| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
19.12.2014, 13:55
| #1 |
 |  PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. Hallo Trojaner-Board, mein PC ist seit ca. 1 Woche sehr langsam und das Internet ebenso. Es hängt nicht am Computer selbst, oder am Internet selbst, ich bin mir sicher dass das ein Virus ist. Nach dem Start öffnen sich automatisch komische Fenster und es tauchen verschiedene Fehlermeldungen auf. Ich wär sehr froh darüber, hier Hilfe zu bekommen und meinen PC wieder clean zu kriegen. MfG, OGKINGZ |
|
19.12.2014, 16:23
| #2 |
| /// Malwareteam   | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. Hi
__________________bitte als Admin ausführen : Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
19.12.2014, 16:42
| #3 |
| | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. frst
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-12-2014
Ran by Volkan (administrator) on VOLKAN-PC on 19-12-2014 16:29:02
Running from C:\Users\Volkan\Desktop
Loaded Profile: Volkan (Available profiles: Volkan & Elvan)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\AsLdrSrv.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 8\Monitor.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(TODO: <公司名稱>) C:\Program Files (x86)\PHotkey\GPMTray.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Universal Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
() C:\Program Files (x86)\IObit\Advanced SystemCare 8\RealTimeProtector.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\samp.exe
(TeamSpeak Systems GmbH) C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\ts3client_win64.exe
() C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\gta_sa.exe
() C:\Users\Volkan\Desktop\TürkLife\Laufscript\Laufscript.exe
() C:\Users\Volkan\Desktop\Csgo.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2967352 2012-11-06] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-03] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2691480 2014-03-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation)
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22059616 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272840 2014-03-31] (Microsoft Corporation)
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\MountPoints2: {66644f0c-50a1-11e4-9312-685d431525bf} - F:\LGAutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb2QDW7d8Z6ix_hAOkRLMxdyAneEgaTNI6Ue3Lc3dqLKDqEfXjY3p1IDrvwvYAn3gSH7s-VOzYxNalZ-7ftDQ3EYHReg6E3DYMNJ7FsSNXV__D0i4plf20lWcNoJmxIL4u5ILW19gveXlSVKs3CQVtx99RYJv0Wzg,,&q={searchTerms}
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-1782373422-569102784-2936947414-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb2QDW7d8Z6ix_hAOkRLMxdyAneEgaTNI6Ue3Lc3dqLKDqEfXjY3p1IDrvwvYAn3gSH7s-VOzYxNalZ-7ftDQ3EYHReg6E3DYMNJ7FsSNXV__D0i4plf20lWcNoJmxIL4u5ILW19gveXlSVKs3CQVtx99RYJv0Wzg,,&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM-x32 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
SearchScopes: HKU\S-1-5-21-1782373422-569102784-2936947414-1001 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
SearchScopes: HKU\S-1-5-21-1782373422-569102784-2936947414-1001 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
BHO: GoSave -> {0c3f1e49-7956-49fe-9a31-babed9a323c0} -> C:\Program Files (x86)\GoSave\mrnlNwUQSfhUPK.x64.dll ()
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll No File
BHO: YoutubeAdBlocke -> {5c775f45-d0c3-4cd2-b1bc-759a7d4722d0} -> C:\Program Files (x86)\YoutubeAdBlocke\GDs8CsR2G01xwe.x64.dll ()
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: No Name -> {C32F5BF7-6918-4F78-A97A-53CDF7D07C8C} -> C:\Users\Volkan\AppData\LocalLow\IE-BHO\bho.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKU\S-1-5-21-1782373422-569102784-2936947414-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1782373422-569102784-2936947414-1001 -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchUrl: hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Google
FF SelectedSearchEngine,S: WebSearch
FF Homepage: hxxp://google.de/
FF Keyword.URL: hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69&l=1&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=3 -> C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=9 -> C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-1782373422-569102784-2936947414-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF user.js: detected! => C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\Astromenda.xml
FF SearchPlugin: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\WebSearch.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-25]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-07-03]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\extensions\faststartff@gmail.com
FF HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\extensions\cliqz@cliqz.com
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Profile: C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh [2014-02-23]
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj [2012-10-30]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-27]
CHR Extension: (GoSave) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg [2014-11-11]
CHR Extension: (MySearchDial) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\iagcajndpnfncplednpbnkahadegklfa [2014-04-11]
CHR Extension: (Skype Click to Call) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-09-27]
CHR Extension: (Google Wallet) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-23]
CHR Extension: (HTML Coupon) - C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef [2014-11-11]
CHR HKLM\...\Chrome\Extension: [iagcajndpnfncplednpbnkahadegklfa] - C:\Users\Volkan\AppData\Local\speedial.crx [2014-04-11]
CHR HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\Chrome\Extension: [iagcajndpnfncplednpbnkahadegklfa] - C:\Users\Volkan\AppData\Local\speedial.crx [2014-04-11]
CHR HKLM-x32\...\Chrome\Extension: [aaaangaohdajkgeopjhpbnlpkehbhmbj] - C:\Users\Volkan\AppData\Local\APN\GoogleCRXs\aaaangaohdajkgeopjhpbnlpkehbhmbj_7.15.4.0.crx [2012-08-06]
CHR HKLM-x32\...\Chrome\Extension: [iagcajndpnfncplednpbnkahadegklfa] - C:\Users\Volkan\AppData\Local\speedial.crx [2014-04-11]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 AdvancedSystemCareService8; C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCService.exe [815392 2014-11-04] (IObit)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-18] ()
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-05-05] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2630432 2014-11-04] (IObit)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-03-29] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2013-07-20] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [107832 2013-07-20] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 UniversalUpdater; C:\Program Files (x86)\Universal Updater\UpdaterService.exe [623064 2014-09-23] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-03-29] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 b786bdb3c67d; C:\Windows\System32\drivers\b786bdb3c67d.sys [50504 2014-12-18] (Windows (R) Win 7 DDK provider)
S3 EagleX64; No ImagePath
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 X6va011; No ImagePath
S3 X6va017; No ImagePath
S3 X6va021; No ImagePath
S3 X6va022; No ImagePath
S3 X6va023; No ImagePath
S3 X6va027; No ImagePath
S1 Salus; system32\drivers\Salus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-19 16:29 - 2014-12-19 16:29 - 00028476 _____ () C:\Users\Volkan\Desktop\FRST.txt
2014-12-19 16:28 - 2014-12-19 16:29 - 00000000 ____D () C:\FRST
2014-12-19 16:27 - 2014-12-19 16:27 - 02121216 _____ (Farbar) C:\Users\Volkan\Desktop\FRST64.exe
2014-12-18 22:15 - 2014-12-19 16:01 - 00000336 _____ () C:\Windows\setupact.log
2014-12-18 22:15 - 2014-12-18 22:35 - 00003260 _____ () C:\Windows\PFRO.log
2014-12-18 22:15 - 2014-12-18 22:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-18 22:07 - 2014-12-18 22:07 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-18 22:06 - 2014-12-18 22:06 - 39441776 _____ () C:\Users\Volkan\Downloads\Firefox Setup 34.0.5.exe
2014-12-18 18:41 - 2014-12-18 18:42 - 00000000 ____D () C:\Program Files (x86)\SU1MyNDVjNDgwZA
2014-12-18 13:05 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 13:05 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-18 01:06 - 2014-12-18 01:06 - 00050504 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\b786bdb3c67d.sys
2014-12-16 17:55 - 2014-12-16 17:56 - 00000000 ____D () C:\Users\Elvan\AppData\Roaming\ProductData
2014-12-16 17:54 - 2014-12-16 17:55 - 00000000 ____D () C:\Users\Elvan\AppData\Roaming\IObit
2014-12-15 19:06 - 2014-12-15 19:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-12-15 19:06 - 2014-12-15 19:06 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-12-14 17:06 - 2014-12-14 17:06 - 00008704 _____ () C:\Users\Volkan\Desktop\Csgo.exe
2014-12-10 03:44 - 2014-12-10 03:44 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-10 03:04 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 03:04 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-09 22:04 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-09 22:04 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-09 22:04 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-09 22:04 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-09 22:04 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-09 22:04 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-09 22:04 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-09 22:04 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-09 22:04 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-09 22:04 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-09 22:04 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-09 22:04 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-09 22:04 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-09 22:04 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-09 22:04 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-09 22:04 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-09 22:04 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-09 22:03 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-09 22:03 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-09 22:03 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-09 22:03 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-09 22:03 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-09 22:03 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-09 22:03 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-09 22:03 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-09 22:03 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-09 22:03 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-09 22:03 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-09 22:03 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-09 22:03 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-09 22:03 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-09 22:03 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-09 22:03 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-09 22:03 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-09 22:03 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-09 22:03 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-09 22:03 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-09 22:03 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-09 22:03 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-09 22:03 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-09 22:03 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-09 22:03 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-09 22:03 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-09 22:03 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-09 22:03 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-09 22:03 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-09 22:03 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-09 22:03 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-09 22:03 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-09 22:03 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-09 22:03 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-09 22:03 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-09 22:03 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-09 22:03 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-09 22:03 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-09 22:03 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-09 22:03 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-09 22:03 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-09 22:03 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-09 22:03 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-09 22:01 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-09 22:01 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-09 22:01 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-09 22:01 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-09 22:01 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-09 22:01 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-09 22:01 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-09 22:01 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-09 22:01 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-09 22:01 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-09 22:01 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-09 22:01 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-09 22:01 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-09 22:01 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-07 15:11 - 2014-12-07 15:11 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\ProductData
2014-12-07 15:10 - 2014-12-15 19:05 - 00000000 ____D () C:\ProgramData\ProductData
2014-12-07 15:10 - 2014-12-07 15:11 - 00000000 ____D () C:\ProgramData\IObit
2014-12-07 15:10 - 2014-12-07 15:10 - 00003168 _____ () C:\Windows\System32\Tasks\ASC8_PerformanceMonitor
2014-12-07 15:10 - 2014-12-07 15:10 - 00002856 _____ () C:\Windows\System32\Tasks\ASC8_SkipUac_Volkan
2014-12-07 15:10 - 2014-12-07 15:10 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-12-07 15:10 - 2014-12-07 15:10 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2014-12-07 15:09 - 2014-12-07 16:23 - 00002185 _____ () C:\Users\Public\Desktop\Advanced SystemCare 8.lnk
2014-12-07 15:09 - 2014-12-07 15:10 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\IObit
2014-12-07 15:09 - 2014-12-07 15:10 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-12-07 15:09 - 2014-12-07 15:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 8
2014-12-07 15:05 - 2014-12-07 15:08 - 43183800 _____ (IObit ) C:\Users\Volkan\Downloads\advanced-systemcare-setup.exe
2014-12-02 01:57 - 2014-12-02 01:57 - 00000000 ____D () C:\Users\Volkan\Desktop\German-Midnight Server - Kopie
2014-11-29 19:08 - 2014-12-18 21:38 - 00000000 ____D () C:\Users\Elvan\AppData\Roaming\Seventh
2014-11-26 20:40 - 2014-12-19 16:03 - 00000000 ____D () C:\Users\Volkan\Tracing
2014-11-26 20:39 - 2014-11-26 20:39 - 00000000 ____D () C:\Windows\de
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\it
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\hu
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\fr
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\es
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\en
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\el
2014-11-26 20:38 - 2014-11-26 20:38 - 00000000 ____D () C:\Windows\da
2014-11-26 20:37 - 2014-11-26 20:37 - 00001378 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-11-26 20:37 - 2014-11-26 20:37 - 00001309 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-11-26 20:37 - 2014-11-26 20:37 - 00000000 ____D () C:\Windows\tr
2014-11-26 20:37 - 2014-11-26 20:37 - 00000000 ____D () C:\Windows\sl
2014-11-26 20:37 - 2014-11-26 20:37 - 00000000 ____D () C:\Windows\pl
2014-11-26 20:37 - 2014-11-26 20:37 - 00000000 ____D () C:\Windows\nl
2014-11-26 20:33 - 2014-11-26 20:33 - 00002490 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-11-26 20:32 - 2014-11-26 20:32 - 00000000 ____D () C:\Program Files\Windows Live
2014-11-26 20:32 - 2014-03-31 21:06 - 00058056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2014-11-26 20:29 - 2014-11-26 20:29 - 00002202 _____ () C:\Users\Volkan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-11-26 18:29 - 2014-11-26 18:29 - 00000000 ____D () C:\Users\Volkan\Desktop\YAHUSO MODPACK
2014-11-26 14:37 - 2014-11-26 14:37 - 00006144 ___SH () C:\Users\Volkan\Thumbs.db
2014-11-25 18:27 - 2014-12-18 22:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-24 17:37 - 2014-11-24 17:37 - 00000000 ____D () C:\Windows\SysWOW64\IPM
2014-11-20 12:25 - 2014-11-22 01:10 - 00000000 ____D () C:\Users\Volkan\Desktop\German-Midnight Server
2014-11-19 14:46 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 14:46 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 14:46 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 14:46 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-19 16:17 - 2013-02-09 21:00 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\TS3Client
2014-12-19 16:09 - 2009-07-14 05:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-19 16:09 - 2009-07-14 05:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-19 16:08 - 2012-08-03 16:20 - 01607546 _____ () C:\Windows\WindowsUpdate.log
2014-12-19 16:06 - 2013-02-10 19:29 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\Skype
2014-12-19 16:06 - 2012-08-06 16:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-12-19 16:04 - 2012-08-03 16:36 - 00000000 ____D () C:\Users\Volkan\Documents\Youcam
2014-12-19 16:02 - 2014-11-11 17:08 - 00000478 ____H () C:\Windows\Tasks\GS_Booster-S-576482620.job
2014-12-19 16:02 - 2014-09-27 01:15 - 00001340 _____ () C:\Windows\Tasks\YNQXV.job
2014-12-19 16:02 - 2014-07-17 23:48 - 00000962 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
2014-12-19 16:02 - 2014-02-23 11:53 - 00000000 ____D () C:\Users\Volkan\AppData\Local\LogMeIn Hamachi
2014-12-19 16:02 - 2012-08-03 16:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-19 16:01 - 2014-07-17 23:48 - 00000966 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job
2014-12-19 16:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-19 02:00 - 2013-07-23 19:24 - 00000000 ____D () C:\Users\Volkan\AppData\Local\Adobe
2014-12-19 01:57 - 2012-09-25 19:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-19 01:51 - 2012-08-03 16:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-18 22:27 - 2014-09-01 14:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-12-18 22:18 - 2014-10-24 20:18 - 00000000 ____D () C:\Users\Volkan\Desktop\Imagem
2014-12-18 22:15 - 2014-09-27 20:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-18 22:07 - 2014-09-27 20:32 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-18 21:54 - 2014-05-21 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-12-18 21:54 - 2014-03-07 20:37 - 00000000 ____D () C:\Users\Volkan\Desktop\Volkan
2014-12-18 21:39 - 2013-04-02 21:56 - 00000000 ____D () C:\Users\Elvan\AppData\Roaming\Skype
2014-12-18 21:39 - 2012-09-25 19:51 - 00000000 ____D () C:\Users\Elvan\AppData\Local\LogMeIn Hamachi
2014-12-18 21:39 - 2012-08-03 19:29 - 00000000 ____D () C:\Users\Elvan\Documents\Youcam
2014-12-18 21:26 - 2014-05-21 20:53 - 00000000 ____D () C:\ProgramData\Origin
2014-12-18 18:40 - 2012-08-03 20:30 - 00000000 __SHD () C:\Users\Elvan\AppData\Roaming\.#
2014-12-18 17:59 - 2012-08-03 20:30 - 00000000 ____D () C:\Users\Elvan\AppData\Roaming\ALDI_SUED_Mah_Jong
2014-12-17 17:05 - 2014-04-14 23:15 - 00000132 _____ () C:\Users\Volkan\AppData\Roaming\Adobe PNG-Format CC - Voreinstellungen
2014-12-16 20:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-15 19:10 - 2012-09-25 19:52 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-15 19:10 - 2012-09-25 19:52 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-15 19:10 - 2011-12-01 22:26 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-15 19:06 - 2014-11-04 12:59 - 00000930 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-12-13 22:07 - 2013-03-13 20:07 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-13 22:07 - 2013-03-13 20:07 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-13 15:47 - 2013-03-13 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-10 03:44 - 2014-04-30 06:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-10 03:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-10 03:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-10 03:17 - 2013-09-16 23:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-10 03:06 - 2011-07-18 21:31 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-10 01:45 - 2014-09-18 23:06 - 00000000 ____D () C:\Users\Volkan\AppData\Local\Skull_HACK
2014-12-09 23:13 - 2014-09-25 14:44 - 00000000 ____D () C:\Users\Volkan\Desktop\Allesineinem
2014-12-09 21:55 - 2014-03-23 12:52 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-09 21:55 - 2012-08-06 16:10 - 00000000 ____D () C:\ProgramData\Avira
2014-12-07 15:28 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Volkan\AppData\Local\Windows Live Writer
2014-12-07 15:28 - 2011-07-18 21:54 - 00000000 ____D () C:\Windows\Panther
2014-12-07 15:10 - 2013-11-03 15:36 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\Apple Computer
2014-12-04 15:12 - 2011-05-16 15:04 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-12-04 15:12 - 2011-05-16 15:04 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-12-04 15:12 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-03 00:19 - 2014-09-17 02:02 - 00000000 ____D () C:\Users\Volkan\AppData\Roaming\FileZilla
2014-12-01 23:49 - 2014-03-03 11:06 - 00000000 ____D () C:\Users\Volkan\Downloads\Gameforge Live
2014-11-30 22:02 - 2014-09-15 23:18 - 00000000 ____D () C:\Users\Volkan\Documents\Bandicam
2014-11-29 19:08 - 2012-08-03 19:28 - 00147736 _____ () C:\Users\Elvan\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-27 17:44 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-27 14:09 - 2009-07-14 05:45 - 05181368 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-27 14:07 - 2012-12-22 16:32 - 00000000 ____D () C:\Program Files (x86)\Pando Networks
2014-11-26 20:40 - 2014-03-24 14:03 - 00000000 ____D () C:\Users\Volkan\AppData\Local\Windows Live
2014-11-26 20:40 - 2012-08-03 16:32 - 00000000 ____D () C:\Users\Volkan
2014-11-26 20:38 - 2011-07-18 21:56 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-11-26 20:35 - 2011-07-18 21:53 - 00001462 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-11-26 20:33 - 2011-07-18 21:51 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-11-26 16:39 - 2012-08-03 16:33 - 00000000 ____D () C:\Users\Volkan\AppData\Local\VirtualStore
2014-11-26 16:12 - 2012-08-03 16:34 - 00147736 _____ () C:\Users\Volkan\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-25 21:55 - 2014-10-08 15:36 - 00000000 ____D () C:\ProgramData\MTA San Andreas All
2014-11-25 21:55 - 2014-10-08 15:36 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-11-25 21:55 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-11-24 14:04 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-19 21:31 - 2014-10-05 16:24 - 00000000 ____D () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas
Some content of TEMP:
====================
C:\Users\Elvan\AppData\Local\Temp\AskSLib.dll
C:\Users\Elvan\AppData\Local\Temp\avgnt.exe
C:\Users\Elvan\AppData\Local\Temp\COMAP.EXE
C:\Users\Elvan\AppData\Local\Temp\Fx6_FF_IE_Setup-Softonic.exe
C:\Users\Elvan\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Volkan\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-16 20:30
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2014
Ran by Volkan at 2014-12-19 16:29:58
Running from C:\Users\Volkan\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
4500_G510nz_Help (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510nz (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510nz_Software_Min (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
4Story DE 4.4.228 (HKLM-x32\...\4Story_DE_is1) (Version: 4.4.228 - Gameforge4D GmbH)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe After Effects CC (HKLM-x32\...\{317243C1-6580-4F43-AED7-37D4438C3DD5}) (Version: 12.2.1 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.5.0.367 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.2) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.2 - Adobe Systems Incorporated)
Advanced SystemCare 8 (HKLM-x32\...\Advanced SystemCare 8_is1) (Version: 8.0.3 - IObit)
ALDI SÜD Mah Jong (HKLM-x32\...\ALDI SÜD Mah Jong) (Version: - )
AMI VR-pulse OS Switcher (HKLM\...\{EC1369CF-15BD-4FAF-BA84-65E4788C682E}) (Version: 1.1 - American Megatrends Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo Burning Studio (HKLM-x32\...\Ashampoo Burning Studio_is1) (Version: 10.0.10 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander (HKLM-x32\...\Ashampoo Photo Commander_is1) (Version: 9.2.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Optimizer (HKLM-x32\...\Ashampoo Photo Optimizer_is1) (Version: 4.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Snap (HKLM-x32\...\Ashampoo Snap_is1) (Version: 4.3.0 - Ashampoo GmbH & Co. KG)
Bandicam (HKLM-x32\...\Bandicam) (Version: 2.0.3.674 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandisoft.com)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version: - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version: - )
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Bully: Scholarship Edition (HKLM-x32\...\Steam App 12200) (Version: - Rockstar New England)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version: - Infinity Ward - Sledgehammer Games)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version: - Infinity Ward - Sledgehammer Games)
Corel Graphics - Windows Shell Extension (HKLM-x32\...\_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}) (Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Common (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Connect (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Custom Data (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - DE (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Draw (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - EN (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - ES (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Extra Content (HKLM-x32\...\_{5A10CFDA-FA2B-453C-B561-AE864E62EAC8}) (Version: - Corel Corporation)
CorelDRAW Essentials X5 - Extra Content (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Filters (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - FR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - IPM (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - IT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - PHOTO-PAINT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Redist (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Setup Files (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - WT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 (HKLM-x32\...\_{EDBEBF07-F880-48FB-9AA5-0E8E71E02D83}) (Version: 15.2.0.686 - Corel Corporation)
CorelDRAW Essentials X5 (x32 Version: 15.3 - Corel Corporation) Hidden
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1197 - SG INTERACTIVE)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink MediaEspresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.1508_36229 - CyberLink Corp.)
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.1.2414a - CyberLink Corp.)
CyberLink PhotoDirector 2011 (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2430 - CyberLink Corp.)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1327 - CyberLink Corp.)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 9.0.0.3621 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3621 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.3622.02 - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM-x32\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink WaveEditor (HKLM-x32\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 1.0.1.3320 - CyberLink Corp.)
CyberLink YouCam 5 (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.1402 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DayZ Commander (HKLM-x32\...\{0170930E-68D6-4E85-88B2-82761CDE1F94}) (Version: 0.92.69 - Dotjosh Studios)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.372.000 - Hewlett-Packard) Hidden
DocMgr (x32 Version: 130.0.000.000 - Ihr Firmenname) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
EA Sports FIFA World (HKLM-x32\...\{8F9AC744-EEF6-43DB-A4B6-FA1A18F1C640}) (Version: 7.1.0.50515 - Electronic Arts, Inc.)
Empire: Total War (HKLM-x32\...\Steam App 10500) (Version: - The Creative Assembly)
Far Cry 2 (HKLM-x32\...\Steam App 19900) (Version: - Ubisoft Montreal)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxy Secure (HKLM-x32\...\Foxy Secure) (Version: 6 - ) <==== ATTENTION
Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
GS_Sustainer (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{fc67e7a0}) (Version: - Genuine P Software) <==== ATTENTION
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet 4500 G510n-z (HKLM\...\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}) (Version: 13.0 - HP)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Icewind Dale Enhanced Edition (HKLM-x32\...\Icewind Dale Enhanced Edition_is1) (Version: - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{520C4DD4-2BC7-409B-BA48-E1A4F832662D}) (Version: 2.1.0.0140 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{4E4282C3-F66E-4852-837A-7675527178C2}) (Version: 3.1.26.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless WiFi Software (HKLM\...\{54EB8041-1115-4406-AA4B-44D236E84B3B}) (Version: 15.01.1000.0927 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Java(TM) 7 Update 3 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417003FF}) (Version: 7.0.30 - Oracle)
Java(TM) 7 Update 3 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217003FF}) (Version: 7.0.30 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden
Magic Bullet Suite 64-bit (HKLM-x32\...\InstallShield_{26055432-339E-4776-803B-F22240B91864}) (Version: 11.1.2 - Red Giant Software)
Magic Bullet Suite 64-bit (Version: 11.1.2 - Red Giant Software) Hidden
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Medion Home Cinema (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.3216 - CyberLink Corp.)
Medion Home Cinema (x32 Version: 8.0.3216 - CyberLink Corp.) Hidden
Memeo Instant Backup (HKLM-x32\...\{8E666407-AC41-46a2-9692-6C7BFCBFDD37}) (Version: 4.60.0.7943 - Memeo Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mathematics (64-Bit) (HKLM\...\{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}) (Version: 4.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 1.1.500.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network64 (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3.2 - Notepad++ Team)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version: - Overkill)
PCSUITE SHREDDER (HKLM-x32\...\PCSUITE_SHREDDER_PRO_is1) (Version: - Markement GmbH)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Peggle (HKLM-x32\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0059 - Pegatron Corporation)
Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Poczta usługi Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.986 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6586 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Risen 2 - Dark Waters (HKLM-x32\...\Steam App 40390) (Version: - Piranha Bytes)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.0.1 - Rockstar Games)
Saints Row: The Third (HKLM-x32\...\Steam App 55230) (Version: - Volition)
Salus (HKLM-x32\...\Salus) (Version: 2.0.18.0 - Salus) <==== ATTENTION!
Sanny Builder 3.2.1 (HKLM-x32\...\Sanny Builder 3_is1) (Version: - )
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-A00000000004}) (Version: 10.0.0 - Adobe Systems Incorporated)
Status (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.21.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKU\S-1-5-21-1782373422-569102784-2936947414-1001\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XAMPP (HKLM-x32\...\xampp) (Version: 1.8.3-3 - Bitnami)
Συλλογή φωτογραφιών (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1782373422-569102784-2936947414-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Volkan\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1782373422-569102784-2936947414-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Volkan\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1782373422-569102784-2936947414-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Volkan\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1782373422-569102784-2936947414-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Volkan\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1782373422-569102784-2936947414-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Volkan\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
07-12-2014 19:00:25 Windows-Sicherung
08-12-2014 19:41:19 Windows Update
10-12-2014 03:00:23 Windows Update
12-12-2014 22:43:13 Windows Update
13-12-2014 15:44:05 Windows Update
14-12-2014 19:00:31 Windows-Sicherung
16-12-2014 18:00:17 Windows Update
18-12-2014 14:01:01 Windows Update
18-12-2014 21:48:51 Removed LG United Mobile Drivers.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2014-09-15 23:21 - 00000595 ____A C:\Windows\system32\Drivers\etc\hosts
9.9.9.9 mobily.pw
9.9.9.9 patron.tweethashcount.com
9.9.9.9 track.ttswebdesign.com
9.9.9.9 grizzl.thewell-beingcompany.com
9.9.9.9 rdp.thewalkinginstitute.com
9.9.9.9 welcome.thesplitscreenphotobooth.com
9.9.9.9 hello.thesplitscreenphotobooth.com
9.9.9.9 welcome.thecraftbarnwales.com
9.9.9.9 hello.sylvanstructures.com
9.9.9.9 remote.sylvanstructures.com
9.9.9.9 wuah.chekc.co.vu
9.9.9.9 canmacar.com
9.9.9.9 www.canmacar.com
9.9.9.9 phaelixe.com
9.9.9.9 nitrous.cf
9.9.9.9 godlikeweapon.pw127.0.0.1 bandicam.com
127.0.0.1 ssl.bandisoft.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1944156A-4891-46E6-9906-2798CDD68705} - System32\Tasks\{376E88D3-056F-4AE7-8273-1026B2C968A1} => pcalua.exe -a C:\Users\Volkan\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {1A05D2C9-2793-49F0-BEE0-26D7E74D2058} - System32\Tasks\Red Giant Link => C:\Program Files (x86)\Red Giant Link\Common\Red Giant Link.exe [2011-11-23] ()
Task: {2532488D-F2A6-4087-AB20-FF00C3BD7EF1} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {25E1D94F-1D58-427A-890D-A51E3A7D55D8} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\RocketTab\Client.exe" /Preferred=true <==== ATTENTION
Task: {2C582106-15E6-4826-9753-8919CF769481} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2EAE47DE-05A8-4760-BFA2-534F32533C51} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {3985E8C7-AFC7-4E2F-B384-11C54A86E127} - System32\Tasks\PriceMeterUpdater => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {41C8FD47-C1FB-4592-B726-95524B2A52BA} - System32\Tasks\YNQXV => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
Task: {44F7B814-2903-432F-BFF5-C1424E673A13} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe [2012-06-26] (Microsoft)
Task: {4E1E8658-3B78-4859-B26A-7DE43349C2A0} - System32\Tasks\pricemeterdownloader => C:\Users\Volkan\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {51C5C041-8E31-4FF4-8730-33FB96488E59} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Device Center\ipoint.exe [2012-06-26] (Microsoft Corporation)
Task: {538E81F0-DD8D-41E9-9DAD-F2A3D9ED82CA} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Device Center\itype.exe [2012-06-26] (Microsoft Corporation)
Task: {592D5EFD-444D-425A-8A40-BAB3C780B502} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-15] (Adobe Systems Incorporated)
Task: {5F1C95D3-9D79-44B3-AD92-B4A2DB8F22B6} - System32\Tasks\ASC8_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare 8\Monitor.exe [2014-11-10] (IObit)
Task: {6422F59A-A062-451E-90DC-A640124E79AE} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {80342A31-DAD0-4AB1-949D-8DEA5FA1D6FB} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8782F14E-1547-4927-B5A5-3E52E196A378} - System32\Tasks\AdobeAAMUpdater-1.0-Volkan-PC-Volkan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27] (Adobe Systems Incorporated)
Task: {8DB94DB5-1934-484F-AE1D-395DDFA10C35} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2012-02-02] (CyberLink Corp.)
Task: {8F9B0C23-9E95-4699-8319-D1449DE1E86A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {A3248683-CC66-4C33-8074-FD532AD7D769} - System32\Tasks\ASC8_SkipUac_Volkan => C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASC.exe [2014-11-07] (IObit)
Task: {AF13DA64-444D-4B6A-B843-E993AD55BF0C} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {C0F549FB-6B99-4641-897F-110B982968EC} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe <==== ATTENTION
Task: {D8A56AB8-2268-4CAE-B3AD-A1B6B01EBB8A} - System32\Tasks\GS_Booster-S-576482620 => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: {E9EF86E3-036A-4E64-AB67-76A486EA0FE1} - System32\Tasks\{897BC909-33EA-4C41-B361-46A4AC5AA298} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/202990
Task: {EBD79DD7-F598-4AD7-A4A2-72A999BC5DE6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {F84750B8-CBF7-4550-AE22-F1C7F2BF2D83} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GS_Booster-S-576482620.job => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\YNQXV.job => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-04-11 10:57 - 2009-12-18 23:40 - 00104968 _____ () C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
2012-04-11 10:57 - 2011-10-13 22:38 - 00156672 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2013-07-20 12:52 - 2013-07-20 12:52 - 00066872 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-07-20 12:52 - 2013-07-20 12:52 - 00107832 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2012-04-11 10:57 - 2012-03-27 22:19 - 00826880 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-04-11 10:57 - 2010-01-13 01:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-04-11 10:57 - 2010-01-13 01:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-04-11 06:19 - 2010-08-19 17:43 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-09-23 18:57 - 2014-09-23 18:57 - 00623064 _____ () C:\Program Files (x86)\Universal Updater\UpdaterService.exe
2012-04-11 08:57 - 2012-03-27 01:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-04-11 10:57 - 2012-01-13 01:58 - 00552960 _____ () C:\Program Files (x86)\PHotkey\PVDesktop.exe
2012-04-11 10:57 - 2012-01-13 01:58 - 00477696 _____ () C:\Program Files (x86)\PHotkey\PVDAgent.exe
2012-04-11 10:57 - 2012-02-24 22:13 - 03458560 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2014-12-07 15:09 - 2014-07-11 16:04 - 01106720 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 8\RealTimeProtector.exe
2014-02-10 12:40 - 2014-02-10 12:40 - 00412672 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\samp.exe
2012-10-29 11:08 - 2012-10-29 11:08 - 00030208 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\imageformats\_old_qgif4.dll
2012-10-29 11:08 - 2012-10-29 11:08 - 00236032 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\imageformats\_old_qjpeg4.dll
2012-10-29 11:08 - 2014-03-05 11:17 - 00302056 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2012-10-29 11:08 - 2014-03-05 11:17 - 00320488 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2012-10-29 11:08 - 2014-03-05 11:17 - 00565224 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2014-03-05 11:17 - 2014-03-05 11:17 - 00700904 _____ () C:\Users\Volkan\AppData\Local\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll
2014-10-05 16:24 - 2011-07-06 18:35 - 14383616 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\gta_sa.exe
2014-03-22 12:01 - 2013-07-21 20:53 - 00831488 _____ () C:\Users\Volkan\Desktop\TürkLife\Laufscript\Laufscript.exe
2014-12-14 17:06 - 2014-12-14 17:06 - 00008704 _____ () C:\Users\Volkan\Desktop\Csgo.exe
2014-12-07 15:09 - 2013-01-15 18:48 - 00348992 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 8\madExcept_.bpl
2014-12-07 15:09 - 2013-01-15 18:48 - 00183616 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 8\madBasic_.bpl
2014-12-07 15:09 - 2013-01-15 18:48 - 00051008 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 8\madDisAsm_.bpl
2014-12-07 15:09 - 2014-10-16 10:26 - 00622880 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 8\ProductStatistics.dll
2012-04-11 10:57 - 2009-12-18 23:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-04-11 10:57 - 2009-12-18 23:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2010-08-03 23:39 - 2010-08-03 23:39 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-03 23:39 - 2010-08-03 23:39 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-03-18 23:22 - 2014-03-18 23:22 - 32733088 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\libcef.dll
2012-04-11 09:39 - 2011-11-30 04:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-04-11 09:31 - 2012-03-06 14:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-10-05 16:24 - 2008-06-09 00:32 - 00004096 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\vorbisfile.dll
2014-10-05 16:24 - 2003-11-16 09:48 - 00065536 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\vorbisHooked.dll
2014-10-05 16:24 - 2003-11-15 16:54 - 00036864 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\ogg.dll
2014-10-05 16:24 - 2003-11-16 09:48 - 01060864 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\vorbis.dll
2014-10-05 16:24 - 2013-03-17 13:24 - 00027648 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\anticrash.asi
2014-10-05 16:25 - 2010-06-17 15:17 - 00004096 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\cleo\FileSystemOperations.cleo
2014-10-05 16:25 - 2010-06-17 15:16 - 00004608 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\cleo\IniFiles.cleo
2014-10-05 16:25 - 2010-06-17 15:16 - 00002560 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\cleo\IntOperations.cleo
2014-10-10 21:12 - 2008-07-21 23:02 - 00052224 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\InterfaceEditor.asi
2014-11-14 20:54 - 2014-07-17 11:41 - 00119296 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\MapRecorder.asi
2014-10-05 16:24 - 2013-08-06 07:05 - 00063488 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\radarrect.asi
2014-10-05 16:24 - 2011-04-01 20:22 - 00158720 _____ () C:\Users\Volkan\Desktop\Grand Theft Auto SanAndreas\sensfix.asi
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-22 12:01 - 2013-07-09 23:06 - 00226816 _____ () C:\Users\Volkan\Desktop\TürkLife\Laufscript\API.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT2
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT2
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AdvancedSystemCareService8 => 2
MSCONFIG\startupreg: 4StoryPrePatch => C:\Program Files (x86)\GameforgeLive\Games\DEU_deu\4Story\PrePatch.exe
MSCONFIG\startupreg: Advanced SystemCare 8 => "C:\Program Files (x86)\IObit\Advanced SystemCare 8\ASCTray.exe" /Auto
MSCONFIG\startupreg: CrashMon => "C:\Program Files (x86)\Universal Updater\CrashMon.exe" "UniversalUpdater" "hxxp://log.data-url.com/crash/"
MSCONFIG\startupreg: f552dd4c52e3 => C:\Program Files (x86)\SU1MyNDVjNDgwZA\b786bdb3c67d.exe
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
========================= Accounts: ==========================
Administrator (S-1-5-21-1782373422-569102784-2936947414-500 - Administrator - Disabled)
Elvan (S-1-5-21-1782373422-569102784-2936947414-1003 - Administrator - Enabled) => C:\Users\Elvan
Gast (S-1-5-21-1782373422-569102784-2936947414-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1782373422-569102784-2936947414-1002 - Limited - Enabled)
Volkan (S-1-5-21-1782373422-569102784-2936947414-1001 - Administrator - Enabled) => C:\Users\Volkan
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: Salus
Description: Salus
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: Salus
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Officejet 4500 G510n-z
Description: Officejet 4500 G510n-z
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Officejet 4500 G510n-z
Description: Officejet 4500 G510n-z
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/19/2014 04:02:11 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/19/2014 02:43:12 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/19/2014 02:43:12 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:36:41 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/18/2014 10:35:16 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:35:16 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:16:31 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/18/2014 10:14:34 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:14:34 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 09:23:27 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
System errors:
=============
Error: (12/19/2014 04:02:30 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Salus
Error: (12/19/2014 04:01:07 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (12/18/2014 10:37:15 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Salus
Error: (12/18/2014 10:35:42 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (12/18/2014 10:16:59 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Salus
Error: (12/18/2014 10:15:17 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (12/18/2014 09:23:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Salus
Error: (12/18/2014 09:22:15 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (12/18/2014 09:21:34 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AD3EDBCA-0901-415B-82E9-C16D3B65E38C}
Error: (12/18/2014 09:06:53 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
Salus
Microsoft Office Sessions:
=========================
Error: (12/19/2014 04:02:11 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/19/2014 02:43:12 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/19/2014 02:43:12 AM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:36:41 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/18/2014 10:35:16 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:35:16 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:16:31 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (12/18/2014 10:14:34 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 10:14:34 PM) (Source: AdvancedSystemCareService8) (EventID: 0) (User: )
Description: Das Handle ist ungültig
Error: (12/18/2014 09:23:27 PM) (Source: MemeoBackgroundService) (EventID: 0) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
CodeIntegrity Errors:
===================================
Date: 2014-10-25 15:10:12.047
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vrtaucbl.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-10-25 15:10:11.977
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\vrtaucbl.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 57%
Total physical RAM: 3990.83 MB
Available physical RAM: 1688.33 MB
Total Pagefile: 7979.84 MB
Available Pagefile: 5532.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:647.54 GB) (Free:320.76 GB) NTFS
Drive d: (recovery) (Fixed) (Total:50 GB) (Free:49.91 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=647.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
==================== End Of Log ============================
|
|
19.12.2014, 16:55
| #4 |
| /// Malwareteam | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. Hi dann legen wir mal los: Schritt 1: Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Schritt 2: Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files (x86)\AnyProtectEx\
C:\Users\Volkan\AppData\Local\PriceMeter\
C:\Program Files (x86)\PriceMeterLiveUpdate\
c:\programdata\trusted publisher\gs_booster\
C:\Users\Volkan\AppData\Roaming\YNQXV.exe
Task: {2532488D-F2A6-4087-AB20-FF00C3BD7EF1} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {25E1D94F-1D58-427A-890D-A51E3A7D55D8} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\RocketTab\Client.exe" /Preferred=true <==== ATTENTION
Task: {2C582106-15E6-4826-9753-8919CF769481} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2EAE47DE-05A8-4760-BFA2-534F32533C51} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {3985E8C7-AFC7-4E2F-B384-11C54A86E127} - System32\Tasks\PriceMeterUpdater => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {41C8FD47-C1FB-4592-B726-95524B2A52BA} - System32\Tasks\YNQXV => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
Task: {4E1E8658-3B78-4859-B26A-7DE43349C2A0} - System32\Tasks\pricemeterdownloader => C:\Users\Volkan\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {6422F59A-A062-451E-90DC-A640124E79AE} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {AF13DA64-444D-4B6A-B843-E993AD55BF0C} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {C0F549FB-6B99-4641-897F-110B982968EC} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe <==== ATTENTION
Task: {D8A56AB8-2268-4CAE-B3AD-A1B6B01EBB8A} - System32\Tasks\GS_Booster-S-576482620 => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\GS_Booster-S-576482620.job => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\YNQXV.job => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT2
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT2
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 3: Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 4: verändert isch das Verhalten schon durch diese Fixe? Du hast da echt einiges an Malware gesammelt  |
|
19.12.2014, 18:59
| #5 |
| | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. Fixlog.txt Code:
ATTFilter -Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-12-2014
Ran by Volkan at 2014-12-19 18:42:57 Run:1
Running from C:\Users\Volkan\Desktop
Loaded Profile: Volkan (Available profiles: Volkan & Elvan)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files (x86)\AnyProtectEx\
C:\Users\Volkan\AppData\Local\PriceMeter\
C:\Program Files (x86)\PriceMeterLiveUpdate\
c:\programdata\trusted publisher\gs_booster\
C:\Users\Volkan\AppData\Roaming\YNQXV.exe
Task: {2532488D-F2A6-4087-AB20-FF00C3BD7EF1} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {25E1D94F-1D58-427A-890D-A51E3A7D55D8} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\RocketTab\Client.exe" /Preferred=true <==== ATTENTION
Task: {2C582106-15E6-4826-9753-8919CF769481} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2EAE47DE-05A8-4760-BFA2-534F32533C51} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {3985E8C7-AFC7-4E2F-B384-11C54A86E127} - System32\Tasks\PriceMeterUpdater => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {41C8FD47-C1FB-4592-B726-95524B2A52BA} - System32\Tasks\YNQXV => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
Task: {4E1E8658-3B78-4859-B26A-7DE43349C2A0} - System32\Tasks\pricemeterdownloader => C:\Users\Volkan\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {6422F59A-A062-451E-90DC-A640124E79AE} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {AF13DA64-444D-4B6A-B843-E993AD55BF0C} - System32\Task-s\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: {C0F549FB-6B99-4641-897F-110B982968EC} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe <==== ATTENTION
Task: {D8A56AB8-2268-4CAE-B3AD-A1B6B01EBB8A} - System32\Tasks\GS_Booster-S-576482620 => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\GS_Booster-S-576482620.job => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Volkan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\YNQXV.job => C:\Users\Volkan\AppData\Roaming\YNQXV.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData:NT
AlternateDataStreams: C:\ProgramData:NT2
AlternateDataStreams: C:\Users\All Users:NT
AlternateDataStreams: C:\Users\All Users:NT2
AlternateDataStreams: C:\ProgramData\Application Data:NT
AlternateDataStreams: C:\ProgramData\Application Data:NT2
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT
AlternateDataStreams: C:\Users\Volkan\Anwendungsdaten:NT2
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT
AlternateDataStreams: C:\Users\Volkan\AppData\Roaming:NT2
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
*****************
C:\Program Files (x86)\AnyProtectEx => Moved successfully.
"C:\Users\Volkan\AppData\Local\PriceMeter" => File/Directory not found.
C:\Program Files (x86)\PriceMeterLiveUpdate => Moved successfully.
c:\programdata\trusted publisher\gs_booster => Moved successfully.
"C:\Users\Volkan\AppData\Roaming\YNQXV.exe" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2532488D-F2A6-4087-AB20-FF00C3BD7EF1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2532488D-F2A6-4087-AB20-FF00C3BD7EF1}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{25E1D94F-1D58-427A-890D-A51E3A7D55D8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25E1D94F-1D58-427A-890D-A51E3A7D55D8}" => Key deleted successfully.
C:\Windows\System32\Tasks\RocketTab => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2C582106-15E6-4826-9753-8919CF769481}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2C582106-15E6-4826-9753-8919CF769481}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2EAE47DE-05A8-4760-BFA2-534F32533C51}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2EAE47DE-05A8-4760-BFA2-534F32533C51}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3985E8C7-AFC7-4E2F-B384-11C54A86E127}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3985E8C7-AFC7-4E2F-B384-11C54A86E127}" => Key deleted successfully.
C:\Windows\System32\Tasks\PriceMeterUpdater => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PriceMeterUpdater" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{41C8FD47-C1FB-4592-B726-95524B2A52BA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{41C8FD47-C1FB-4592-B726-95524B2A52BA}" => Key deleted successfully.
C:\Windows\System32\Tasks\YNQXV => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YNQXV" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4E1E8658-3B78-4859-B26A-7DE43349C2A0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E1E8658-3B78-4859-B26A-7DE43349C2A0}" => Key deleted successfully.
C:\Windows\System32\Tasks\pricemeterdownloader => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\pricemeterdownloader" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6422F59A-A062-451E-90DC-A640124E79AE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6422F59A-A062-451E-90DC-A640124E79AE}" => Key deleted successfully.
C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PriceMeterLiveUpdateUpdateTaskMachineUA" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AF13DA64-444D-4B6A-B843-E993AD55BF0C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF13DA64-444D-4B6A-B843-E993AD55BF0C}" => Key deleted successfully.
C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PriceMeterLiveUpdateUpdateTaskMachineCore" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C0F549FB-6B99-4641-897F-110B982968EC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0F549FB-6B99-4641-897F-110B982968EC}" => Key deleted successfully.
C:\Windows\System32\Tasks\RocketTab Update Task => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab Update Task" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D8A56AB8-2268-4CAE-B3AD-A1B6B01EBB8A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D8A56AB8-2268-4CAE-B3AD-A1B6B01EBB8A}" => Key deleted successfully.
C:\Windows\System32\Tasks\GS_Booster-S-576482620 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GS_Booster-S-576482620" => Key deleted successfully.
C:\Windows\Tasks\APSnotifierPP1.job => Moved successfully.
C:\Windows\Tasks\APSnotifierPP2.job => Moved successfully.
C:\Windows\Tasks\APSnotifierPP3.job => Moved successfully.
C:\Windows\Tasks\GS_Booster-S-576482620.job => Moved successfully.
C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\PriceMeterUpdater.job => Moved successfully.
C:\Windows\Tasks\YNQXV.job => Moved successfully.
C:\ProgramData => ":NT" ADS removed successfully.
C:\ProgramData => ":NT2" ADS removed successfully.
"C:\Users\All Users" => ":NT" ADS not found.
"C:\Users\All Users" => ":NT2" ADS not found.
"C:\ProgramData\Application Data" => ":NT" ADS not found.
"C:\ProgramData\Application Data" => ":NT2" ADS not found.
C:\ProgramData\MTA San Andreas All => ":NT" ADS removed successfully.
C:\ProgramData\MTA San Andreas All => ":NT2" ADS removed successfully.
"C:\Users\Volkan\Anwendungsdaten" => ":NT" ADS not found.
"C:\Users\Volkan\Anwendungsdaten" => ":NT2" ADS not found.
C:\Users\Volkan\AppData\Roaming => ":NT" ADS removed successfully.
C:\Users\Volkan\AppData\Roaming => ":NT2" ADS removed successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
The system needed a reboot.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 19/12/2014 um 18:52:26
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-16.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Volkan - VOLKAN-PC
# Gestartet von : C:\Users\Volkan\Desktop\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : UniversalUpdater
[#] Dienst Gelöscht : salus
Dienst Gelöscht : b786bdb3c67d
Dienst Gelöscht : c2cautoupdatesvc
Dienst Gelöscht : c2cpnrsvc
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\374311380
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\Meteoroids
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Registry Helper
Ordner Gelöscht : C:\ProgramData\Trusted Publisher
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\GoSave
Ordner Gelöscht : C:\ProgramData\YoutubeAdBlocke
Ordner Gelöscht : C:\ProgramData\504c2cf8db11ac3b
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\FLVM Player
Ordner Gelöscht : C:\Program Files (x86)\IminentToolbar
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Program Files (x86)\System Speedup
Ordner Gelöscht : C:\Program Files (x86)\Universal Updater
Ordner Gelöscht : C:\Program Files (x86)\DeltaFix
Ordner Gelöscht : C:\Program Files (x86)\GoSave
Ordner Gelöscht : C:\Program Files (x86)\YoutubeAdBlocke
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\torch
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\torch
Ordner Gelöscht : C:\Users\Elvan\AppData\LocalLow\IE-BHO
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Common\LuaRT
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\DataMgr
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\fbDownloader
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Intermediate
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\SCheck
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Security Systems
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Seventh
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Sixth
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Snz
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\SSync
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\fbDownloader
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Gast\AppData\Local\torch
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\torch
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\apn
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Chromatic Browser
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Gameo
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\PriceMeterLiveUpdate
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\torch
Ordner Gelöscht : C:\Users\Volkan\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\Users\Volkan\AppData\LocalLow\IE-BHO
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\ap_logs
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\Gameo
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\IminentToolbar
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Volkan\AppData\Roaming\RHEng
Ordner Gelöscht : C:\Users\Volkan\Documents\PC Speed Maximizer
[!] Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
Ordner Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\Extensions\ffxtlbr@mysearchdial.com
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\iagcajndpnfncplednpbnkahadegklfa
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bkhaafiomdphcnmbmdbfafokfiehdpdg
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Elvan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Gast\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Ordner Gelöscht : C:\Users\Volkan\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
Datei Gelöscht : C:\Windows\SysWOW64\RegistryHelperLM.ocx
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Volkan\AppData\Local\speedial.crx
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\aps.uninstall.scan.results
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\LiveSupport.exe_log.txt
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\regsvr32.exe_log.txt
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\invalidprefs.js
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\searchplugins\astromenda.xml
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\astromenda.xml
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\searchplugins\fbdownloader_search.xml
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\searchplugins\Mysearchdial.xml
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\trovi-search.xml
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\searchplugins\WebSearch.xml
Datei Gelöscht : C:\Users\Elvan\AppData\Roaming\Mozilla\Firefox\Profiles\8zy40wo7.default\user.js
Datei Gelöscht : C:\Users\Volkan\AppData\Roaming\Mozilla\Firefox\Profiles\awgln4b1.default-1405638547811\user.js
Datei Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_iagcajndpnfncplednpbnkahadegklfa_0.localstorage
Datei Gelöscht : C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
***** [ Tasks ] *****
Task Gelöscht : PriceMeterLiveUpdateUpdateTaskMachineCore
Task Gelöscht : WOT WTHUR1
Task Gelöscht : WOT WTUE1
Task Gelöscht : WOT WMON1
Task Gelöscht : WOT WW1
Task Gelöscht : WOT WFRI1
Task Gelöscht : WOT WW2
Task Gelöscht : WOT WWED1
Task Gelöscht : WOT W1
Task Gelöscht : WOT W2
Task Gelöscht : WOT T
Task Gelöscht : WOT N
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaangaohdajkgeopjhpbnlpkehbhmbj
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PriceMeterLiveUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=9
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A154AE-6C33-4F1E-9057-242350540936}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{45F8961E-1314-421E-9F00-BDDE18CF8EA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8D73A258-9787-4AE7-9232-41036673FD0E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89449F37-4AB2-46ED-A566-BB3A7797701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F509ADC2-B40E-470F-A7B7-45191486B5CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89449F37-4AB2-46ED-A566-BB3A7797701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F509ADC2-B40E-470F-A7B7-45191486B5CB}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\PriceMeterUpdater
Schlüssel Gelöscht : HKCU\Software\RegisteredApplicationsEx
Schlüssel Gelöscht : HKCU\Software\RocketTabInstalled
Schlüssel Gelöscht : HKCU\Software\SupHpUISoft
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\WSE_Astromenda
Schlüssel Gelöscht : HKCU\Software\onekit
Schlüssel Gelöscht : HKCU\Software\gameo
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BlockAndSurf
Schlüssel Gelöscht : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\PriceMeterLiveUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\Registry Helper
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\GS_Booster
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxy Secure
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\suprasavings
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DatamngrCoordinator.exe
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v34.0.5 (x86 de)
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb2QDW7d8Z6ix_hAOkRLMxdyAneEgaTNI6Ue3Lc3dqLKDqEfXjY3p1IDrvwvYAn3gSNiGPZxl8EvO4-J4[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultenginename", "FBDownloader Search");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=de&q=");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.order.1", "Mysearchdial");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine", "FBDownloader Search");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.irmysearch.aflt", "ir_14_15_ch");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0Bt[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.irmysearch.cr", "347746127");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.irmysearch.instlRef", "140305_b");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.AL", 2);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.aflt", "ir_14_15_ch");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.cntry", "DE");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.cr", "347746127");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.dfltLng", "");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.dfltSrch", true);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.dnsErr", true);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,18285[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.excTlbr", false);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.hdrMd5", "858F116EA6AA99D87B4764BBCFD6707F");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.hmpg", true);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtD[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.id", "7A7919DFDE2A3CC0");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.instlDay", "16171");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.instlRef", "140305_b");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtA[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.lastVrsnTs", "");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyE[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"96\",\"lastVrsn\":\"96\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.sg", "{smplGrp}");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.tlbrId", "base");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutC[...]
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.vrsn", "1.8.29.0");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.vrsni", "1.8.29.0");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.newTab", false);
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.smplGrp", "none");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.023:24:58");
[8zy40wo7.default\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.fbdownloader.com/search.php?channel=de&q=");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultenginename,S", "WebSearch");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69&l=1&q=");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("browser.search.order.1", "WebSearch");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("browser.search.order.1,S", "WebSearch");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine,S", "WebSearch");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("extensions.GUHieZp5xW1L9555.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1url.indexOf(\"warnalert11.com\")>-1url.index[...]
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("extensions.crossrider.bic", "148b70f14208ef08f40a0510fc3324ab");
[awgln4b1.default-1405638547811\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69&l=1&q=");
-\\ Google Chrome v38.0.2125.111
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : aaaaacalgebmfelllfiaoknifldpngjh
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : iagcajndpnfncplednpbnkahadegklfa
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : lifbcibllhkdhoafpjfnlhfpfgnpldfl
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : bkhaafiomdphcnmbmdbfafokfiehdpdg
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : nolijncfnkgaikbjbdaogikpmpbdcdef
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.only-search.com/?babsrc=SP_kms&affID=129280&tt=030814_ctrl&mntrid=204C685D431525BC&tsp=5332&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_49_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzyyDtDtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0B0CyB0C0DzzyBtGyEtByE0AtG0EyC0F0DtG0AtBtDzytGtD0AyEtByD0Ezz0E0AzytDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=1151622652&ir=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : aaaaacalgebmfelllfiaoknifldpngjh
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : aaaangaohdajkgeopjhpbnlpkehbhmbj
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : bopakagnckmlgajfccecajhnimjiiedh
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : iagcajndpnfncplednpbnkahadegklfa
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : lifbcibllhkdhoafpjfnlhfpfgnpldfl
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : bbmegnmpleoagolcnjnejdacakedpcgd
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : bkhaafiomdphcnmbmdbfafokfiehdpdg
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Extension] : nolijncfnkgaikbjbdaogikpmpbdcdef
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Homepage] : hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\preferences] - Gelöscht [Startup_URLs] : hxxp://websearch.search-plaza.info/?pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
-\\ Chromium v
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.only-search.com/?babsrc=SP_kms&affID=129280&tt=030814_ctrl&mntrid=204C685D431525BC&tsp=5332&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_49_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzyyDtDtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0B0CyB0C0DzzyBtGyEtByE0AtG0EyC0F0DtG0AtBtDzytGtD0AyEtByD0Ezz0E0AzytDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=1151622652&ir=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
-\\ Comodo Dragon v
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.only-search.com/?babsrc=SP_kms&affID=129280&tt=030814_ctrl&mntrid=204C685D431525BC&tsp=5332&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_49_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzyyDtDtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0B0CyB0C0DzzyBtGyEtByE0AtG0EyC0F0DtG0AtBtDzytGtD0AyEtByD0Ezz0E0AzytDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=1151622652&ir=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
-\\ Opera v0.0.0.0
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_15_ch&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzztAtBtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyB0BtAtAtCtAtG0CtD0B0BtGyEtA0DyCtGyC0CzytDtGtC0EyE0AtBtDtBtC0CtBtByB2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=347746127&ir=
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Elvan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.fbdownloader.com/search.php?channel=de&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.only-search.com/?babsrc=SP_kms&affID=129280&tt=030814_ctrl&mntrid=204C685D431525BC&tsp=5332&q={searchTerms}
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3329032&octid=EB_ORIGINAL_CTID&ISID=M5C073D49-7EC0-4B52-A66E-21D8913CD319&SearchSource=58&CUI=&UM=6&UP=SP24149AC3-C5AB-499E-98D5-7B073DF1710F&q={searchTerms}&SSPV=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_49_ff&cd=2XzuyEtN2Y1L1QzuyB0AyBzytCzy0D0F0D0EtB0AtA0C0CtDtN0D0Tzu0SzyyDtDtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0B0CyB0C0DzzyBtGyEtByE0AtG0EyC0F0DtG0AtBtDzytGtD0AyEtByD0Ezz0E0AzytDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtA0BtD0ByDyDyEtG0CyDtAyDtGzyyCyEyBtGyEyD0ByEtGtA0FtDtB0FtD0DtB0B0B0AyC2Q&cr=1151622652&ir=
[C:\Users\Volkan\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.search-plaza.info/?l=1&q={searchTerms}&pid=2356&r=2014/11/11&hid=12490012838301760652&lg=EN&cc=DE&unqvl=69
[C:\Users\Volkan\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Homepage] : hxxp://search.babylon.com/?affID=100782&tl=gkn12345&tt=3112_7&babsrc=SP_def_nch_opera&mntrId=36537cd300000000000050e549ed9c44
[C:\Users\Volkan\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Startup_URLs] : hxxp://search.babylon.com/?affID=100782&tl=gkn12345&tt=3112_7&babsrc=SP_def_nch_opera&mntrId=36537cd300000000000050e549ed9c44
[C:\Users\Volkan\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Homepage] : hxxp://search.babylon.com/?affID=100782&tl=gkn12345&tt=3112_7&babsrc=SP_def_nch_opera&mntrId=36537cd300000000000050e549ed9c44
[C:\Users\Volkan\AppData\Roaming\Opera Software\Opera Stable\preferences] - Gelöscht [Startup_URLs] : hxxp://search.babylon.com/?affID=100782&tl=gkn12345&tt=3112_7&babsrc=SP_def_nch_opera&mntrId=36537cd300000000000050e549ed9c44
*************************
AdwCleaner[R0].txt - [34961 octets] - [19/12/2014 18:50:39]
AdwCleaner[S0].txt - [41525 octets] - [19/12/2014 18:52:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [41586 octets] ##########
Läuft alles soweit besser. Keine Programme mehr beim Start |
|
19.12.2014, 22:22
| #6 |
| /// Malwareteam | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. gut wunderbar soweit Schritt 1: Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Schritt 2: Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 3: ESET Online Scanner
Schritt 4: erstelle ein neues FRST Logfile und poste es hier
__________________ --> PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. |
|
25.12.2014, 14:55
| #7 |
| /// Malwareteam | Bump Hallo. Benötigst du noch Hilfe? Wir sind noch nicht fertig. Nur weil die Symptome verschwunden sind bedeutet dies nicht dass dein System sauber ist. |
|
26.12.2014, 00:06
| #8 |
| /// Malwareteam | PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe? Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos. Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen. |
|
| Themen zu PC langsam. Internet langsam. Beim Start öffnen sich unseriöse Sachen. |
| automatisch, computer, fehlercode, fehlercode 22, fehlercode 24, fehlermeldungen, fenster, foxy secure entfernen, gs_sustainer entfernen, interne, internet, komische, kriege, langsam, sachen, sehr langsam, sweet-page, sweet-page entfernen, tauchen, this device cannot start. (code10), this device is disabled. (code 22), verschiedene, öffnen |
dann auf 
und dann auf 
. 
Gruß Aneri 
Linear-Darstellung
