:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-11-29 16:11 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-11-29 16:09 - 2014-07-27 14:17 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-11-29 16:09 - 2013-09-29 16:50 - 00000000 ____D () C:\Program Files (x86)\Google 2014-11-29 16:09 - 2012-11-08 21:24 - 00000000 ____D () C:\Users\Alex\AppData\Local\Google 2014-11-29 16:08 - 2014-07-27 14:17 - 00000000 ____D () C:\ProgramData\Origin 2014-11-26 16:11 - 2013-04-10 13:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-26 16:11 - 2012-11-08 22:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-26 16:11 - 2012-11-08 22:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-24 14:17 - 2013-05-25 15:17 - 00000000 ____D () C:\Users\Alex\Documents\Algodoo 2014-11-24 14:04 - 2012-11-08 20:36 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-11-18 18:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-16 19:11 - 2012-11-08 21:24 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA 2014-11-16 19:11 - 2012-11-08 21:24 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core 2014-11-16 16:44 - 2012-11-09 17:22 - 00000000 ____D () C:\Users\Alex\.gimp-2.8 2014-11-16 16:42 - 2013-10-19 18:19 - 00000000 ____D () C:\Users\Alex\AppData\Local\gtk-2.0 2014-11-14 19:22 - 2014-05-21 20:53 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-11-14 19:22 - 2012-11-09 19:09 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-11-12 21:14 - 2014-10-05 12:29 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\XnView 2014-11-12 19:35 - 2012-11-08 22:47 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-11-11 17:54 - 2014-06-27 17:15 - 00000000 ____D () C:\Windows\Minidump 2014-11-11 17:54 - 2013-01-06 11:49 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\DAEMON Tools Lite 2014-11-11 17:42 - 2012-11-08 20:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-09 22:56 - 2012-11-08 21:34 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Skype 2014-11-03 08:09 - 2014-10-30 09:23 - 00000000 ____D () C:\Users\Alex\Desktop\MX VS ATV 2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linkage X3 Demo 2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\ProgramData\Linkage 2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\Program Files (x86)\LinkageX3Demo 2014-11-01 16:20 - 2012-11-19 07:29 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk Some content of TEMP: ==================== C:\Users\Alex\AppData\Local\Temp\amd-catalyst-14-9-win7-win8.1-64bit-dd-ccc-whql.exe C:\Users\Alex\AppData\Local\Temp\AutoRun.exe C:\Users\Alex\AppData\Local\Temp\AutoRunGUI.dll C:\Users\Alex\AppData\Local\Temp\avgnt.exe C:\Users\Alex\AppData\Local\Temp\Creative Cloud Helper.exe C:\Users\Alex\AppData\Local\Temp\CreativeCloudSet-Up.exe C:\Users\Alex\AppData\Local\Temp\drm_dyndata_7400009.dll C:\Users\Alex\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwy5lu2.dll C:\Users\Alex\AppData\Local\Temp\SHSetup.exe C:\Users\Alex\AppData\Local\Temp\SIntf16.dll C:\Users\Alex\AppData\Local\Temp\SIntf32.dll C:\Users\Alex\AppData\Local\Temp\SIntfNT.dll C:\Users\Alex\AppData\Local\Temp\{397E31AA-0D78-4649-A01C-339D73A2ED35}_NSS_7622.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-25 20:32 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2014
Ran by Alex at 2014-11-30 20:56:13
Running from C:\Users\Alex\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.5970 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Illustrator CC 2014 (HKLM-x32\...\{2B4B4082-8043-4646-8334-B0A29E641211}) (Version: 18.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.4.154 - Adobe Systems, Inc.)
Algodoo v2.1.0 (HKLM-x32\...\Algodoo_is1) (Version: - Algoryx)
AMD Catalyst Install Manager (HKLM\...\{C2956908-53A3-88FC-B795-B16508296FC4}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
BeamNG-Techdemo-0.3 (remove only) (HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\BeamNG-Techdemo-0.3) (Version: - )
BeamNG-Techdemo-0.3 (remove only) (HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\BeamNG-Techdemo-0.3) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CPUID CPU-Z 1.65.1 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
Creative Live! Cam Notebook (VF0470) Driver (1.03.01.00) (HKLM\...\Creative VF0470) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.18 - Piriform)
Dropbox (HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version: - Trendy Entertainment)
FlatOut2 (HKLM-x32\...\{C884B05A-F5D9-4AE4-9D84-E6BD9F6E7890}) (Version: 1.00.0000 - Ihr Firmenname)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
Free YouTube Download version 3.2.0.128 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.0.128 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.0.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
Game Booster 3 (HKLM-x32\...\Game Booster_is1) (Version: 3.4 - IObit)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Chrome (HKU\S-1-5-21-130873077-1766887506-2883398934-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Linkage X3 Demo Version (HKLM-x32\...\Linkage Demo X3_is1) (Version: - Racooz Software)
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
MotoGP(TM)13 (HKLM-x32\...\{4B784CE7-7CDB-4AF1-B636-2DC3EA51EA87}) (Version: 1.00.0000 - Milestone)
MotoGP(TM)13 (x32 Version: 1.00.0000 - Milestone) Hidden
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MX Reflex Skin packager version 0.9.5.1 (HKLM-x32\...\{951ED83A-47A3-4FAD-B7DF-4A8BCB453589}_is1) (Version: 0.9.5.1 - Strawberry Software)
MX Simulator (HKLM-x32\...\MX Simulator) (Version: - )
MX vs ATV Reflex (HKLM-x32\...\Steam App 55140) (Version: - Double Helix Games)
MXGP - The Official Motocross Videogame (HKLM-x32\...\Steam App 256370) (Version: - Milestone S.r.l.)
Next Car Game Free Technology Demo (HKLM-x32\...\Next Car Game Free Technology Demo) (Version: - Bugbear Entertainment)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Richard Burns Rally (HKLM-x32\...\{92C7D009-A464-4948-A980-7A3E28CB2F49}) (Version: 1.00.000 - )
RollerCoaster Tycoon 3 (HKLM-x32\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
RSRBR2014 (HKLM-x32\...\RSRBR_v2014_is1) (Version: - RallyeSim)
RuckZuck Demo (HKLM-x32\...\{79BB1F79-F4D6-4E20-909F-30F41F30F113}) (Version: 6.0.12 - MURSOFT)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)
UltraISO Premium V9.53 (HKLM-x32\...\UltraISO_is1) (Version: - )
Vegas Pro 11.0 (64-bit) (HKLM\...\{31A6FA40-E935-11E0-95F9-F04DA23A5C58}) (Version: 11.0.371 - Sony)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Works Suite-Betriebssystem-Pack (x32 Version: 1.0.0.0000 - Microsoft Corporation) Hidden
Works-Synchronisierung (x32 Version: 1.0.0.0000 - Firmenname) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-130873077-1766887506-2883398934-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Alex\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
23-11-2014 18:00:11 Windows-Sicherung
29-11-2014 15:15:37 Removed Advanced PDF Password Recovery
29-11-2014 15:17:22 Removed Cisco Systems VPN Client 5.0.07.0290
30-11-2014 11:53:51 Windows Update
30-11-2014 12:53:01 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
30-11-2014 12:53:29 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04EA335A-E194-4022-989E-F68DCFA9AF1B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {0ADD8866-3A52-45B7-B299-3A9E28024AD2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-08] (Google Inc.)
Task: {1ADAA807-B2EF-4F39-8016-12F023CB9537} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {5A076AA7-26DF-47F5-9794-87EB84F9BE4A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {849B5B99-AB83-4543-A840-23DB4A0F2D34} - System32\Tasks\{02634E60-0915-4511-AFF1-B5E06F5A781F} => C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe [2014-11-06] (Avira Operations GmbH & Co. KG)
Task: {AE246119-5F29-4DD6-BBB8-E57A4347BAEA} - System32\Tasks\{25A66D4B-3446-45A3-8E16-1DD9479C48ED} => C:\Program Files\Pro Engineer 5.0\bin\proe.exe [2013-11-24] (PTC Inc.)
Task: {E096B0C3-7938-420B-809C-BC696A88C96B} - System32\Tasks\AdobeAAMUpdater-1.0-Alex-PC-Alex => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)
Task: {F81DC58E-EA7E-4CE5-B3BD-24B1ABDDD3D8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-08] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core.job => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA.job => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-05-23 01:10 - 2014-05-23 01:10 - 00671904 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2014-09-15 18:13 - 2014-09-15 18:13 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-01-02 01:20 - 2014-01-02 01:20 - 01183744 _____ () C:\Spiele\MX Simulator\mx.exe
2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-03-23 13:26 - 2010-03-23 13:26 - 00201512 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2014-03-04 09:36 - 2014-03-04 09:36 - 00525944 _____ () C:\Program Files\Common Files\SpeedBit\SBUpdate\sbfi32.dll
2014-11-11 14:48 - 2014-11-11 14:48 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^vpngui.exe.lnk => C:\Windows\pss\vpngui.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Alex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Alex^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Rainmeter - Verknüpfung.lnk => C:\Windows\pss\Rainmeter - Verknüpfung.lnk.Startup
MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: Google Update => "C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: ICQ => "C:\Program Files (x86)\ICQ7M\ICQ.exe" silent loginmode=4
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Ocs_SM => C:\Users\Alex\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Start WingMan Profiler => C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: V0470Mon.exe => C:\Windows\V0470Mon.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-130873077-1766887506-2883398934-500 - Administrator - Disabled)
Alex (S-1-5-21-130873077-1766887506-2883398934-1001 - Administrator - Enabled) => C:\Users\Alex
Gast (S-1-5-21-130873077-1766887506-2883398934-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-130873077-1766887506-2883398934-1002 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/30/2014 08:43:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mx.exe, Version: 0.0.0.0, Zeitstempel: 0x52c32e09
Name des fehlerhaften Moduls: mx.exe, Version: 0.0.0.0, Zeitstempel: 0x52c32e09
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000990cc
ID des fehlerhaften Prozesses: 0xaf4
Startzeit der fehlerhaften Anwendung: 0xmx.exe0
Pfad der fehlerhaften Anwendung: mx.exe1
Pfad des fehlerhaften Moduls: mx.exe2
Berichtskennung: mx.exe3
Error: (11/30/2014 00:52:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mx.exe, Version: 0.0.0.0, Zeitstempel: 0x52c32e09
Name des fehlerhaften Moduls: mx.exe, Version: 0.0.0.0, Zeitstempel: 0x52c32e09
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000990cc
ID des fehlerhaften Prozesses: 0xe30
Startzeit der fehlerhaften Anwendung: 0xmx.exe0
Pfad der fehlerhaften Anwendung: mx.exe1
Pfad des fehlerhaften Moduls: mx.exe2
Berichtskennung: mx.exe3
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
System errors:
=============
Error: (11/30/2014 02:02:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.3" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/30/2014 00:37:39 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (11/30/2014 00:37:33 PM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.
Error: (11/29/2014 09:34:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (11/29/2014 09:34:49 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.
Error: (11/29/2014 09:34:13 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (11/29/2014 09:34:09 PM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.
Error: (11/29/2014 11:37:08 AM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (11/29/2014 11:37:04 AM) (Source: APPHOSTSVC) (EventID: 9010) (User: )
Description: Fehler im Anwendungshost-Hilfsdienst beim Zugriff auf das Verlaufsstammverzeichnis "C:\inetpub\history". Das Verzeichnis ist nicht vorhanden, oder die Berechtigungen für das Verzeichnis lassen den Zugriff des Verzeichnisdiensts auf das Verzeichnis nicht zu. Das Konfigurationsverlaufsfeature wird deaktiviert und erneut aktiviert, nachdem das Problem behoben wurde. Stellen Sie zum Beheben des Problems sicher, dass das Verzeichnis vorhanden ist und dass die Gruppe "Administratoren" über Lese- und Schreibzugriff auf das Verzeichnis verfügt. Das Datenfeld enthält die Fehlernummer.
Error: (11/28/2014 03:01:51 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Microsoft Office Sessions:
=========================
Error: (11/30/2014 08:43:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mx.exe0.0.0.052c32e09mx.exe0.0.0.052c32e09c0000005000990ccaf401d00cd5d731ff17C:\Spiele\MX Simulator\mx.exeC:\Spiele\MX Simulator\mx.exe21d642e3-78c9-11e4-beb2-6cf0497154b9
Error: (11/30/2014 00:52:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mx.exe0.0.0.052c32e09mx.exe0.0.0.052c32e09c0000005000990cce3001d00c9417f7bb62C:\Spiele\MX Simulator\mx.exeC:\Spiele\MX Simulator\mx.exe67e316e3-7887-11e4-beb2-6cf0497154b9
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (11/29/2014 09:34:49 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt
Error: (11/29/2014 09:34:47 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
4700
==================== Memory info ===========================
Processor: AMD Athlon(tm) II X4 635 Processor
Percentage of memory in use: 60%
Total physical RAM: 4094.49 MB
Available physical RAM: 1614.8 MB
Total Pagefile: 16092.67 MB
Available Pagefile: 12944.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:120.33 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 335BB6EE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von schrauber (01.12.2014 um 20:38 Uhr) |
|
01.12.2014, 20:39
| #4 |
| /// the machine /// TB-Ausbilder | Große Anzahl an Adware entdeckt. Codetags, nicht PHP Code MBAM updaten, Funde löschen lassen. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.12.2014, 21:29
| #5 |
| | Große Anzahl an Adware entdeckt.Code:
ATTFilter # AdwCleaner v4.103 - Bericht erstellt am 01/12/2014 um 21:10:26
# Aktualisiert 01/12/2014 von Xplode
# Database : 2014-12-01.2 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Alex - ALEX-PC
# Gestartet von : C:\Users\Alex\Downloads\AdwCleaner_4.103.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\QuickSet
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Users\Alex\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\qone8
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Alex\Desktop\Browser
[!] Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
Ordner Gelöscht : C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Datei Gelöscht : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}.xpi
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Alex\AppData\Local\Temp\EsgScanner.sys
Datei Gelöscht : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\Ask.xml
Datei Gelöscht : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\icqplugin.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338A754C-B46E-4BF2-8AC8-23DE36862AD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\IePlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\SafetyNut
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\supWPM
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17420
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v33.1 (x86 de)
-\\ Google Chrome v
[C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms}
-\\ Opera v0.0.0.0
[C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://go.speedbit.com/search.aspx?s=D4Da&q={searchTerms}
*************************
AdwCleaner[R0].txt - [12144 octets] - [01/12/2014 20:51:01]
AdwCleaner[S0].txt - [9934 octets] - [01/12/2014 21:10:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9994 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Home Premium x64
Ran by Alex on 01.12.2014 at 21:17:29,86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\nb3ri3yg.default\minidumps [416 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.12.2014 at 21:20:58,84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-11-2014
Ran by Alex (administrator) on ALEX-PC on 01-12-2014 21:24:54
Running from C:\Users\Alex\Downloads
Loaded Profile: Alex (Available profiles: Alex & DefaultAppPool)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Scarlet.Crush Productions) C:\Users\Alex\AppData\Local\Temp\Rar$EXa0.355\ScpServer\bin\ScpService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Speedbit Ltd.) C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe
(Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Thisisu) C:\Users\Alex\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-06] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\Run: [Google Update] => C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-08] (Google Inc.)
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\...\MountPoints2: {fff6b530-57ed-11e2-b9c3-6cf0497154b9} - E:\starter.exe
InternetURL: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.com.url -> C:\ProgramData\27218346293184.exe
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD8B6BF72EABDCD01
HKU\S-1-5-21-130873077-1766887506-2883398934-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\S-1-5-21-130873077-1766887506-2883398934-1001 -> DefaultScope {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-130873077-1766887506-2883398934-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Alex\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: Avira Browser Safety - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: Adblock Plus - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\nb3ri3yg.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-04]
Chrome:
=======
CHR HomePage: Default ->
CHR DefaultSearchKeyword: Default ->
CHR DefaultSearchURL: Default ->
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]
CHR Extension: (Google Wallet) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Speedbit New Tab) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\palpbfjgianahgbbeodmcohjdmaelbeo [2013-10-18]
CHR HKLM-x32\...\Chrome\Extension: [palpbfjgianahgbbeodmcohjdmaelbeo] - C:\Program Files\Common Files\SpeedBit\SBUpdate\SpeedbitNewTab.crx [2013-10-06]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-09-15] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG)
S2 appdrvrem01; C:\Windows\System32\appdrvrem01.exe [551896 2014-08-13] (Protection Technology)
R2 Ds3Service; C:\Users\Alex\AppData\Local\Temp\Rar$EXa0.355\ScpServer\bin\ScpService.exe [381952 2014-03-13] (Scarlet.Crush Productions) [File not signed]
U2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation)
R2 MSMQ; C:\Windows\system32\mqsvc.exe [9216 2009-07-14] (Microsoft Corporation)
R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [64512 2010-11-26] (Nalpeiron Ltd.) [File not signed]
R2 SBUpd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe [2541688 2014-03-04] (Speedbit Ltd.)
R2 simptcp; C:\Windows\SysWOW64\tcpsvcs.exe [9216 2009-07-14] (Microsoft Corporation)
R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)
R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)
S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R1 appdrv01; C:\Windows\System32\Drivers\appdrv01.sys [3852976 2014-08-13] (Protection Technology)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-01-06] (DT Soft Ltd)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2010-01-29] (EZB Systems, Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-30] (Malwarebytes Corporation)
R3 MQAC; C:\Windows\System32\drivers\mqac.sys [189440 2009-07-14] (Microsoft Corporation)
R3 SBUpdd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys [41368 2014-03-04] ()
R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VF0470Vid; C:\Windows\System32\DRIVERS\V0470Vid.sys [183200 2007-05-09] (Creative Technology Ltd.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-01 21:20 - 2014-12-01 21:20 - 00000756 _____ () C:\Users\Alex\Desktop\JRT.txt
2014-12-01 21:17 - 2014-12-01 21:17 - 00000000 ____D () C:\Windows\ERUNT
2014-12-01 21:16 - 2014-12-01 21:17 - 01707646 _____ (Thisisu) C:\Users\Alex\Downloads\JRT.exe
2014-12-01 21:14 - 2014-12-01 21:14 - 00010134 _____ () C:\Users\Alex\Desktop\AdwCleaner[S0].txt
2014-12-01 20:50 - 2014-12-01 21:10 - 00000000 ____D () C:\AdwCleaner
2014-12-01 20:50 - 2014-12-01 20:50 - 02154496 _____ () C:\Users\Alex\Downloads\AdwCleaner_4.103.exe
2014-12-01 08:25 - 2014-12-01 09:20 - 2290428279 _____ () C:\Users\Alex\Downloads\Bike Videos vom 29_11_14 von Phileas Schönberg (1).zip
2014-11-30 23:25 - 2014-11-30 23:43 - 573177132 _____ () C:\Users\Alex\Downloads\Bike Videos vom 29_11_14 von Phileas Schönberg.zip
2014-11-30 20:56 - 2014-11-30 20:57 - 00031807 _____ () C:\Users\Alex\Downloads\Addition.txt
2014-11-30 20:55 - 2014-12-01 21:24 - 00014628 _____ () C:\Users\Alex\Downloads\FRST.txt
2014-11-30 20:54 - 2014-12-01 21:25 - 00000000 ____D () C:\FRST
2014-11-30 20:54 - 2014-11-30 20:54 - 02117120 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2014-11-30 20:43 - 2014-11-30 20:43 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\AMD
2014-11-30 14:27 - 2014-11-30 14:27 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-30 14:05 - 2014-11-30 14:05 - 00000000 ____D () C:\ProgramData\ATI
2014-11-30 14:04 - 2014-11-30 14:04 - 00061880 _____ () C:\Windows\SysWOW64\CCCInstall_201411301404017876.log
2014-11-30 14:04 - 2014-11-30 14:04 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-11-30 14:03 - 2014-11-30 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-11-30 13:41 - 2014-11-30 13:41 - 00891224 _____ (AMD) C:\Users\Alex\Downloads\amddriverdownloader.exe
2014-11-30 13:08 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-30 13:08 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-30 13:08 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-30 13:08 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-30 13:08 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-30 13:08 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-30 13:08 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-30 13:08 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-30 13:08 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-30 13:08 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-30 13:07 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-30 13:07 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-30 13:07 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-30 13:07 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-30 13:07 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-30 13:07 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-30 13:07 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-30 13:07 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-30 13:07 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-30 13:07 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-30 13:07 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-30 13:07 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-30 13:07 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-30 13:07 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-30 13:07 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-30 13:07 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-30 13:07 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-30 13:07 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-30 13:07 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-30 13:07 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-30 13:07 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-30 13:07 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-30 13:07 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-30 13:07 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-30 13:07 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-30 13:07 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-30 13:07 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-30 13:07 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-30 13:07 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-30 13:07 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-30 13:07 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-30 13:07 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-30 13:07 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-30 13:07 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-30 13:07 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-30 13:07 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-30 13:07 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-30 13:07 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-30 13:07 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-30 13:07 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-30 13:07 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-30 13:07 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-30 13:07 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-30 13:07 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-30 13:07 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-30 13:07 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-30 13:07 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-30 13:07 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-30 13:07 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-30 13:07 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-30 13:07 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-30 13:07 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-30 13:07 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-30 13:07 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-30 13:07 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-30 13:07 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-30 13:07 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-30 13:07 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-30 13:07 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-30 13:07 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-30 13:07 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-30 13:07 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-30 13:07 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-30 13:07 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-30 13:05 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-30 13:05 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-30 13:05 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-30 13:05 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-30 13:05 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-30 13:05 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2014-11-30 13:00 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-30 13:00 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-30 13:00 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-30 13:00 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-30 13:00 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-30 13:00 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-30 13:00 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-30 13:00 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-30 12:55 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-30 12:55 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-30 12:55 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-30 12:55 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-30 12:55 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-30 12:55 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-30 12:55 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-29 21:34 - 2014-12-01 21:11 - 00001528 _____ () C:\Windows\setupact.log
2014-11-29 21:34 - 2014-11-29 21:34 - 00000000 _____ () C:\Windows\setuperr.log
2014-11-29 21:32 - 2014-12-01 21:11 - 00004112 _____ () C:\Windows\PFRO.log
2014-11-29 17:04 - 2014-11-29 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2014-11-29 17:04 - 2014-11-29 17:04 - 00000000 ____D () C:\Program Files\CPUID
2014-11-29 17:03 - 2014-11-29 17:03 - 01439184 _____ ( ) C:\Users\Alex\Downloads\cpu-z_1.65-setup-en.exe
2014-11-29 16:10 - 2014-11-29 16:10 - 00000000 ____D () C:\Windows\system32\IO
2014-11-29 14:22 - 2014-11-29 14:22 - 00163004 _____ () C:\Users\Alex\Downloads\ShellExView-1.90.zip
2014-11-29 14:21 - 2014-11-29 14:21 - 01174352 _____ () C:\Users\Alex\Downloads\ShellExView - CHIP-Installer.exe
2014-11-28 19:59 - 2014-11-28 19:59 - 03067725 _____ () C:\Users\Alex\Downloads\bike skins 250 and 450 in pic.rar
2014-11-28 17:13 - 2014-11-28 17:14 - 17522790 _____ () C:\Users\Alex\Downloads\Zyphar - beta (1).rar
2014-11-28 15:05 - 2014-11-28 15:06 - 42925792 _____ () C:\Users\Alex\Downloads\CYCLONE RACEABLE.rar
2014-11-26 22:14 - 2014-11-26 22:16 - 57639524 _____ () C:\Users\Alex\Downloads\Dirtpark Compound.rar
2014-11-25 20:06 - 2014-11-25 20:06 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BeamNG-Techdemo-0.3
2014-11-25 20:05 - 2014-11-25 20:05 - 00000000 ____D () C:\Users\Alex\AppData\Local\BeamNG
2014-11-25 20:02 - 2014-11-25 20:05 - 98903976 _____ () C:\Users\Alex\Downloads\BeamNG-Techdemo-0.3-setup.exe
2014-11-24 15:00 - 2014-11-24 15:02 - 84544613 _____ () C:\Users\Alex\Downloads\1348750252.rar
2014-11-24 12:20 - 2014-11-24 12:20 - 31705850 _____ () C:\Users\Alex\Downloads\Muddy Creek MX.rar
2014-11-24 12:12 - 2014-11-24 12:13 - 31246928 _____ () C:\Users\Alex\Downloads\The Test Facility 2.zip
2014-11-24 11:56 - 2014-11-24 11:57 - 26234271 _____ () C:\Users\Alex\Downloads\BEAUMONT NATIONAL MX.rar
2014-11-24 11:56 - 2014-11-24 11:57 - 15007119 _____ () C:\Users\Alex\Downloads\Veinge Sand track.rar
2014-11-24 11:31 - 2014-11-24 11:31 - 17241905 _____ () C:\Users\Alex\Downloads\City Sx.rar
2014-11-22 17:06 - 2014-11-22 17:06 - 33274722 _____ () C:\Users\Alex\Downloads\GRS National.rar
2014-11-22 15:47 - 2014-11-22 15:48 - 40020317 _____ () C:\Users\Alex\Downloads\Sand Double.rar
2014-11-17 17:07 - 2014-11-17 17:08 - 23597656 _____ () C:\Users\Alex\Downloads\Revolt Mx.rar
2014-11-17 17:06 - 2014-11-17 17:08 - 17522790 _____ () C:\Users\Alex\Downloads\Zyphar - beta.rar
2014-11-17 17:05 - 2014-11-17 17:08 - 40295355 _____ () C:\Users\Alex\Downloads\Bercy Sx 2014.rar
2014-11-17 12:14 - 2014-11-17 12:15 - 10006992 _____ () C:\Users\Alex\Downloads\BercyLilleParis.rar
2014-11-16 19:22 - 2014-11-16 19:23 - 31939751 _____ () C:\Users\Alex\Downloads\Kinco Komplex SX 1.rar
2014-11-16 16:42 - 2014-11-16 16:42 - 00005269 _____ () C:\Users\Alex\AppData\Local\recently-used.xbel
2014-11-16 16:29 - 2014-07-16 21:40 - 06291510 _____ () C:\Users\Alex\Desktop\MXRider_Jersey_wireframe.bmp
2014-11-16 15:57 - 2014-11-16 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MX Reflex Skin packager
2014-11-16 15:57 - 2014-11-16 15:57 - 00000000 ____D () C:\Program Files (x86)\ReflexSkinDLCCreator
2014-11-15 18:32 - 2014-11-15 18:32 - 01125200 _____ () C:\Users\Alex\Downloads\SharePod - CHIP-Installer.exe
2014-11-14 19:23 - 2014-11-14 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\Program Files\iTunes
2014-11-14 19:22 - 2014-11-14 19:23 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-11-14 19:22 - 2014-11-14 19:22 - 00000000 ____D () C:\Program Files\iPod
2014-11-14 18:46 - 2014-11-14 18:46 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2014-11-14 15:35 - 2014-11-14 15:35 - 00024744 _____ () C:\Users\Alex\Downloads\15million_savegame (1).bxml
2014-11-14 15:34 - 2014-11-14 15:34 - 00024744 _____ () C:\Users\Alex\Downloads\15million_savegame.bxml
2014-11-13 20:22 - 2014-11-29 16:09 - 00000000 ____D () C:\Users\Alex\Documents\RZDB
2014-11-13 20:22 - 2014-11-13 20:22 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mursoft
2014-11-13 20:22 - 2014-11-13 20:22 - 00000000 ____D () C:\Program Files (x86)\MURSOFT
2014-11-13 20:19 - 2014-11-13 20:20 - 16962607 _____ () C:\Users\Alex\Downloads\RZ6DemoSetup.zip
2014-11-12 21:31 - 2014-11-12 21:32 - 11037025 _____ () C:\Users\Alex\Downloads\AMA Bike Skin Pack.zip
2014-11-12 21:31 - 2014-11-12 21:32 - 06352127 _____ () C:\Users\Alex\Downloads\Mototanks bike skin pack 8 1 2014.zip
2014-11-12 21:11 - 2014-11-12 21:13 - 39519896 _____ () C:\Users\Alex\Downloads\2014 Anaheim 3 Supercross.rar
2014-11-12 20:31 - 2014-11-14 20:16 - 00000000 ____D () C:\ProgramData\Norton
2014-11-12 20:05 - 2014-11-12 20:05 - 00000839 _____ () C:\Users\Alex\Downloads\photoelectric_de (1).jnlp
2014-11-12 19:34 - 2014-11-12 19:34 - 00000839 _____ () C:\Users\Alex\Downloads\photoelectric_de.jnlp
2014-11-12 19:31 - 2014-11-12 19:31 - 05008056 _____ (Adobe Systems Inc.) C:\Users\Alex\Downloads\Shockwave_Installer_Slim(1).exe
2014-11-12 19:31 - 2014-11-12 19:31 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-11-12 19:07 - 2014-11-12 19:07 - 05008056 _____ (Adobe Systems Inc.) C:\Users\Alex\Downloads\Shockwave_Installer_Slim.exe
2014-11-12 18:39 - 2014-11-12 18:39 - 00239104 _____ () C:\Users\Alex\Downloads\Abmeldung.dot
2014-11-11 14:48 - 2014-11-11 14:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-09 16:21 - 2014-11-09 16:38 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\TS3Client
2014-11-03 23:20 - 2014-11-24 14:15 - 00016896 _____ () C:\Users\Alex\Documents\Mappe1.xls
2014-11-02 20:04 - 2014-12-01 14:11 - 00000000 ____D () C:\Users\Alex\AppData\Local\Linkage
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-01 21:20 - 2009-07-14 05:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-01 21:20 - 2009-07-14 05:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-01 21:16 - 2012-11-08 21:24 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA.job
2014-12-01 21:11 - 2013-04-10 13:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-01 21:11 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-01 21:10 - 2012-11-08 20:09 - 01368681 _____ () C:\Windows\WindowsUpdate.log
2014-12-01 19:16 - 2012-11-08 21:24 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core.job
2014-12-01 14:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-01 13:09 - 2009-07-14 18:58 - 00744870 _____ () C:\Windows\system32\perfh007.dat
2014-12-01 13:09 - 2009-07-14 18:58 - 00162742 _____ () C:\Windows\system32\perfc007.dat
2014-12-01 13:09 - 2009-07-14 06:13 - 01728398 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-01 13:02 - 2009-07-14 05:45 - 05008216 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-01 12:59 - 2014-05-06 22:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-01 08:38 - 2013-08-13 23:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-01 08:37 - 2012-11-20 21:12 - 00000000 ____D () C:\Users\Alex\AppData\Local\Adobe
2014-12-01 08:29 - 2013-01-09 02:02 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-30 14:27 - 2014-05-26 13:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-30 14:27 - 2014-05-26 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-30 14:27 - 2014-05-26 13:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-11-30 14:04 - 2012-11-08 21:05 - 00000000 ____D () C:\ProgramData\AMD
2014-11-30 14:03 - 2014-01-03 23:32 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-11-30 13:54 - 2014-01-03 23:33 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-30 13:50 - 2013-02-05 14:28 - 00000000 ____D () C:\AMD
2014-11-30 12:45 - 2012-11-08 21:22 - 00000000 ____D () C:\Users\Alex\Desktop\Spiele
2014-11-29 22:16 - 2012-11-08 21:22 - 00000000 ____D () C:\Users\Alex\Desktop\Programme
2014-11-29 22:15 - 2012-11-08 21:28 - 00000000 ____D () C:\Spiele
2014-11-29 16:36 - 2012-11-08 22:47 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-29 16:30 - 2013-11-01 22:01 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-29 16:27 - 2012-11-19 07:29 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-11-29 16:26 - 2013-10-13 16:08 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-29 16:21 - 2013-11-01 22:05 - 00000000 ____D () C:\Program Files\Adobe
2014-11-29 16:20 - 2014-02-16 18:05 - 00000000 ____D () C:\Users\Alex\AppData\Local\Unity
2014-11-29 16:17 - 2014-05-19 20:36 - 00001615 _____ () C:\Windows\VPNUnInstall.MIF
2014-11-29 16:11 - 2012-11-09 09:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-29 16:11 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-11-29 16:09 - 2014-07-27 14:17 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-11-29 16:09 - 2013-09-29 16:50 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-29 16:09 - 2012-11-08 21:24 - 00000000 ____D () C:\Users\Alex\AppData\Local\Google
2014-11-29 16:08 - 2014-07-27 14:17 - 00000000 ____D () C:\ProgramData\Origin
2014-11-26 16:11 - 2013-04-10 13:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-26 16:11 - 2012-11-08 22:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 16:11 - 2012-11-08 22:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-24 14:17 - 2013-05-25 15:17 - 00000000 ____D () C:\Users\Alex\Documents\Algodoo
2014-11-24 14:04 - 2012-11-08 20:36 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-18 18:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-16 19:11 - 2012-11-08 21:24 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001UA
2014-11-16 19:11 - 2012-11-08 21:24 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-130873077-1766887506-2883398934-1001Core
2014-11-16 16:44 - 2012-11-09 17:22 - 00000000 ____D () C:\Users\Alex\.gimp-2.8
2014-11-16 16:42 - 2013-10-19 18:19 - 00000000 ____D () C:\Users\Alex\AppData\Local\gtk-2.0
2014-11-14 19:22 - 2014-05-21 20:53 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-11-14 19:22 - 2012-11-09 19:09 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-11-12 21:14 - 2014-10-05 12:29 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\XnView
2014-11-12 19:35 - 2012-11-08 22:47 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-11-11 17:54 - 2014-06-27 17:15 - 00000000 ____D () C:\Windows\Minidump
2014-11-11 17:54 - 2013-01-06 11:49 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\DAEMON Tools Lite
2014-11-11 17:42 - 2012-11-08 20:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-09 22:56 - 2012-11-08 21:34 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Skype
2014-11-03 08:09 - 2014-10-30 09:23 - 00000000 ____D () C:\Users\Alex\Desktop\MX VS ATV
2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linkage X3 Demo
2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\ProgramData\Linkage
2014-11-02 20:03 - 2014-06-30 17:47 - 00000000 ____D () C:\Program Files (x86)\LinkageX3Demo
2014-11-01 16:20 - 2012-11-19 07:29 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
Some content of TEMP:
====================
C:\Users\Alex\AppData\Local\Temp\amd-catalyst-14-9-win7-win8.1-64bit-dd-ccc-whql.exe
C:\Users\Alex\AppData\Local\Temp\AutoRun.exe
C:\Users\Alex\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Alex\AppData\Local\Temp\avgnt.exe
C:\Users\Alex\AppData\Local\Temp\Creative Cloud Helper.exe
C:\Users\Alex\AppData\Local\Temp\CreativeCloudSet-Up.exe
C:\Users\Alex\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Alex\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwy5lu2.dll
C:\Users\Alex\AppData\Local\Temp\Quarantine.exe
C:\Users\Alex\AppData\Local\Temp\SHSetup.exe
C:\Users\Alex\AppData\Local\Temp\SIntf16.dll
C:\Users\Alex\AppData\Local\Temp\SIntf32.dll
C:\Users\Alex\AppData\Local\Temp\SIntfNT.dll
C:\Users\Alex\AppData\Local\Temp\sqlite3.dll
C:\Users\Alex\AppData\Local\Temp\{397E31AA-0D78-4649-A01C-339D73A2ED35}_NSS_7622.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-25 20:32
==================== End Of Log ============================
--- --- --- |
|
02.12.2014, 18:25
| #6 |
| /// the machine /// TB-Ausbilder | Große Anzahl an Adware entdeckt.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Große Anzahl an Adware entdeckt. |
|
| Themen zu Große Anzahl an Adware entdeckt. |
| arbeitet, computer, downloader, explorer, fehlercode, fehlercode 0x80070490, fehlercode 0xc0000005, fehlercode 22, fehlercode windows, funktioniert, internet, internet explorer, logdatei, malwarebytes, microsoft, nicht mehr, schließen, software, this device is disabled. (code 22), webseiten, windows explorer |
Linear-Darstellung
