| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Werbung im Hintergrund ohne etwas geöffnet zu habenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.12.2014, 21:44
| #1 |
| |  Werbung im Hintergrund ohne etwas geöffnet zu haben Hallo , Ich habe folgendes Problem ,ich habe mir vor paar Tagen Tuneup Utlities Runtergeladen(Chip) und eine Wartung durchgeführt und jetzt ein paar Tage später habe ich in unregelmäßigen Abstände "Werbung/Audio" im Hintergrund laufen. Habe Antivir und Spybot durchlaufen lassen die Sachen die er gefundet hat sind in Quarantäne ,aber das Problem tritt weiterhin auf. Desweiteren ist mein PC sehr langsam dadurch geworden so wie bei Hochfahren und wenn er Hochgefahren ist hat er eine Hohe CPU und Ram Auslastung. Geändert von nihao88 (03.12.2014 um 22:42 Uhr) |
|
04.12.2014, 00:58
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Werbung im Hintergrund ohne etwas geöffnet zu haben Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
04.12.2014, 12:56
| #3 |
| | FRST AdditionCode:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2014 Ran by BiLo (administrator) on BILO-PC on 04-12-2014 12:39:16 Running from C:\Users\BiLo\Desktop Loaded Profile: BiLo (Available profiles: BiLo) Platform: Windows 7 Ultimate (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kingsoft Corporation) C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxescore.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe () C:\Program Files\mediainformationaccess\updater.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe () C:\Program Files\mediainformationaccess\updater.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe () C:\Program Files\mediainformationaccess\updater.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Run: [] => [X] HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.) HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-12-02] (Microsoft Corporation) BootExecute: autocheck autochk * sh4native Sh4Removalsdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE091E2810BF4CC01 HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll No File BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: Ó¦Óñ¦Ò»¼ü°²×°²å¼þ -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll (腾讯公司) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll No File BHO-x32: SignoIEHelper.SignoIEHelp -> {C5323D86-13B6-4B06-A27E-3D19E2954017} -> C:\Program Files (x86)\signotec\Dll\SignoIEHelper.dll (signotec GmbH, Ratingen) BHO-x32: QQÏÂÔØÖúÊÖä¯ÀÀÆ÷¿Ø¼þ -> {C9C7334B-5657-41e1-8F79-F6AACECA05F4} -> C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\49\Browser\QQIEHelper01.dll (Tencent Technology (Shenzhen) Company Limited) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: AccountProtectBHO Class -> {DDD362CF-523B-4BC9-8FDC-58F93B6BC945} -> C:\Users\BiLo\AppData\Roaming\Tencent\QQ\QQAntiPhishing\AccountProtect.dll (Tencent) BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) DPF: HKLM-x32 {03A89EFD-E023-7700-A22D-45F77558EB4C} https://cs7.netucate.net/campus/download/ilinci77.dll Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @kingsfot.com/npkws -> C:\Program Files (x86)\kingsoft\kingsoft antivirus\npkws.dll (Kingsoft Corporation) FF Plugin-x32: @kingsoft.com/npkvip -> c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll (腾讯公司) FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll (Tencent) FF Plugin-x32: @qq.com/QQMiniDLPlugin -> C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\49\Browser\npXFMiniDLPlugin.dll (Tencent Technology (Shenzhen) Company Limited) FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll () FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll (Tencent) FF Plugin-x32: @qq.com/TXSSO -> C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.2.49\Bin\npSSOAxCtrlForPTLogin.dll (Tencent) FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll (Tencent) FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll (Tencent Technology (Shenzhen) Company Limited) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKU\S-1-5-21-2015670880-1155494743-3860310727-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\BiLo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-2015670880-1155494743-3860310727-1001: ubisoft.com/uplaypc -> E:\Spiele\Die Siedler 7\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll No File FF user.js: detected! => C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\user.js FF SearchPlugin: C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\searchplugins\google-maps.xml FF Extension: Avira Browser Safety - C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\Extensions\abs@avira.com [2014-12-03] FF Extension: Download videos and MP3s from YouTube - C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-19] FF HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\BiLo\AppData\Roaming\11002 FF Extension: Java String Helper - C:\Users\BiLo\AppData\Roaming\11002 [2012-03-20] FF HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-19] Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR DefaultSearchKeyword: Default -> lolnexus.com CHR DefaultSearchURL: Default -> hxxp://www.lolnexus.com/EUW/search?name={searchTerms}®ion=EUW CHR DefaultSuggestURL: Default -> CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\pdf.dll () CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\plugin/npUrlAdvisor.dll No File CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0\plugin/content_blocker_npapi.dll No File CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4190_0\plugin/npVKPlugin.dll No File CHR Plugin: (QQ2011) - C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent) CHR Plugin: (Tencent SSO Platform) - C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.77\Bin\npSSOAxCtrlForPTLogin.dll No File CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (QQMusic) - C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll (Tencent) CHR Plugin: (QQPCMgr Detector) - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.8052.210\npQMExtensionsMozilla.dll No File CHR Plugin: (npQQPhotoDrawEx) - C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll () CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File CHR Plugin: (Unity Player) - C:\Users\BiLo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll No File CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Kingsoft@Firefox ActiveX Comm) - c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll () CHR Plugin: (Kingsoft Internet Security) - c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll (Kingsoft Corporation) CHR Profile: C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-16] CHR Extension: (No History) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljamgkbcojbnmcaonjokopmcblmmpfch [2014-06-19] CHR Extension: (Google Wallet) - C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2013-04-13] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 kxescore; c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe [280024 2014-12-01] (Kingsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.) S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) R2 updater; C:\Program Files\mediainformationaccess\updater.exe [679936 2014-12-03] () [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-02-21] (DT Soft Ltd) R1 KDHacker; c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys [185656 2014-09-05] (Kingsoft Corporation) R2 kisknl; C:\Windows\system32\drivers\kisknl.sys [228152 2014-12-01] (Kingsoft Corporation) R1 kisnetm; c:\program files (x86)\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm64.sys [109880 2014-07-08] (Kingsoft Corporation) R3 ksapi64; C:\Windows\system32\drivers\ksapi64.sys [56680 2014-03-13] (Kingsoft Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-04] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [532480 2009-07-01] (PixArt Imaging Inc.) S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.) S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\8.8.10778.238\QMUdisk64.sys [X] S0 wrnk; System32\drivers\ucaoo.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-04 12:42 - 2014-12-04 12:44 - 00042036 _____ () C:\Users\BiLo\Desktop\Ereignisse.txt 2014-12-04 12:36 - 2014-12-04 12:36 - 00000000 _____ () C:\Users\BiLo\Desktop\Neues Textdokument.txt 2014-12-04 12:32 - 2014-12-04 12:39 - 00038983 _____ () C:\Users\BiLo\Desktop\Addition.txt 2014-12-04 12:32 - 2014-12-04 12:34 - 00000000 ____D () C:\Users\BiLo\Desktop\Neuer Ordner (4) 2014-12-04 12:31 - 2014-12-04 12:31 - 00042122 _____ () C:\Users\BiLo\Desktop\Malwarbyte.txt 2014-12-04 12:24 - 2014-12-04 12:43 - 00021228 _____ () C:\Users\BiLo\Desktop\FRST.txt 2014-12-04 12:24 - 2014-12-04 12:39 - 00000000 ____D () C:\FRST 2014-12-04 12:23 - 2014-12-04 12:23 - 02117632 _____ (Farbar) C:\Users\BiLo\Desktop\FRST64.exe 2014-12-03 21:28 - 2014-12-04 11:55 - 08704507 _____ () C:\Windows\SysWOW64\debug.log 2014-12-03 18:25 - 2014-12-04 12:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-03 18:24 - 2014-12-03 18:24 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-03 18:24 - 2014-12-03 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-03 18:24 - 2014-12-03 18:24 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-03 18:24 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-03 18:24 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-03 18:24 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-03 18:23 - 2014-12-03 18:23 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\BiLo\Downloads\mbam-setup-2.0.3.1025.exe 2014-12-03 18:19 - 2014-12-03 18:19 - 00602112 _____ (OldTimer Tools) C:\Users\BiLo\Downloads\OTL.exe 2014-12-03 13:19 - 2014-12-03 13:19 - 00002112 _____ () C:\Users\BiLo\Desktop\SpyBot - Search & Destroy - CHIP Downloader.lnk 2014-12-03 13:18 - 2014-12-03 13:18 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-12-03 13:18 - 2014-12-03 13:18 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-12-03 13:18 - 2014-12-03 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-12-03 13:18 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-12-03 13:17 - 2014-12-03 13:24 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-12-03 13:11 - 2014-12-03 13:11 - 01174352 _____ () C:\Users\BiLo\Downloads\SpyBot Search Destroy - CHIP-Installer.exe 2014-12-03 12:53 - 2014-12-03 12:52 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-12-03 12:51 - 2014-12-03 12:51 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Avira 2014-12-03 12:47 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-12-03 12:47 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-12-03 12:47 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-12-03 12:44 - 2014-12-03 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-03 12:44 - 2014-12-03 12:47 - 00000000 ____D () C:\ProgramData\Avira 2014-12-03 12:44 - 2014-12-03 12:47 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-03 12:44 - 2014-12-03 12:44 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-12-03 12:43 - 2014-12-03 12:43 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\BiLo\Downloads\avira_de_av_5659826454__ws.exe 2014-12-03 12:43 - 2014-12-03 12:43 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-03 12:33 - 2014-12-03 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-03 12:01 - 2014-12-04 12:44 - 00000112 _____ () C:\ProgramData\dRUisk.dat 2014-12-03 11:56 - 2014-12-03 11:59 - 00000000 ____D () C:\Program Files\mediainformationaccess 2014-12-03 11:54 - 2014-12-03 11:54 - 00432688 _____ () C:\Windows\Minidump\120314-17737-01.dmp 2014-12-02 12:52 - 2014-12-02 12:52 - 00000000 ____D () C:\Windows\system32\SPReview 2014-12-02 12:51 - 2014-12-02 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-12-02 12:48 - 2014-12-02 12:49 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-12-02 12:48 - 2014-12-02 12:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-12-02 12:38 - 2014-12-02 12:38 - 00027155 _____ () C:\Users\BiLo\Downloads\hummer_training_control_map_by_time2kill_v4__pro.zip 2014-12-02 12:31 - 2014-09-15 01:44 - 03195392 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-12-01 20:28 - 2014-12-01 20:28 - 00002029 _____ () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\888poker.lnk 2014-12-01 20:28 - 2014-12-01 20:28 - 00002005 _____ () C:\Users\BiLo\Desktop\888poker.lnk 2014-12-01 20:28 - 2014-12-01 20:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\888poker 2014-11-30 02:37 - 2014-11-30 02:37 - 00003424 ____N () C:\bootsqm.dat 2014-11-29 22:54 - 2014-11-29 22:54 - 00001980 _____ () C:\Users\BiLo\Desktop\PokerStars.eu.lnk 2014-11-29 22:54 - 2014-11-29 22:54 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2014-11-29 22:51 - 2014-11-29 22:52 - 108594192 _____ (PokerStars) C:\Users\BiLo\Downloads\PokerStarsInstallEU.exe 2014-11-27 17:29 - 2014-12-01 22:15 - 00000000 ____D () C:\Users\BiLo\AppData\Local\PokerStars.EU 2014-11-27 17:29 - 2014-11-29 22:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2014-11-27 17:27 - 2014-11-29 22:54 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2014-11-27 16:57 - 2014-12-01 20:29 - 00000000 ____D () C:\Users\BiLo\Documents\888poker 2014-11-27 16:57 - 2014-12-01 20:28 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\PacificPoker 2014-11-27 16:57 - 2014-11-27 16:57 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker 2014-11-27 16:56 - 2014-12-01 20:28 - 00000000 ____D () C:\Program Files (x86)\PacificPoker 2014-11-27 15:23 - 2014-11-29 22:28 - 00000000 ____D () C:\Users\BiLo\Documents\StarCraft II 2014-11-25 18:28 - 2014-11-25 18:28 - 00000000 ____D () C:\Users\BiLo\AppData\Local\TuneUp Software 2014-11-25 18:27 - 2014-11-29 22:28 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014 2014-11-25 18:24 - 2014-11-25 18:24 - 28598072 _____ (TuneUp Software) C:\Users\BiLo\Downloads\TuneUpUtilities2014_34de-DE.exe 2014-11-25 17:08 - 2014-11-25 17:09 - 202853696 _____ () C:\Users\BiLo\Downloads\kav15.0.1.415de_6845.exe 2014-11-25 16:59 - 2014-11-25 17:00 - 01169232 _____ () C:\Users\BiLo\Downloads\Hotspot Shield VPN - CHIP-Installer.exe 2014-11-19 01:21 - 2014-11-19 01:21 - 00001243 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-11-19 01:19 - 2014-11-19 01:19 - 00000000 ____D () C:\Program Files (x86)\Free Codec Pack 2014-11-11 00:11 - 2014-11-11 00:12 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Curse Advertising 2014-11-11 00:09 - 2014-12-02 12:24 - 00000000 ____D () C:\Users\BiLo\AppData\Local\Deployment 2014-11-11 00:09 - 2014-11-11 00:09 - 00003116 _____ () C:\Windows\System32\Tasks\{CAD742E8-0262-4164-8779-7CE4BFAC32AE} 2014-11-11 00:09 - 2014-11-11 00:09 - 00000318 _____ () C:\Users\BiLo\Desktop\Curse Client.appref-ms 2014-11-11 00:09 - 2014-11-11 00:09 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse 2014-11-11 00:09 - 2014-11-11 00:09 - 00000000 ____D () C:\Users\BiLo\AppData\Local\Apps\2.0 2014-11-11 00:08 - 2014-11-11 00:08 - 00402696 _____ () C:\Users\BiLo\Downloads\setup(1).exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-04 12:32 - 2012-08-04 20:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-04 12:24 - 2014-09-16 20:06 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-04 12:22 - 2011-12-30 14:48 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Skype 2014-12-04 12:20 - 2014-08-13 19:35 - 00000000 ____D () C:\Users\BiLo\Documents\GenTool 2014-12-04 12:00 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-04 12:00 - 2009-07-14 05:45 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-04 11:57 - 2011-12-30 13:14 - 01768393 _____ () C:\Windows\WindowsUpdate.log 2014-12-04 11:51 - 2014-09-16 20:06 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-04 11:51 - 2012-08-04 23:38 - 00157822 _____ () C:\Windows\setupact.log 2014-12-04 11:51 - 2012-08-04 23:37 - 01481284 _____ () C:\Windows\PFRO.log 2014-12-04 11:51 - 2011-12-30 14:37 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-04 11:51 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-03 22:45 - 2009-07-14 18:58 - 00696832 _____ () C:\Windows\system32\perfh007.dat 2014-12-03 22:45 - 2009-07-14 18:58 - 00148128 _____ () C:\Windows\system32\perfc007.dat 2014-12-03 22:45 - 2009-07-14 06:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-03 22:38 - 2012-01-09 21:44 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\vlc 2014-12-03 22:38 - 2012-01-05 21:08 - 00000000 ____D () C:\Users\BiLo\AppData\Local\QuickPar 2014-12-03 19:25 - 2011-12-30 13:10 - 00000000 ____D () C:\Windows\Panther 2014-12-03 19:24 - 2014-05-15 16:53 - 00000000 ____D () C:\Program Files (x86)\Rr Savings 2014-12-03 19:24 - 2012-09-15 12:00 - 00000000 ____D () C:\temp 2014-12-03 18:24 - 2013-10-13 18:21 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-03 18:04 - 2014-06-19 23:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-03 15:20 - 2013-09-28 15:20 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-12-03 13:24 - 2014-05-15 16:51 - 00000000 ____D () C:\Program Files\002 2014-12-03 12:03 - 2013-12-10 21:34 - 00000000 ____D () C:\Users\BiLo\AppData\Local\Battle.net 2014-12-03 11:54 - 2013-05-03 20:28 - 00000000 ____D () C:\Windows\Minidump 2014-12-02 20:36 - 2009-07-14 05:45 - 00295680 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-02 14:37 - 2012-02-26 14:34 - 00000000 ___RD () C:\Users\BiLo\Dropbox 2014-12-02 12:48 - 2014-05-24 20:08 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-02 12:28 - 2012-04-03 10:25 - 00000000 ____D () C:\Windows\pss 2014-12-02 12:24 - 2012-02-26 14:31 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Dropbox 2014-12-01 20:33 - 2012-08-04 20:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-01 20:33 - 2012-08-04 20:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-01 20:33 - 2012-01-02 00:50 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-01 19:54 - 2012-08-04 19:59 - 00228152 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\kisknl_del.sys 2014-12-01 19:54 - 2012-08-04 19:59 - 00228152 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\kisknl.sys 2014-11-30 13:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-30 12:59 - 2013-02-15 21:22 - 00000000 ____D () C:\Users\BiLo\AppData\Local\LogMeIn Hamachi 2014-11-30 12:51 - 2014-09-16 20:07 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-11-30 02:38 - 2011-12-30 13:34 - 00000000 ____D () C:\Users\BiLo 2014-11-29 22:28 - 2014-09-16 20:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-29 22:28 - 2014-05-15 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCSOFT 2014-11-29 22:28 - 2014-04-09 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2014-11-29 22:28 - 2013-12-10 21:34 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Battle.net 2014-11-29 22:28 - 2013-11-29 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live 2014-11-29 22:28 - 2013-10-18 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014 2014-11-29 22:28 - 2013-10-06 22:18 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-11-29 22:28 - 2012-07-20 21:23 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WINEAS 2014-11-29 22:28 - 2012-07-04 08:53 - 00000000 __SHD () C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} 2014-11-29 22:28 - 2012-05-09 21:37 - 00000000 ____D () C:\Users\BiLo\Documents\Command and Conquer Generals Zero Hour Data 2014-11-29 22:28 - 2012-02-26 14:32 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-11-29 22:28 - 2012-02-22 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Sports 2014-11-29 22:28 - 2012-01-02 00:50 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-11-29 22:28 - 2012-01-02 00:48 - 00000000 ____D () C:\Windows\system32\Macromed 2014-11-29 22:28 - 2011-03-27 22:25 - 00000000 ____D () C:\NVIDIA 2014-11-29 22:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-11-29 22:24 - 2012-05-11 20:34 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-11-29 22:24 - 2012-01-05 09:28 - 00000000 ____D () C:\ProgramData\Apple Computer 2014-11-29 22:24 - 2012-01-05 09:23 - 00000000 ____D () C:\ProgramData\Apple 2014-11-26 17:06 - 2012-12-14 12:22 - 00000000 ____D () C:\Users\BiLo\AppData\Local\Downloaded Installations 2014-11-26 17:06 - 2012-01-05 09:28 - 00000000 ____D () C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2014-11-25 18:24 - 2012-07-04 08:53 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-11-25 18:23 - 2014-09-07 14:39 - 00000000 ____D () C:\ProgramData\UnifaGivhe 2014-11-25 17:22 - 2013-10-13 14:52 - 00262144 _____ () C:\Windows\system32\config\elam 2014-11-19 01:21 - 2012-08-17 12:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-11-19 01:21 - 2012-08-17 12:41 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-11-19 01:20 - 2012-08-17 12:40 - 00000000 ____D () C:\Users\BiLo\AppData\Roaming\DVDVideoSoft 2014-11-16 02:18 - 2014-09-16 20:06 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-16 02:18 - 2014-09-16 20:06 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-14 18:06 - 2012-02-26 14:34 - 00001013 _____ () C:\Users\BiLo\Desktop\Dropbox.lnk 2014-11-11 00:25 - 2012-08-04 19:59 - 00031592 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\kavbootc.sys 2014-11-06 14:24 - 2014-09-04 19:43 - 00000926 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk Files to move or delete: ==================== C:\ProgramData\dRUisk.dat Some content of TEMP: ==================== C:\Users\BiLo\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed Code:
ATTFilter Exportierte Ereignisse:
04.12.2014 11:59 [Updater] Update erfolgreich durchgeführt
Update von Avira Free Antivirus auf Computer BILO-PC (192.168.178.54)
erfolgreich durchgeführt.
Folgende Dateien wurden von "hxxp://88.221.92.80/update" aktualisiert:
aevdf.dat 8.11.192.144
xbv00044.vdf 8.11.192.86
xbv00045.vdf 8.11.192.110
xbv00046.vdf 8.11.192.134
xbv00047.vdf 8.11.192.138
xbv00048.vdf 8.11.192.140
xbv00049.vdf 8.11.192.144
local000.vdf
04.12.2014 11:56 [Planer] Auftrag gestartet
Auftrag "Automatisches Update"
wurde erfolgreich gestartet.
04.12.2014 11:52 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version:
VDF Version:
04.12.2014 11:52 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version: 8.3.26.28
VDF Version: 8.11.192.58
04.12.2014 11:51 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 22:55 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
03.12.2014 22:55 [Planer] Dienst gestoppt
Der Dienst wurde gestoppt.
03.12.2014 21:26 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version:
VDF Version:
03.12.2014 21:26 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version: 8.3.26.28
VDF Version: 8.11.192.58
03.12.2014 21:24 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 21:20 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 21:14 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 21:12 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
03.12.2014 21:12 [Planer] Dienst gestoppt
Der Dienst wurde gestoppt.
03.12.2014 21:04 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde abgebrochen!].
Anzahl Dateien: 278246
Anzahl Verzeichnisse: 1547
Anzahl Malware: 0
Anzahl Warnungen: 0
03.12.2014 19:25 [Planer] Auftrag gestartet
Auftrag "Vollständige Systemprüfung"
wurde erfolgreich gestartet.
03.12.2014 18:57 [Updater] Update erfolgreich durchgeführt
Update von Avira Free Antivirus auf Computer BILO-PC (192.168.178.54)
erfolgreich durchgeführt.
Folgende Dateien wurden von "hxxp://77.67.96.248/update" aktualisiert:
aevdf.dat 8.11.192.58
xbv00042.vdf 8.11.190.56
xbv00043.vdf 8.11.192.58
local001.vdf
03.12.2014 18:51 [Planer] Auftrag gestartet
Auftrag "Automatisches Update"
wurde erfolgreich gestartet.
03.12.2014 18:05 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version:
VDF Version:
03.12.2014 18:05 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version: 8.3.26.28
VDF Version: 8.11.190.32
03.12.2014 18:04 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 18:01 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde abgebrochen!].
Anzahl Dateien: 1898973
Anzahl Verzeichnisse: 41557
Anzahl Malware: 39
Anzahl Warnungen: 24
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\7e5d3dba-757001
95'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-4681.A2.Gen'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7730a66c.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\9f7e333-19be844
f'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-4681.A2.Gen'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a68892e.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\4ca9867b-422a25
c5'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-0507' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0b7ce63e.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\BiLo\Downloads\microsoft-silverlight.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Graftor.151493.9' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '38ddf81b.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\BiLo\Downloads\generals zero hour map
hack__3515_i1331147066_il3114271.exe'
enthielt einen Virus oder unerwünschtes Programm 'Adware/Amonetize.kpa'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '47c9ca76.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\76a9fdc5-6f4d374
5'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2012-0507' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4356b2e4.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '158eee88.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\AdwCleaner\Quarantine\C\ProgramData\Browser
Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.crx.vir'
enthielt einen Virus oder unerwünschtes Programm 'TR/BProtector.Gen2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1c8dea27.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\59634841-3f1d6cd
6'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2011-3544.A.113'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50fc9785.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\77b40470-2d55b0
b8'
enthielt einen Virus oder unerwünschtes Programm 'TR/Agent.983.3' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2f0b9ed5.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\BiLo\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\32da63a7-4f5db0
04'
enthielt einen Virus oder unerwünschtes Programm 'EXP/CVE-2010-0840.A.95'
[exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5eb0a74d.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\SysWOW64\installd.exe'
enthielt einen Virus oder unerwünschtes Programm 'Adware/Amonetize.ges'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4921c00b.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'D:\Program Files\ÌÚѶÓÎÏ·\QQGame\Ermj\ermj.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Malob.FE.191' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51a8efb0.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\BiLo\Downloads\microsoft-silverlight_setup.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen7'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7d59d524.qua'
verschoben!
03.12.2014 18:01 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\BiLo\Downloads\VideoConverterSetup.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen7'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1b6f9ae6.qua'
verschoben!
03.12.2014 13:46 [Planer] Auftrag gestartet
Auftrag "Vollständige Systemprüfung"
wurde erfolgreich gestartet.
03.12.2014 13:25 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde abgebrochen!].
Anzahl Dateien: 0
Anzahl Verzeichnisse: 0
Anzahl Malware: 0
Anzahl Warnungen: 0
03.12.2014 13:24 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\BiLo\Desktop\Manager13.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7d27ae9e.qua'
verschoben!
03.12.2014 13:24 [System-Scanner] Suche
Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].
Anzahl Dateien: 4910
Anzahl Verzeichnisse: 0
Anzahl Malware: 3
Anzahl Warnungen: 1
03.12.2014 13:24 [System-Scanner] Malware gefunden
Die Datei 'C:\Program Files\002\yewimmxqbs64.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen' [adware].
Durchgeführte Aktion(en):
Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler
aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003.
Die Datei konnte nicht gelöscht werden!
Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
Eine Instanz der ARK Library läuft bereits.
Der Registrierungseintrag
<HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\yewimmxqbs64\ImagePath>
wurde erfolgreich repariert.
Der Registrierungseintrag
<HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\yewimmxqbs64\ImagePath> wurde
erfolgreich repariert.
Der Registrierungseintrag
<HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\yewimmxqbs64\ImagePath> wurde
erfolgreich repariert.
03.12.2014 13:22 [Echtzeit-Scanner] Echtzeit-Scanner aktiviert
Echtzeit-Scanner wurde aktiviert.
03.12.2014 13:19 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\BiLo\Desktop\Manager13.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
03.12.2014 12:55 [Planer] Auftrag gestartet
Auftrag "Vollständige Systemprüfung"
wurde erfolgreich gestartet.
03.12.2014 12:54 [Updater] Update erfolgreich durchgeführt
Update von Avira Free Antivirus auf Computer BILO-PC (192.168.178.54)
erfolgreich durchgeführt.
Folgende Dateien wurden von "hxxp://88.221.92.80/update" aktualisiert:
aecore.dll 8.3.3.0
aegen.dll 8.1.7.36
aeheur.dll 8.1.4.1418
aeoffice.dll 8.3.1.8
aepack.dll 8.4.0.56
aerdl.dll 8.2.1.16
aescript.dll 8.2.2.32
aeexp.dll 8.4.2.48
aeset.dat 8.3.26.28
aedroid.dll 8.4.2.248
aemobile.dll 8.1.1.0
avnetflt.sys 14.0.7.248
avlode.rdf 14.0.4.50
avreg.yml 14.0.4.2
aevdf.dat 8.11.190.32
xbv00011.vdf 8.11.184.50
xbv00012.vdf 8.11.190.32
xbv00042.vdf 8.11.190.32
xbv00043.vdf 8.11.190.32
xbv00044.vdf 8.11.190.32
xbv00045.vdf 8.11.190.32
xbv00046.vdf 8.11.190.32
xbv00047.vdf 8.11.190.32
xbv00048.vdf 8.11.190.32
xbv00049.vdf 8.11.190.32
xbv00050.vdf 8.11.190.32
xbv00051.vdf 8.11.190.32
xbv00052.vdf 8.11.190.32
xbv00053.vdf 8.11.190.32
xbv00054.vdf 8.11.190.32
xbv00055.vdf 8.11.190.32
xbv00056.vdf 8.11.190.32
xbv00057.vdf 8.11.190.32
xbv00058.vdf 8.11.190.32
xbv00059.vdf 8.11.190.32
xbv00060.vdf 8.11.190.32
xbv00061.vdf 8.11.190.32
xbv00062.vdf 8.11.190.32
xbv00063.vdf 8.11.190.32
xbv00064.vdf 8.11.190.32
xbv00065.vdf 8.11.190.32
xbv00066.vdf 8.11.190.32
xbv00067.vdf 8.11.190.32
xbv00068.vdf 8.11.190.32
xbv00069.vdf 8.11.190.32
xbv00070.vdf 8.11.190.32
xbv00071.vdf 8.11.190.32
xbv00072.vdf 8.11.190.32
xbv00073.vdf 8.11.190.32
xbv00074.vdf 8.11.190.32
xbv00075.vdf 8.11.190.32
xbv00076.vdf 8.11.190.32
xbv00077.vdf 8.11.190.32
xbv00078.vdf 8.11.190.32
xbv00079.vdf 8.11.190.32
xbv00080.vdf 8.11.190.32
xbv00081.vdf 8.11.190.32
xbv00082.vdf 8.11.190.32
xbv00083.vdf 8.11.190.32
xbv00084.vdf 8.11.190.32
xbv00085.vdf 8.11.190.32
xbv00086.vdf 8.11.190.32
xbv00087.vdf 8.11.190.32
xbv00088.vdf 8.11.190.32
xbv00089.vdf 8.11.190.32
xbv00090.vdf 8.11.190.32
xbv00091.vdf 8.11.190.32
xbv00092.vdf 8.11.190.32
xbv00093.vdf 8.11.190.32
xbv00094.vdf 8.11.190.32
xbv00095.vdf 8.11.190.32
xbv00096.vdf 8.11.190.32
xbv00097.vdf 8.11.190.32
xbv00098.vdf 8.11.190.32
xbv00099.vdf 8.11.190.32
xbv00100.vdf 8.11.190.32
xbv00101.vdf 8.11.190.32
xbv00102.vdf 8.11.190.32
xbv00103.vdf 8.11.190.32
xbv00104.vdf 8.11.190.32
xbv00105.vdf 8.11.190.32
xbv00106.vdf 8.11.190.32
xbv00107.vdf 8.11.190.32
xbv00108.vdf 8.11.190.32
xbv00109.vdf 8.11.190.32
xbv00110.vdf 8.11.190.32
xbv00111.vdf 8.11.190.32
xbv00112.vdf 8.11.190.32
xbv00113.vdf 8.11.190.32
xbv00114.vdf 8.11.190.32
xbv00115.vdf 8.11.190.32
xbv00116.vdf 8.11.190.32
xbv00117.vdf 8.11.190.32
xbv00118.vdf 8.11.190.32
xbv00119.vdf 8.11.190.32
xbv00120.vdf 8.11.190.32
xbv00121.vdf 8.11.190.32
xbv00122.vdf 8.11.190.32
xbv00123.vdf 8.11.190.32
xbv00124.vdf 8.11.190.32
xbv00125.vdf 8.11.190.32
xbv00126.vdf 8.11.190.32
xbv00127.vdf 8.11.190.32
xbv00128.vdf 8.11.190.32
xbv00129.vdf 8.11.190.32
xbv00130.vdf 8.11.190.32
xbv00131.vdf 8.11.190.32
xbv00132.vdf 8.11.190.32
xbv00133.vdf 8.11.190.32
xbv00134.vdf 8.11.190.32
xbv00135.vdf 8.11.190.32
xbv00136.vdf 8.11.190.32
xbv00137.vdf 8.11.190.32
xbv00138.vdf 8.11.190.32
xbv00139.vdf 8.11.190.32
xbv00140.vdf 8.11.190.32
xbv00141.vdf 8.11.190.32
xbv00142.vdf 8.11.190.32
xbv00143.vdf 8.11.190.32
xbv00144.vdf 8.11.190.32
xbv00145.vdf 8.11.190.32
xbv00146.vdf 8.11.190.32
xbv00147.vdf 8.11.190.32
xbv00148.vdf 8.11.190.32
xbv00149.vdf 8.11.190.32
xbv00150.vdf 8.11.190.32
xbv00151.vdf 8.11.190.32
xbv00152.vdf 8.11.190.32
xbv00153.vdf 8.11.190.32
xbv00154.vdf 8.11.190.32
xbv00155.vdf 8.11.190.32
xbv00156.vdf 8.11.190.32
xbv00157.vdf 8.11.190.32
xbv00158.vdf 8.11.190.32
xbv00159.vdf 8.11.190.32
xbv00160.vdf 8.11.190.32
xbv00161.vdf 8.11.190.32
xbv00162.vdf 8.11.190.32
xbv00163.vdf 8.11.190.32
xbv00164.vdf 8.11.190.32
xbv00165.vdf 8.11.190.32
xbv00166.vdf 8.11.190.32
xbv00167.vdf 8.11.190.32
xbv00168.vdf 8.11.190.32
xbv00169.vdf 8.11.190.32
xbv00170.vdf 8.11.190.32
xbv00171.vdf 8.11.190.32
xbv00172.vdf 8.11.190.32
xbv00173.vdf 8.11.190.32
xbv00174.vdf 8.11.190.32
xbv00175.vdf 8.11.190.32
xbv00176.vdf 8.11.190.32
xbv00177.vdf 8.11.190.32
xbv00178.vdf 8.11.190.32
xbv00179.vdf 8.11.190.32
xbv00180.vdf 8.11.190.32
xbv00181.vdf 8.11.190.32
xbv00182.vdf 8.11.190.32
xbv00183.vdf 8.11.190.32
xbv00184.vdf 8.11.190.32
xbv00185.vdf 8.11.190.32
xbv00186.vdf 8.11.190.32
xbv00187.vdf 8.11.190.32
xbv00188.vdf 8.11.190.32
xbv00189.vdf 8.11.190.32
xbv00190.vdf 8.11.190.32
xbv00191.vdf 8.11.190.32
xbv00192.vdf 8.11.190.32
xbv00193.vdf 8.11.190.32
xbv00194.vdf 8.11.190.32
xbv00195.vdf 8.11.190.32
xbv00196.vdf 8.11.190.32
xbv00197.vdf 8.11.190.32
xbv00198.vdf 8.11.190.32
xbv00199.vdf 8.11.190.32
xbv00200.vdf 8.11.190.32
xbv00201.vdf 8.11.190.32
xbv00202.vdf 8.11.190.32
xbv00203.vdf 8.11.190.32
xbv00204.vdf 8.11.190.32
xbv00205.vdf 8.11.190.32
xbv00206.vdf 8.11.190.32
xbv00207.vdf 8.11.190.32
xbv00208.vdf 8.11.190.32
xbv00209.vdf 8.11.190.32
xbv00210.vdf 8.11.190.32
xbv00211.vdf 8.11.190.32
xbv00212.vdf 8.11.190.32
xbv00213.vdf 8.11.190.32
xbv00214.vdf 8.11.190.32
xbv00215.vdf 8.11.190.32
xbv00216.vdf 8.11.190.32
xbv00217.vdf 8.11.190.32
xbv00218.vdf 8.11.190.32
xbv00219.vdf 8.11.190.32
xbv00220.vdf 8.11.190.32
xbv00221.vdf 8.11.190.32
xbv00222.vdf 8.11.190.32
xbv00223.vdf 8.11.190.32
xbv00224.vdf 8.11.190.32
xbv00225.vdf 8.11.190.32
xbv00226.vdf 8.11.190.32
xbv00227.vdf 8.11.190.32
xbv00228.vdf 8.11.190.32
xbv00229.vdf 8.11.190.32
xbv00230.vdf 8.11.190.32
xbv00231.vdf 8.11.190.32
xbv00232.vdf 8.11.190.32
xbv00233.vdf 8.11.190.32
xbv00234.vdf 8.11.190.32
xbv00235.vdf 8.11.190.32
xbv00236.vdf 8.11.190.32
xbv00237.vdf 8.11.190.32
xbv00238.vdf 8.11.190.32
xbv00239.vdf 8.11.190.32
xbv00240.vdf 8.11.190.32
xbv00241.vdf 8.11.190.32
xbv00242.vdf 8.11.190.32
xbv00243.vdf 8.11.190.32
xbv00244.vdf 8.11.190.32
xbv00245.vdf 8.11.190.32
xbv00246.vdf 8.11.190.32
xbv00247.vdf 8.11.190.32
xbv00248.vdf 8.11.190.32
xbv00249.vdf 8.11.190.32
xbv00250.vdf 8.11.190.32
xbv00251.vdf 8.11.190.32
xbv00252.vdf 8.11.190.32
xbv00253.vdf 8.11.190.32
xbv00254.vdf 8.11.190.32
xbv00255.vdf 8.11.190.32
local000.vdf
webcat0.dat
webcat1.dat
webcat2.dat
webcat3.dat
webcat4.dat
repair.rdf 1.0.2.30
03.12.2014 12:54 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version:
VDF Version:
03.12.2014 12:54 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version: 8.3.26.28
VDF Version: 8.11.190.32
03.12.2014 12:53 [Echtzeit-Scanner] Dienst gestoppt
Der Dienst wurde gestoppt.
03.12.2014 12:51 [Planer] Auftrag gestartet
Auftrag "update_after_installation"
wurde erfolgreich gestartet.
03.12.2014 12:51 [Planer] Auftrag gestartet
Auftrag "AVImmediateUpdateJobEx"
wurde erfolgreich gestartet.
03.12.2014 12:51 [Planer] Auftrag gestartet
Auftrag "AVImmediateUpdateJobEx"
wurde erfolgreich gestartet.
03.12.2014 12:51 [Planer] Auftrag gestartet
Auftrag "AVImmediateUpdateJobEx"
wurde erfolgreich gestartet.
03.12.2014 12:51 [Planer] Auftrag gestartet
Auftrag "AVImmediateUpdateJobEx"
wurde erfolgreich gestartet.
03.12.2014 12:51 [Planer] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version 14.0.7.310
03.12.2014 12:51 [Echtzeit-Scanner] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version:
VDF Version:
03.12.2014 12:51 [Hilfsdienst] Dienst gestartet
Der Dienst wurde gestartet.
Dienst Version: 14.0.7.310
Engine Version: 8.3.24.38
VDF Version: 8.11.180.188
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 03.12.2014 Scan Time: 18:25:38 Logfile: Malwarbyte.txt Administrator: Yes Version: 2.00.3.1025 Malware Database: v2014.12.03.08 Rootkit Database: v2014.12.02.02 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 CPU: x64 File System: NTFS User: BiLo Scan Type: Threat Scan Result: Completed Objects Scanned: 324322 Time Elapsed: 55 min, 34 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 33 PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\APPID\{1DD31B76-C57E-49ba-94BC-BF53F0C82CD4}, Quarantined, [d59fcf8f63199a9c40e656898979619f], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, Quarantined, [d59fcf8f63199a9c40e656898979619f], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{1DD31B76-C57E-49BA-94BC-BF53F0C82CD4}, Quarantined, [d59fcf8f63199a9c40e656898979619f], PUP.Optional.AdPeak.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}, Quarantined, [581ccc92e8945dd9945b3890c04247b9], PUP.Optional.AdPeak.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{10AD2C61-0898-4348-8600-14A342F22AC3}, Quarantined, [581ccc92e8945dd9945b3890c04247b9], PUP.Optional.AdPeak.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{10AD2C61-0898-4348-8600-14A342F22AC3}, Quarantined, [581ccc92e8945dd9945b3890c04247b9], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{91878E42-FC03-4785-B513-1F9E613D1027}, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FCB380C4-D350-44BE-8791-50216F4747AC}, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{D02E3AB9-7796-40cb-BDFC-20D834FE1F75}, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker.1, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\CLASSES\ASBarBroker.BDBroker, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker, Quarantined, [40342539e3997db9ad770bd4ba4854ac], PUP.Optional.Funshion, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASBarBroker.BDBroker.1, Quarantined, [40342539e3997db9ad770bd4ba4854ac], Trojan.Banker, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{975670D0-7EFB-4fa8-90FA-3AE575B9FB77}, Quarantined, [d79da8b65824b97d40530bd08a78619f], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [fa7a4c1247353ff79400fdcd06fc46ba], Trojan.Cinmus, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{A7F05EE4-0426-454F-8013-C41E3596E9E9}, Quarantined, [9cd857074d2f2f07428b6c86fb071ee2], Adware.BDSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}, Quarantined, [a4d01c4297e57db9512f27bb02001be5], PUP.Optional.AdPeak.A, HKLM\SOFTWARE\LevelQualityWatcher, Quarantined, [522264facdafeb4b5b94a0c024dfec14], PUP.Optional.RRSavings.A, HKLM\SOFTWARE\rrsavings, Quarantined, [f67ea4ba5329e056b8d97bf642c19769], PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, Quarantined, [84f01a449be104323b6e2c3b6e957090], PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, Quarantined, [a6cef866b3c934029a9922985aaa0ff1], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [fd77aeb0ed8f39fda54368e19f649868], PUP.Optional.RRSavings.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\RrSavings, Quarantined, [0470510dcfade5519003531e689b20e0], PUP.Optional.WebSearches.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SupHpUISoft, Quarantined, [0074025c3e3e32048104b79f3ac916ea], PUP.Optional.PassShow.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PassShow, Quarantined, [3143bba3cab249ed31b956f5679c2ed2], PUP.Optional.RRSavings.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Rr Savings, Quarantined, [561ef5691864ab8b6134234eac57a957], PUP.Optional.RRSavings.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\rrsavings, Quarantined, [393b4e10a5d7cf675c382e439c67d32d], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Quarantined, [95dfa2bc73097bbbbd678ef6fa09d030], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Quarantined, [a0d4510df6862115dd6ba7f38a7a44bc], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SEARCHPROTECTINT, Quarantined, [185ced71d9a3d264521a275caf5431cf], PUP.Optional.SnapDo.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR, Quarantined, [77fdafafdf9dbe785fafaed6c2410ef2], Registry Values: 5 PUP.Optional.FreeMakeConverter.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fmconverter@gmail.com, C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\, Quarantined, [7ef60c527903e155b125024647bc2ad6] PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\extensions\faststartff@gmail.com, Quarantined, [c9ab520c681469cdfc514079df25a759] PUP.Optional.InstallCore.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0H1N1M, Quarantined, [a0d4510df6862115dd6ba7f38a7a44bc] PUP.Optional.SearchProtect.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SEARCHPROTECTINT|Install, 1, Quarantined, [185ced71d9a3d264521a275caf5431cf] PUP.Optional.SnapDo.A, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR|publisher, SnapdoOCYB, Quarantined, [77fdafafdf9dbe785fafaed6c2410ef2] Registry Data: 2 PUP.Optional.Snapdo, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b39a96f0-04d5-429d-b1bc-6f02906a0b48&searchtype=ds&q={searchTerms}&installDate={installDate}, Good: (www.google.com), Bad: (hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b39a96f0-04d5-429d-b1bc-6f02906a0b48&searchtype=ds&q={searchTerms}&installDate={installDate}),Replaced,[b2c21747a5d7f0466d5078e6ef168080] PUP.Optional.Snapdo, HKU\S-1-5-21-2015670880-1155494743-3860310727-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b39a96f0-04d5-429d-b1bc-6f02906a0b48&searchtype=ds&q={searchTerms}&installDate={installDate}, Good: (www.google.com), Bad: (hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b39a96f0-04d5-429d-b1bc-6f02906a0b48&searchtype=ds&q={searchTerms}&installDate={installDate}),Replaced,[4a2a530b98e47cba407f85d929dcd927] Folders: 25 PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config, Quarantined, [71031b436f0d8ea877ff411c17ec718f], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\index-dir, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\databases, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Local Storage, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\040C5D034F2147B8A1A3EFBCA8975AA4, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\0702E43377EF4C39A11655C93B0B5365, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\0D26091890DC4E71AF268DB8C8FFD51B, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\5A465C0BD5D94A7F9E5DD6FFA88D7FD6, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\9D5D9AD0B35941DABF2925943CCCABE2, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\BBA7E62D20A4480B896E336F9AE694C3, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.SearchGolTB.A, C:\Users\BiLo\AppData\Local\Temp\mt_ffx\searchgol, Quarantined, [056f9cc20a72a98dbb2fe62dea19817f], PUP.Optional.SearchGolTB.A, C:\Users\BiLo\AppData\Local\Temp\mt_ffx\searchgol\searchgol, Quarantined, [056f9cc20a72a98dbb2fe62dea19817f], PUP.Optional.SearchGolTB.A, C:\Users\BiLo\AppData\Local\Temp\mt_ffx\searchgol\searchgol\1.8.16.19, Quarantined, [056f9cc20a72a98dbb2fe62dea19817f], PUP.Optional.Extutil.A, C:\Users\BiLo\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, Quarantined, [2d47a4ba8eee42f4ca38909b976cde22], PUP.Optional.Managera.A, C:\Users\BiLo\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, Quarantined, [db9978e657252c0a0ff4b477986bed13], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, Quarantined, [8ce8b7a77c006ccaac6643e8c24131cf], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\log, Quarantined, [8ce8b7a77c006ccaac6643e8c24131cf], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, Quarantined, [8ce8b7a77c006ccaac6643e8c24131cf], PUP.Optional.GlobalUpdate.A, C:\Users\BiLo\AppData\Local\Temp\comh.456248, Quarantined, [294b2c32adcf90a648b80e1fb94ade22], Files: 219 PUP.Optional.AdPeak.A, C:\Program Files (x86)\Rr Savings\RrSavings.dll, Quarantined, [581ccc92e8945dd9945b3890c04247b9], PUP.Optional.PCFixSpeed.A, C:\Users\BiLo\AppData\Roaming\OpenCandy\0702E43377EF4C39A11655C93B0B5365\SearchGolTB.exe, Quarantined, [f67e1c42146857dfe85a1baf7b89b64a], PUP.Optional.SearchProtect.A, C:\Users\BiLo\AppData\Roaming\OpenCandy\0D26091890DC4E71AF268DB8C8FFD51B\sp-downloader.exe, Quarantined, [88ec09551a6269cd32679409b8493bc5], PUP.Optional.OpenCandy.A, C:\Users\BiLo\AppData\Roaming\OpenCandy\5A465C0BD5D94A7F9E5DD6FFA88D7FD6\LatestDLMgr.exe, Quarantined, [5b193a240b711224bbb27cace81938c8], PUP.Optional.AdPeak.A, C:\temp\t.msi, Quarantined, [7ff54c120775de5884610c2638cd649c], PUP.Optional.BundleInstaller.A, C:\Users\BiLo\Downloads\Setup (1).exe, Quarantined, [bbb9da84a5d71f177bdfb86c2bd58080], PUP.Optional.BundleInstaller.A, C:\Users\BiLo\Downloads\Setup (2).exe, Quarantined, [89eb0559dca035010d4d93915da37f81], PUP.Optional.Bundlore, C:\Users\BiLo\Downloads\setup (3).exe, Quarantined, [581c194516661a1c7cd4d3451fe623dd], PUP.Optional.BundleInstaller.A, C:\Users\BiLo\Downloads\Java.exe, Quarantined, [ec88530b6c1055e142ec43f968998080], PUP.Optional.OpenCandy, C:\Users\BiLo\Downloads\FreemakeVideoConverterSetup_4.0.0.9.exe, Quarantined, [1064b8a6403cc6702d8565c47d8452ae], PUP.Optional.Spigot, C:\Users\BiLo\Downloads\YTD483Setup.exe, Quarantined, [8ee6f569e29ad85ed33efabd13ee15eb], PUP.Optional.Bandoo, C:\Users\BiLo\Downloads\iLividSetup-r394-n-bc (1).exe, Quarantined, [2054eb73700c45f1ac0cbf66cd3436ca], PUP.Optional.Bandoo, C:\Users\BiLo\Downloads\iLividSetup-r394-n-bc.exe, Quarantined, [79fb82dc45375dd97d3b68bd788941bf], PUP.Optional.AdPeak.A, C:\Windows\Installer\267ded.msi, Quarantined, [84f029350b712610e40151e135d011ef], PUP.Optional.SmartBar.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_amfclgbdpgndipgoegfpkkgobahigbcl_0.localstorage, Quarantined, [cca86af486f6221439d9083dcc3729d7], PUP.Optional.SmartBar.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_amfclgbdpgndipgoegfpkkgobahigbcl_0.localstorage-journal, Quarantined, [284c5e00bfbde551b35f68dde1228b75], PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\ver.xml, Quarantined, [71031b436f0d8ea877ff411c17ec718f], PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe, Quarantined, [71031b436f0d8ea877ff411c17ec718f], PUP.Optional.LiveLyrics.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.livelyrics00.live-lyrics.com_0.localstorage, Quarantined, [3440510d4e2e7db9e7849bcfcb38a35d], PUP.Optional.LiveLyrics.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.livelyrics00.live-lyrics.com_0.localstorage-journal, Quarantined, [007495c9bfbdf73f81eaa9c1e320d32d], PUP.Optional.Trovi.A, C:\Users\BiLo\AppData\Roaming\Mozilla\Firefox\Profiles\08vv59hj.default\searchplugins\trovi-search.xml, Quarantined, [383c273746363ff7f4763b318b78c13f], PUP.Optional.LiveLyrics.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage, Quarantined, [e68ed18db6c686b0511b1656986b01ff], PUP.Optional.LiveLyrics.A, C:\Users\BiLo\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.livelyrics00.live-lyrics.com_0.localstorage-journal, Quarantined, [d99b045acfadab8b29432e3e28db867a], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\QuotaManager-journal, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\cookies, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\cookies-journal, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\QuotaManager, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\website.ico, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\0391508644c19a21_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\0eccbae11a6f5ecb_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\0f33e409dd0fc209_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\1041015f9233625e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\10ba1a6dd717f76d_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\11e6110ae031549d_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\11f0fb0b13525c35_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\1891c3c199143c01_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\192a5edd7f4ae77a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\1aa0282fbbc6c50a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\1e3d6418f83d7f4f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\209ca589b30e27b7_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2389bacb72342bfe_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\239a90dfaf073813_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\659b5cfc7ccacedb_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\66dae7ea99dcbbd8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\68868552a17a5984_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\6b8ccb2ff592fc29_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\6da5d3816808bf54_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\6e7ce84851014eac_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\6f7767bba8cebab3_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\75ec5f93c9bf6544_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\76c4b88915132c62_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\76e88df581d162b5_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7790e844b0e98891_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\79198261be8cb252_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7999e89c947ac08f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\b289f232b5094c1c_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\b44ca478bf0353cb_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\b903affd77be6a11_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\baaad00a0230e1dd_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\bc224dc2f5365a88_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\bc347c170e05ff2f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c200eb68ce03bf0a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c4b917d6c89772e6_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c4ca34fbacccadb8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c54bf716db823006_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c5d01da770880359_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c7b80a13452fff3c_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\c8204462e6bd29c4_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ca4db7f4e93c2dd2_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ca8ae2f624c115e5_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\caeb5db39065b322_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d8569788d42812d8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\dadd80d281d6eec9_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\db959369648d3451_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\dd05cf2d49253455_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\de858106cfc34604_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ded9bf09be938bb0_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e03f65034b6fcd49_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e100c1b18b143ef8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e10a40d9d051ce22_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a0057a458f3dc559_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a129eef5058dde79_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a1d231c44b98e792_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a24338160301e511_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a27f6a71a3315605_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a293429572645627_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a33a6df31c300466_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a3d0400f409d65c9_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a49df59ac523a5b2_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a61068ce16a656c5_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a682a844981d4e40_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\a92ae4bf84941533_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ad6a43c509b8b414_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\aecb82ebbbe91493_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\b009d14dab9621d7_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\32c15340f0117e9a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\3353c0a29260a0dd_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\346325161b82b112_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\358b1f8a07d41dc3_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\3679240fe3115f35_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\3736e4c0cf5a8c1e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\38e0e004ba8628f7_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\45e3212b34078829_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\46ed3a4430cde43a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4777820e2f4ff78a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\47cff2ba15008159_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\48602aaf0de52c18_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4969095fb6cc2208_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4b31449684928a10_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e1e806fb78245513_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7b4e32d5a96e1de8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7c000d76bf1f0157_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7c55d307fe43e78a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7d8baeb5fa0fb7aa_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\7fc3efd97363b9d1_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\84dfd86f57110d6e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\86cd43f2d0bae84b_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\8a2abd4eed83e9d6_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\8a89305e64fa0dc3_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\8b26da64eb9f82de_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\cc1ccafa24e33b87_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\cc3ef367bd642e8a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ce8c46a231163cc8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\cf2dacb2ef4a2549_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\cfef3b34cc1f66b9_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d0589bdc5c45ae41_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d14ca16812c9d3fd_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d1dfc9baf114f551_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d3a28080e4dea391_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d470a03b87f18464_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d5032bd60a53fcde_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d5c9d2590e7af9ea_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d637438e2a06492b_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d681aebf460cb29b_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\d853bbd0688c803d_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4d20553ff9d3edf4_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4daf3cbc2c7e199f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4db07c6a773edb3f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\4fc8ebc30a2a5f62_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\50b6f6dedd814b4a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\531ad77db1fe86a4_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\5396f746cdc60618_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\56d8c1ba67f4bc12_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\58356a09f280edf5_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\589ee6c1bbbdb758_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\59b8977b859685e3_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\59e45516295f8e4c_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\5b7417275fbe29e4_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\5e25a1f3929f7e99_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\5ed1cb2ed3d4503d_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\62e27f935b9bf95b_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\6310b9b27313c4b3_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\63d4dfeb795e6004_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\239da1c9375f3222_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\259c6aa627803dae_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\25aba580c575808f_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\25c1ed2fe28df335_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\264b294c7ddba978_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\27e9e90e0dadb275_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\28b0dc98176c4830_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2984cb4670d75438_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2a2edbda263790c6_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2ad8a646a82ac751_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2ae4c6c7a9b3ec27_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2b983046aa68280a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2c04bbf443eae70c_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2de558d6e537e61a_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\2f607f41aafa33fe_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\315a39b606bc4359_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\327e2f346370c855_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\8f0b0ac7676862f1_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\91a501b48ee2cb0b_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\954b9c606802895e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\96a4a3fc8559cc07_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\96aed09277c30d8d_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\97dd353c55aff7f8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\980660044736b96e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\991f99ca63e7f220_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\9afb5765bdd6ea37_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\9bbb19db0be626a7_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\9bc7f4ee83c20677_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\9d66c6f9938a5160_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\9f9647c4aef2deb8_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e4e348cd9411aae4_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e8e2ce151826761e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\e93f9019765cdcb6_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\ebfd932e35eb1606_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\f223eb2ed0c26c31_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\f36136a75620219e_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\f58f2d29be04132c_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\index, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Cache\index-dir\the-real-index, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\databases\Databases.db, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\databases\Databases.db-journal, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache\data_0, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache\data_1, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache\data_2, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache\data_3, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\GPUCache\index, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.bak, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.ldb, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000006.log, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\CURRENT, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOCK, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG.old, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000004, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Local Storage\file__0.localstorage, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.Gameo.A, C:\Users\BiLo\AppData\Local\Gameo\Local Storage\file__0.localstorage-journal, Quarantined, [007466f8760625114d7ea90c49bbfa06], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\040C5D034F2147B8A1A3EFBCA8975AA4\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\5A465C0BD5D94A7F9E5DD6FFA88D7FD6\3209.ico, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\5A465C0BD5D94A7F9E5DD6FFA88D7FD6\speedupmypcDE.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\5A465C0BD5D94A7F9E5DD6FFA88D7FD6\speedupmypcDE_p2v0.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\9D5D9AD0B35941DABF2925943CCCABE2\Trial-14.0.1000.89_de-DE_1004733_DE-2.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\BBA7E62D20A4480B896E336F9AE694C3\3709.ico, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\BBA7E62D20A4480B896E336F9AE694C3\Installer.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.OpenCandy, C:\Users\BiLo\AppData\Roaming\OpenCandy\BBA7E62D20A4480B896E336F9AE694C3\OCBrowserHelper_1.0.6.124.exe, Quarantined, [0272db83d0ac0f271325a271f0138a76], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\log\ProtectWindowsManager_2014-08-30[15-39-47-865].log, Quarantined, [8ce8b7a77c006ccaac6643e8c24131cf], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, Quarantined, [8ce8b7a77c006ccaac6643e8c24131cf], Physical Sectors: 0 (No malicious items detected) (end) ISt mein PC noch zu retten?  PS: Avira habe ich nicht komplett durchlaufen lassen |
|
04.12.2014, 13:03
| #4 |
| | FRSTCode:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2014
Ran by BiLo at 2014-12-04 12:45:59
Running from C:\Users\BiLo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
888poker (HKLM-x32\...\888poker) (Version: - )
AbiWord 2.9.4 (HKLM-x32\...\AbiWord2) (Version: 2.9.4 - AbiSource Developers)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
aEton CommunicaEor (HKLM-x32\...\aEton CommunicaEor) (Version: 0.1.0.03 - aEton Usenet LTD)
Amyuni PDF Converter (HKLM-x32\...\Amyuni PDF Converter) (Version: - )
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
C&C:Online (HKLM-x32\...\{4A6B85E6-645E-4C3C-85BD-48764CD6FFBF}) (Version: 2.0.5 - Revora)
Command & Conquer Generals (HKLM-x32\...\InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}) (Version: 0.50.0000 - Electronic Arts)
Command & Conquer Generals (x32 Version: 0.50.0000 - Electronic Arts) Hidden
Command and ConquerTM Generals Zero Hour (HKLM-x32\...\InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}) (Version: 1.00.0000 - Electronic Arts)
Command and ConquerTM Generals Zero Hour (x32 Version: 1.00.0000 - Electronic Arts) Hidden
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Curse Client (HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.820 - Curse)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.3.0297 - DT Soft Ltd)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Dropbox (HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
Free Studio version 6.4.0.1111 (HKLM-x32\...\Free Studio_is1) (Version: 6.4.0.1111 - DVDVideoSoft Ltd.)
Free Video Converter V 3.2 (HKLM-x32\...\Free Video Converter_is1) (Version: 3.2.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.44.820 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.44.820 - DVDVideoSoft Ltd.)
Freemake Video Converter Version 4.0.0 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.0.0 - Ellora Assets Corporation)
Gameforge Live 1.9.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.9.0 - Gameforge)
GameRanger (HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\GameRanger) (Version: - GameRanger Technologies)
GenTool (HKLM-x32\...\GenTool) (Version: 6.5 - xezon)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
League of Legends (HKLM-x32\...\{918A9082-6287-4D25-9002-5E5D5E4971CB}) (Version: 1.02.0000 - Riot Games)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
NC Launcher (GameForge) (HKLM-x32\...\NCLauncher_GameForge) (Version: - NCsoft)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Par-N-Rar 1.3 (HKLM-x32\...\Par-N-Rar) (Version: 1.3 - MilowSoft)
PC Camera(0028.2010.0804.1040) (HKLM-x32\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 0028.2010.0804.1040 - PixArt)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
QQÓÎÏ· (HKLM-x32\...\QQÓÎÏ·) (Version: 2.5.201.93 - ÌÚѶ¹«Ë¾)
QQ游戏 (HKLM-x32\...\QQ游戏) (Version: 3.3.1.1 - 腾讯公司)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
RrSavings (x32 Version: 1.0.0.0 - RrSavings) Hidden
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
signotec SignoSign R5 V10.0.1200 (HKLM\...\{F799B76A-F71E-4425-AFA1-32CEB613AF71}) (Version: 10.0.1200 - signotec GmbH)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: - TeamSpeak Systems GmbH)
Tencent QQMail Plugin (HKLM-x32\...\QQMailPlugin) (Version: - )
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73 - TuneUp Software) Hidden
Unity Web Player (HKU\S-1-5-21-2015670880-1155494743-3860310727-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
新毒霸(悟空) (HKLM-x32\...\Kingsoft Internet Security) (Version: 2013.9.5 - Kingsoft Internet Security)
腾讯QQ (HKLM-x32\...\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}) (Version: 5.4.11066.0 - 腾讯科技(深圳)有限公司)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{71e7837f-79d9-4389-b943-69ce7dcc7c3a}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015670880-1155494743-3860310727-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\BiLo\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
02-12-2014 11:51:58 Windows 7 Service Pack 1
03-12-2014 15:18:16 Säuberung (Spybot - Search & Destroy 2.4, Administratorrechte)
03-12-2014 15:19:24 Säuberung (Spybot - Search & Destroy 2.4, Administratorrechte)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {00EC7AF5-A8A4-4AC0-8503-66552D58242E} - System32\Tasks\{AFF392D1-9D36-4C26-BDB6-0A3686269BE2} => E:\Spiele\FUSSBALL MANAGER 13\Manager13.exe
Task: {12F52B25-2E03-4D32-9F53-3F8A8B832F67} - System32\Tasks\{1FC1A327-D630-49A5-B977-4724C11449C0} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-10-01] (Skype Technologies S.A.)
Task: {1C608E44-F88C-4041-8E48-ED6C28B05CCD} - System32\Tasks\{CF80FCC6-6C6F-48A4-935C-430F55813044} => E:\Spiele\zh\generals.exe [2003-08-30] ()
Task: {22EAB685-9C78-41DC-8E2B-DB0DAF09549F} - System32\Tasks\{28C826A1-5CCF-49A6-ABB3-86E84D23868C} => Firefox.exe hxxp://ui.skype.com/ui/0/6.0.0.126/de/abandoninstall?page=tsProgressBar
Task: {25E57950-E81D-456A-8A84-36F73880F5FE} - System32\Tasks\{B6F6024A-6CA9-451F-A05C-8778AA67AA4B} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.73.106.456/de/abandoninstall?page=tsProgressBar
Task: {2790034D-859A-4856-9122-58CA612C2002} - System32\Tasks\{6DE3772A-75ED-497D-8003-A80E26F0C184} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.3.0.107/de/abandoninstall?page=tsProgressBar
Task: {34082A8F-32A0-4011-B6BB-170C2D0E692D} - System32\Tasks\{1C882C30-00F3-4CCE-8422-E41FEDB3FFB0} => E:\Spiele\zh\generals.exe [2003-08-30] ()
Task: {3FD79787-884C-416C-99ED-04F408364D09} - System32\Tasks\{EFE9267B-D22A-4930-B6A2-542D00388617} => C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe [2014-11-11] (DVDVideoSoft Ltd.)
Task: {4B3136BC-1248-4FC5-839D-34BE85AD3B0E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-16] (Google Inc.)
Task: {5F02E7D4-DD6A-460C-9995-FD80CF53F661} - System32\Tasks\{E44E4383-1CE5-4439-A370-CE5C9C6FB6EB} => c:\program files (x86)\opera\launcher.exe
Task: {786F42B4-9464-4697-99B4-405969F9113D} - System32\Tasks\{F576769D-C926-4E3B-BED7-36E8C9EB2512} => C:\Users\BiLo\Desktop\LL7Class.exe
Task: {79CA6218-3639-49DB-A07D-1CFACF1F276F} - System32\Tasks\{CD5DCEE5-E1E6-4771-AC0F-9C77AB8F7B4C} => C:\Users\BiLo\Downloads\GeneralsZH-104-german.exe
Task: {875CB2B1-E245-4AF5-8E93-BAA804BCCD72} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-01] (Adobe Systems Incorporated)
Task: {8D072B17-F5B8-493C-A8FE-E57E20472619} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {937B35E0-7C7C-4EC1-AFF2-5DF5D36A257C} - System32\Tasks\{8A39A08A-C386-49F9-983E-9BA2BD3C816A} => C:\Users\BiLo\Downloads\GeneralsZH-104-german.exe
Task: {9A67CCCB-4CAB-49AD-800A-CAAD387DED36} - System32\Tasks\{CAE5E631-BC97-4BA0-AA7B-BFDE4CCDA99D} => D:\Program Files\腾讯游戏\QQGame\QQGame.exe [2012-07-19] (深圳市腾讯计算机系统有限公司)
Task: {A9E5DDF3-9A10-41D3-94B2-4B546BF4599F} - System32\Tasks\{642F3DBF-A127-4B05-A212-064619C1AEB7} => E:\Spiele\FUSSBALL MANAGER 13\Manager13.exe
Task: {B210FD1A-D1DD-4288-AF8D-29336300DE77} - System32\Tasks\{35F9D774-76CA-4AC5-85A7-24F70301B877} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-10-01] (Skype Technologies S.A.)
Task: {DF0EA9C8-BF41-4BFA-9ADF-E50502C0A108} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-16] (Google Inc.)
Task: {EADCA56D-A809-4A55-B26F-3ED63667CD66} - System32\Tasks\{6A04D527-4C03-4BA8-9340-C698FAB43AA3} => C:\Users\BiLo\Downloads\LL7Class.exe
Task: {EC3D44A3-8F0C-47C0-BC53-6E6C51E8AF3C} - System32\Tasks\{47402809-6FE5-4EC6-8BFF-CA60D185020B} => E:\Spiele\zh\generals.exe [2003-08-30] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-12-30 14:37 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-12-03 11:56 - 2014-12-03 11:57 - 00679936 _____ () C:\Program Files\mediainformationaccess\updater.exe
2014-12-03 13:18 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-03 13:18 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-03 13:18 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-03 13:18 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-03 13:18 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-12-03 11:58 - 2014-12-03 11:58 - 00331264 _____ () C:\Windows\TEMP\bhelper.dll
2014-11-30 12:51 - 2014-11-25 07:39 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libglesv2.dll
2014-11-30 12:51 - 2014-11-25 07:39 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libegl.dll
2014-11-30 12:51 - 2014-11-25 07:39 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\pdf.dll
2014-11-30 12:51 - 2014-11-25 07:39 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll
2014-11-30 12:51 - 2014-11-25 07:39 - 14910280 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^BiLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip => C:\Windows\pss\CurseClientStartup.ccip.Startup
MSCONFIG\startupfolder: C:^Users^BiLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^BiLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^QQÓÎÏ·Æô¶¯¼ÓËÙ³ÌÐò.lnk => C:\Windows\pss\QQÓÎÏ·Æô¶¯¼ÓËÙ³ÌÐò.lnk.Startup
MSCONFIG\startupfolder: C:^Users^BiLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^QQ游戏启动加速程序.lnk => C:\Windows\pss\QQ游戏启动加速程序.lnk.Startup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EA Core => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: ICQ => "C:\Program Files (x86)\ICQ7.7\ICQ.exe" silent loginmode=4
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: kxesc => "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" -autorun
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: PAC7302_Monitor => C:\Windows\PixArt\PAC7302\Monitor.exe
MSCONFIG\startupreg: QDesk => "C:\Program Files (x86)\Tencent\QDesk\QDesk.exe" /parent=regrun
MSCONFIG\startupreg: QQ2009 => "C:\Program Files (x86)\Tencent\QQ\QQProtect\Bin\QQProtect.exe" /background
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Spotify => "C:\Users\BiLo\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\BiLo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: Steam => "E:\Spiele\steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-2015670880-1155494743-3860310727-500 - Administrator - Disabled)
BiLo (S-1-5-21-2015670880-1155494743-3860310727-1001 - Administrator - Enabled) => C:\Users\BiLo
Gast (S-1-5-21-2015670880-1155494743-3860310727-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2015670880-1155494743-3860310727-1002 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: tencent QMUdisk
Description: tencent QMUdisk
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: QMUdisk
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft-ISATAP-Adapter
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/04/2014 11:54:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018be9c
ID des fehlerhaften Prozesses: 0x1280
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (12/04/2014 11:54:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018be9c
ID des fehlerhaften Prozesses: 0x167c
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (12/03/2014 09:46:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018be9c
ID des fehlerhaften Prozesses: 0x1440
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (12/03/2014 09:46:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018be9c
ID des fehlerhaften Prozesses: 0x14e0
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (12/03/2014 04:19:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.
System Error:
Falscher Parameter.
.
Error: (12/03/2014 04:18:17 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.
System Error:
Falscher Parameter.
.
Error: (12/03/2014 01:32:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.4.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel: 0x4ec4b137
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000157cd
ID des fehlerhaften Prozesses: 0x4d8
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Error: (12/03/2014 01:32:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.4.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16915, Zeitstempel: 0x4ec4b137
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000157cd
ID des fehlerhaften Prozesses: 0x1750
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Error: (12/03/2014 00:38:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018be9c
ID des fehlerhaften Prozesses: 0xf44
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (12/03/2014 00:38:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 0.0.0.0, Zeitstempel: 0x547bf43e
Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bdb3b
Ausnahmecode: 0xc0020043
Fehleroffset: 0x0005cd59
ID des fehlerhaften Prozesses: 0x984
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
System errors:
=============
Error: (12/04/2014 00:26:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
%%1060
Error: (12/04/2014 00:26:58 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
%%1060
Error: (12/04/2014 00:16:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
%%1060
Error: (12/04/2014 11:53:29 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.
Error: (12/04/2014 11:53:12 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
%%1060
Error: (12/04/2014 11:53:02 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
wrnk
Error: (12/04/2014 11:52:19 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.
Error: (12/04/2014 11:51:21 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (12/04/2014 11:51:21 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (12/03/2014 10:28:19 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
%%1060
Microsoft Office Sessions:
=========================
Error: (12/04/2014 11:54:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eupdater.exe0.0.0.0547bf43ec00000050018be9c128001d00fb0b982846eC:\Program Files\mediainformationaccess\updater.exeC:\Program Files\mediainformationaccess\updater.exefbfac6f4-7ba3-11e4-a8e2-001a4d44dac1
Error: (12/04/2014 11:54:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eupdater.exe0.0.0.0547bf43ec00000050018be9c167c01d00fb0ae466051C:\Program Files\mediainformationaccess\updater.exeC:\Program Files\mediainformationaccess\updater.exef0f343f9-7ba3-11e4-a8e2-001a4d44dac1
Error: (12/03/2014 09:46:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eupdater.exe0.0.0.0547bf43ec00000050018be9c144001d00f37bf53442cC:\Program Files\mediainformationaccess\updater.exeC:\Program Files\mediainformationaccess\updater.exe70b6f938-7b2d-11e4-b8b0-001a4d44dac1
Error: (12/03/2014 09:46:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eupdater.exe0.0.0.0547bf43ec00000050018be9c14e001d00f37b7cb9544C:\Program Files\mediainformationaccess\updater.exeC:\Program Files\mediainformationaccess\updater.exe70b105b1-7b2d-11e4-b8b0-001a4d44dac1
Error: (12/03/2014 04:19:24 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.
System Error:
Falscher Parameter.
Error: (12/03/2014 04:18:17 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : GetNextFileMapContent() failed.
System Error:
Falscher Parameter.
Error: (12/03/2014 01:32:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.4.000000000ntdll.dll6.1.7600.169154ec4b137c000000500000000000157cd4d801d00ef535750e9dC:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll80e9ff5c-7ae8-11e4-abef-001a4d44dac1
Error: (12/03/2014 01:32:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.4.000000000ntdll.dll6.1.7600.169154ec4b137c000000500000000000157cd175001d00ef521968e47C:\Program Files\VideoLAN\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll6c1227ba-7ae8-11e4-abef-001a4d44dac1
Error: (12/03/2014 00:38:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eupdater.exe0.0.0.0547bf43ec00000050018be9cf4401d00ee83374d9a5C:\Program Files\mediainformationaccess\updater.exeC:\Program Files\mediainformationaccess\updater.exeea71b2eb-7ae0-11e4-abef-001a4d44dac1
Error: (12/03/2014 00:38:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: updater.exe0.0.0.0547bf43eRPCRT4.dll6.1.7600.163854a5bdb3bc00200430005cd5998401d00ee83034a212C:\Program Files\mediainformationaccess\updater.exeC:\Windows\syswow64\RPCRT4.dllded91593-7ae0-11e4-abef-001a4d44dac1
CodeIntegrity Errors:
===================================
Date: 2014-02-03 17:39:57.150
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-03 17:39:57.148
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-03 17:39:57.146
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-03 17:39:57.134
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-03 17:39:57.131
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-03 17:39:57.128
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-26 02:10:07.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-26 02:10:07.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-26 02:10:07.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-26 02:10:07.537
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz
Percentage of memory in use: 77%
Total physical RAM: 6142.49 MB
Available physical RAM: 1388.55 MB
Total Pagefile: 12283.12 MB
Available Pagefile: 6780.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:97.56 GB) (Free:21.46 GB) NTFS
Drive d: () (Fixed) (Total:407.23 GB) (Free:393.91 GB) NTFS
Drive e: () (Fixed) (Total:426.63 GB) (Free:240.59 GB) NTFS
Drive h: () (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 282C282C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=407.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=426.6 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
05.12.2014, 00:26
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Werbung im Hintergrund ohne etwas geöffnet zu haben Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
Linear-Darstellung
