| |
| |||||||
Log-Analyse und Auswertung: Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne VirenschutzWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
21.12.2014, 23:45
| #1 |
| |  Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz Hallo, Ihr Spezialisten! ich habe von einer Bekannten einen Laptop zur Behebung eines Problems "in Behandlung". Eigentlich bemängelte sie nur, das sich keine Word/Excel-Dateien mehr öffnen lassen. Mir ist aber gleich aufgefallen, das sich das Sicherheitscenter nicht aktivieren lässt. Auf dem Laptop (HP) war eine 60 Tage Testversion von Norton installiert- ist aber schon ewig abgelaufen. Ich vermute nun das Sie seit einer Ewigkeit ohne Virenschutz im Netz unterwegs war. Ich hoffe, ich habe mich gut vorbereitet und benötige dringend Eure Hilfe. Habe auch schon mal einen Scan mit Malewarebytes gemacht. Logs folgen weiter unten. Vielen Dank schon mal vorab für Eure Hilfe. MfG Scout FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01 Ran by Isetta (administrator) on ISETTA-HP on 21-12-2014 22:30:34 Running from C:\Users\Isetta\Desktop Loaded Profile: Isetta (Available profiles: Isetta) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (AMD) C:\Windows\System32\atieclxx.exe (ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Swisscom) C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe (TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.) HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [DriverTurbo] => C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6525088 2013-04-15] () HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [EPSON SX235 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [232448 2011-01-22] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Facebook Update] => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-06-24] (Facebook Inc.) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30528608 2014-11-27] (Skype Technologies S.A.) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\RunOnce: [Adobe Speed Launcher] => 1419189410 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: G - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {48966f6e-6ec4-11e2-bb3f-101f74b2fac2} - G:\AutoRun.exe HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {715c2d8c-4b06-11e3-8fcb-001e101f1f81} - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5eed-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5f33-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73dc-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73ec-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1 HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {980170ca-6ddc-11e2-b73a-001e101fb4df} - G:\AutoRun.exe HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267111-6d3f-11e2-b58f-101f74b2fac2} - G:\AutoRun.exe HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267155-6d3f-11e2-b58f-101f74b2fac2} - I:\AutoRun.exe HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {ebaa3d19-4713-11e3-93c5-001e101f1ed9} - I:\Autorun.exe AUTORUN=1 CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 URLSearchHook: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91 SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: HKLM {615A1925-0E5B-4767-A65E-3165AEAC32A3} hxxp://quickscan.bitdefender.com/qsax/qsax64.cab Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-19] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 192.168.179.1 Tcpip\..\Interfaces\{2036D35A-6021-4665-BF45-A144EA758D98}: [NameServer] 139.7.30.126 139.7.30.125 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @ei.VideoDownloadConverter_4z.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll (VideoDownloadConverter) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2848928747-3939298252-169735021-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Isetta\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed] R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed] R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 SesamService; C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe [1237800 2009-02-17] (Swisscom) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-21] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) R3 wtsmpadap; C:\Windows\System32\DRIVERS\wtsmpadap.sys [56104 2009-01-31] (Swisscom) R3 WtSmpFlt; C:\Windows\System32\DRIVERS\wtsmpflt.sys [383784 2009-01-31] (Swisscom) S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S1 rqvxcarc; \??\C:\Windows\system32\drivers\rqvxcarc.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-21 22:23 - 2014-12-21 22:24 - 00028323 _____ () C:\Users\Isetta\Desktop\Addition.txt 2014-12-21 22:22 - 2014-12-21 22:30 - 00021280 _____ () C:\Users\Isetta\Desktop\FRST.txt 2014-12-21 22:22 - 2014-12-21 22:30 - 00000000 ____D () C:\FRST 2014-12-21 22:19 - 2014-12-21 22:19 - 00380416 _____ () C:\Users\Isetta\Desktop\Gmer-19357.exe 2014-12-21 22:18 - 2014-12-21 22:18 - 02122240 _____ (Farbar) C:\Users\Isetta\Desktop\FRST64.exe 2014-12-21 21:44 - 2014-12-21 21:44 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-21 21:43 - 2014-12-21 21:43 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-21 21:43 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-21 21:43 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-21 21:43 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-21 21:42 - 2014-12-21 21:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Isetta\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-21 20:46 - 2014-12-21 20:46 - 01184256 _____ () C:\Users\Isetta\Downloads\MicrosoftFixit50450.msi 2014-12-21 20:16 - 2014-12-21 20:16 - 00000056 _____ () C:\Windows\setupact.log 2014-12-21 20:16 - 2014-12-21 20:16 - 00000000 _____ () C:\Windows\setuperr.log 2014-12-21 20:15 - 2014-12-21 20:15 - 00010020 _____ () C:\Windows\PFRO.log 2014-12-21 17:29 - 2014-12-21 17:29 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2014-12-21 17:29 - 2014-12-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2014-12-21 17:28 - 2014-12-21 17:29 - 00000000 ____D () C:\Program Files\CCleaner 2014-12-21 15:38 - 2014-12-21 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-12-21 14:43 - 2014-12-21 14:43 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\QuickScan 2014-12-21 14:06 - 2014-12-21 14:06 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-12-21 14:05 - 2014-12-21 14:05 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk 2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-12-21 14:04 - 2014-12-21 14:04 - 14107296 _____ (Microsoft Corporation) C:\Users\Isetta\Downloads\mseinstall.exe 2014-12-21 13:13 - 2014-12-21 13:19 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-21 13:13 - 2014-11-27 16:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-21 12:59 - 2014-12-21 13:24 - 00004453 _____ () C:\ProgramData\RUNDLL32.EXE-3460-F.txt 2014-12-21 12:50 - 2014-12-21 12:50 - 00002962 _____ () C:\Windows\System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769} 2014-12-21 11:38 - 2014-12-21 12:57 - 00013062 _____ () C:\ProgramData\RUNDLL32.EXE-5092-F.txt 2014-12-21 00:24 - 2014-12-21 00:44 - 00002629 _____ () C:\ProgramData\RUNDLL32.EXE-4056-F.txt 2014-12-19 20:46 - 2014-12-19 21:33 - 00007246 _____ () C:\ProgramData\RUNDLL32.EXE-3756-F.txt 2014-12-18 22:06 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 22:06 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-18 21:17 - 2014-12-18 23:01 - 00016086 _____ () C:\ProgramData\RUNDLL32.EXE-2624-F.txt 2014-12-12 19:47 - 2014-12-12 22:14 - 00022498 _____ () C:\ProgramData\RUNDLL32.EXE-5656-F.txt 2014-12-12 19:41 - 2014-12-12 19:41 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-12 19:23 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-12 19:23 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-11 23:53 - 2014-12-12 19:40 - 00016146 _____ () C:\ProgramData\RUNDLL32.EXE-3656-F.txt 2014-12-10 19:30 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 19:30 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 19:30 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 19:30 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-10 19:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 19:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 19:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 19:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 19:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 19:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 19:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 19:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-10 19:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-10 19:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 19:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-10 19:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 19:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-10 19:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 19:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-10 19:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-10 19:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-10 19:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 19:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 19:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-10 19:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-10 19:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 19:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 19:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-10 19:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-10 19:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 19:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 19:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 19:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-10 19:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-10 19:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-10 19:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-10 19:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 19:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 19:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-10 19:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 19:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-10 19:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 19:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-10 19:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-10 19:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 19:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 19:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 19:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 19:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 19:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-10 19:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 19:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 19:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 19:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 19:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 19:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 19:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 19:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 19:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-10 19:28 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 19:28 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 19:28 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 19:28 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 19:28 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-10 19:28 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 19:26 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 19:26 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-10 19:26 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-10 19:26 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-10 19:26 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-10 19:26 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-10 19:26 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-10 19:26 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-10 19:26 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-10 19:26 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-10 19:26 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-10 19:26 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-10 19:26 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-10 19:26 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-10 18:48 - 2014-12-11 22:49 - 00087696 _____ () C:\ProgramData\RUNDLL32.EXE-4080-F.txt 2014-12-07 22:31 - 2014-12-07 22:31 - 00000000 ____D () C:\Users\Isetta\AppData\Local\{33D6233C-631C-4C78-9150-12CBDACBEE1F} 2014-12-07 12:49 - 2014-12-07 20:41 - 00075982 _____ () C:\Users\Isetta\Documents\Fotobuch.pbf 2014-12-07 12:49 - 2014-12-07 20:40 - 00000000 ____D () C:\Users\Isetta\Documents\Fotobuch-Dateien 2014-12-07 12:21 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll 2014-12-07 12:17 - 2014-12-07 12:17 - 00001025 _____ () C:\Users\Public\Desktop\posterXXL Designer.lnk 2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\Users\Isetta\AppData\Local\posterXXL Designer 2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\posterXXL Designer 2014-12-07 12:16 - 2014-12-07 12:17 - 00000000 ____D () C:\Program Files (x86)\posterXXL Designer 2014-12-07 12:16 - 2014-12-07 12:16 - 00000000 ____D () C:\ProgramData\posterXXL Designer 2014-12-07 11:58 - 2014-12-09 22:53 - 00187502 _____ () C:\ProgramData\RUNDLL32.EXE-3660-F.txt 2014-12-04 08:10 - 2014-12-06 22:09 - 00065636 _____ () C:\ProgramData\RUNDLL32.EXE-3400-F.txt 2014-12-03 19:30 - 2014-12-03 22:20 - 00026615 _____ () C:\ProgramData\RUNDLL32.EXE-336-F.txt 2014-12-02 12:31 - 2014-12-02 22:03 - 00055916 _____ () C:\ProgramData\RUNDLL32.EXE-5372-F.txt 2014-12-01 12:45 - 2014-12-01 22:44 - 00078874 _____ () C:\ProgramData\RUNDLL32.EXE-5668-F.txt 2014-11-28 17:28 - 2014-11-28 22:16 - 00045453 _____ () C:\ProgramData\RUNDLL32.EXE-864-F.txt 2014-11-27 18:36 - 2014-11-27 22:09 - 00034185 _____ () C:\ProgramData\RUNDLL32.EXE-4092-F.txt 2014-11-26 18:15 - 2014-12-21 14:36 - 00042271 _____ () C:\ProgramData\RUNDLL32.EXE-4964-F.txt 2014-11-24 07:49 - 2014-11-25 23:01 - 00047789 _____ () C:\ProgramData\RUNDLL32.EXE-3276-F.txt 2014-11-22 23:07 - 2014-11-23 21:55 - 00036972 _____ () C:\ProgramData\RUNDLL32.EXE-3748-F.txt ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-21 22:14 - 2013-09-05 20:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-21 21:10 - 2014-06-24 08:05 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job 2014-12-21 21:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-12-21 20:37 - 2012-07-09 19:12 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-21 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System 2014-12-21 20:36 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini 2014-12-21 20:35 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2014-12-21 20:24 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-21 20:24 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-21 20:20 - 2014-01-03 19:13 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\Skype 2014-12-21 20:20 - 2011-09-15 00:40 - 01522792 _____ () C:\Windows\WindowsUpdate.log 2014-12-21 20:16 - 2012-02-20 20:41 - 00058016 _____ () C:\Users\Isetta\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-21 20:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-21 20:16 - 2009-07-14 05:45 - 00267176 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-21 17:32 - 2014-05-06 21:30 - 00000000 ____D () C:\Windows\Minidump 2014-12-21 17:32 - 2012-05-03 16:30 - 00000000 ____D () C:\Users\Isetta\AppData\Local\CrashDumps 2014-12-21 17:32 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther 2014-12-21 16:33 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-12-21 14:57 - 2014-07-09 15:34 - 00000000 ____D () C:\ProgramData\OhzazAqfug 2014-12-21 14:57 - 2014-07-09 15:34 - 00000000 ____D () C:\ProgramData\IgtahSopub 2014-12-21 14:55 - 2014-07-09 09:32 - 00000000 ____D () C:\ProgramData\6D83ADA25104713C62EBA86DEC5B9787 2014-12-21 13:46 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-12-21 13:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-21 13:10 - 2014-07-09 16:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk 2014-12-21 13:10 - 2011-07-19 10:37 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-12-21 12:56 - 2011-07-19 19:45 - 00735450 _____ () C:\Windows\system32\perfh007.dat 2014-12-21 12:56 - 2011-07-19 19:45 - 00165278 _____ () C:\Windows\system32\perfc007.dat 2014-12-21 12:50 - 2012-02-22 16:19 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\TP 2014-12-21 11:53 - 2012-02-20 20:42 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{16B80042-919F-4825-962C-0F560E7139F1} 2014-12-18 21:28 - 2014-06-12 16:03 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForIsetta 2014-12-18 21:28 - 2014-06-12 16:03 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForIsetta.job 2014-12-12 20:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-12 19:41 - 2014-05-06 21:29 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-12 19:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-12 19:18 - 2014-06-24 08:05 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job 2014-12-10 19:14 - 2013-09-05 20:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-10 19:14 - 2013-09-05 20:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-10 19:14 - 2011-07-19 10:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-03 19:34 - 2014-09-23 17:38 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-12-03 19:34 - 2014-01-03 19:12 - 00000000 ____D () C:\ProgramData\Skype 2014-11-30 22:28 - 2014-08-08 17:49 - 00241294 _____ () C:\ProgramData\RUNDLL32.EXE-3920-F.txt 2014-11-22 22:28 - 2014-11-20 06:29 - 00084901 _____ () C:\ProgramData\RUNDLL32.EXE-3196-F.txt Some content of TEMP: ==================== C:\Users\Isetta\AppData\Local\Temp\ose00000.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-06 20:02 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-21 22:31:33
Running from C:\Users\Isetta\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.15.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.4.36191 - Ask.com) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Druckerdeinstallation für EPSON SX235 Series (HKLM\...\EPSON SX235 Series) (Version: - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{DE15C5EC-7C30-44BF-ACEB-03960FC5601D}) (Version: 1.1.1.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{ABEF00D0-FCAE-4E47-8D4E-D4AE5FD72B15}) (Version: 2.4.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{B446137B-18A1-4FAE-B0E4-ABE8F09705F1}) (Version: 4.1.6.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mobilt bredband (HKLM-x32\...\{9941ABED-87FF-413B-9E89-15F60487AEC7}_x) (Version: 2.3.1.343 - Option)
mobilt bredband (Version: 2.3.1.343 - Option) Hidden
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
posterXXL Designer 5.3 (HKLM-x32\...\posterXXL Designer_is1) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.34.1130.2010 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0323 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list restore points.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01CD728C-0F0D-4E77-8871-8E07F46FBB3B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {14460768-4127-4C46-ABA3-C2AAAC36FB53} - System32\Tasks\{E4E2C0C1-7F02-4EB0-9FFD-5B3642EA89F7} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {228C7504-7D29-415A-A71B-5A0D6A5FC04F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {2B9C4A26-BBB6-45F6-A11A-1EDD900CDB5D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {489C1D1F-6EA1-4A09-A3E2-BDC30D41B667} - System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769} => G:\SetupConsumerC2ROLW\SetupConsumerC2ROLW.exe
Task: {4EE2C4F6-5D77-4F67-B4D3-FBD06E37B7C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {6DF4B400-48FF-431F-A192-8D1EE0DB404B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {8A365B95-91ED-4035-A7C8-9B2795609C85} - System32\Tasks\HPCeeScheduleForIsetta => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {AB27DFA1-5A10-41A8-8673-573EB0171489} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {ADB5E7E7-C4DF-4374-868C-A6F274E111FA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B820529A-CD60-46CA-AD0F-87CE2661FABC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {B86FF47E-9F0A-424E-9D38-642FE509FE25} - System32\Tasks\{77929317-B71E-4FFD-9A41-601176702D51} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/go/help.faq.installer?LastError=1603
Task: {BD219128-8028-4F82-84B5-6146C13F5CDE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-02-08] () <==== ATTENTION
Task: {E75235D9-85F8-49D7-8647-26FA431E6B8A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {F5CF6616-96EB-4E46-93AE-17CC12EE51E9} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForIsetta.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2011-07-05 10:27 - 2011-07-05 10:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2011-07-05 10:27 - 2011-07-05 10:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 10:13 - 2011-07-05 10:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 12:42 - 2011-06-17 12:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2848928747-3939298252-169735021-500 - Administrator - Disabled)
Gast (S-1-5-21-2848928747-3939298252-169735021-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2848928747-3939298252-169735021-1003 - Limited - Enabled)
Isetta (S-1-5-21-2848928747-3939298252-169735021-1001 - Administrator - Enabled) => C:\Users\Isetta
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1,
Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1,
Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1,
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
System errors:
=============
Error: (12/21/2014 09:28:24 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (12/21/2014 08:55:06 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (12/21/2014 08:29:30 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (12/21/2014 08:18:40 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (12/21/2014 08:16:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/21/2014 08:16:57 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.
Error: (12/21/2014 08:16:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (12/21/2014 08:16:28 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Error: (12/21/2014 05:34:27 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (12/21/2014 04:38:52 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.
Microsoft Office Sessions:
=========================
Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1, (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1, (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, : Zeile18, Spalte 1, (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore
Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt
==================== Memory info ===========================
Processor: AMD A4-3300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 33%
Total physical RAM: 5610.91 MB
Available physical RAM: 3744.51 MB
Total Pagefile: 11219.99 MB
Available Pagefile: 9005.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:445.89 GB) (Free:396.52 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.71 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive f: (16 Aug 2012) (CDROM) (Total:0.69 GB) (Free:0.65 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1ECE8725)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-12-21 23:00:32 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000070 ST950032 rev.0005 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\Isetta\AppData\Local\Temp\fwdcqpow.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031a2000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800031a202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [2800] entry point in ".rdata" section 00000000741b71e6 ---- EOF - GMER 2.1 ---- Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 21.12.2014 Suchlauf-Zeit: 21:44:51 Logdatei: Malwarebytes-log.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.21.04 Rootkit Datenbank: v2014.12.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Isetta Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 323372 Verstrichene Zeit: 28 Min, 31 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 31 PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.RegCleanerPro.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\RegClean Pro, , [77017ee7d1ab3006550e4f66f113bc44], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{38122a36-83b2-46b8-b39a-ec72a4614a07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], Registrierungswerte: 3 PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [4434e18497e5cc6aba39a56ce0238b75], Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 7 PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\setups, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI, , [d99f76ef15675fd7ea1b3003b64d946c], PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr, , [d99f76ef15675fd7ea1b3003b64d946c], PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache, , [d99f76ef15675fd7ea1b3003b64d946c], Dateien: 7 PUP.Optional.FrostwireTB.A, C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll, , [d1a7e77efb81a88e1bd843ce8083f709], PUP.Optional.AdvancedSystemProtector, C:\Windows\System32\sasnative64.exe, , [195f2441522ae15538626c4fd928fe02], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe, , [d99f76ef15675fd7ea1b3003b64d946c], PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\files.ini, , [d99f76ef15675fd7ea1b3003b64d946c], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) |
| Themen zu Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz |
| administrator, adobe flash player, ask toolbar entfernen, ask toolbar updater entfernen, askbar, bingbar, branding, device driver, dringend, explorer, fehlercode 0x80070490, fehlercode windows, flash player, ip-hilfsdienst, microsoft, microsoft fix it, neustart, pup.optional.advancedsystemprotector, pup.optional.frostwiretb.a, pup.optional.mindspark.a, pup.optional.regcleanerpro.a, registry, security, software, winlogon.exe |
Baum-Darstellung