|
Plagegeister aller Art und deren Bekämpfung: Internet öffnet immer neue tabs mit WerbungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.12.2014, 16:13 | #1 |
| Internet öffnet immer neue tabs mit Werbung Hey Leute, ich hoffe ihr könnt mir helfen Ich habe eine Datei runtergeladen und leider dabei noch andere sachen mit ... Nun habe ich den Salat und ich bekomme es einfach nicht weg, hoffe ihr könnt mir helfen. ( bin neu hier ) LG |
24.12.2014, 17:03 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit Werbung Hallo und
__________________Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
24.12.2014, 17:11 | #3 |
| Internet öffnet immer neue tabs mit Werbung FRST Logfile:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-12-2014 Ran by Ich (administrator) on KRISTIAN on 24-12-2014 17:07:17 Running from C:\Users\Ich\Downloads Loaded Profiles: Ich & kobol_000 (Available profiles: Ich & kobol_000) Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Windows\slsvc.exe () C:\Windows\PersonalizeEnabler.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Spotify Ltd) C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Akamai Technologies, Inc.) C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Spotify Ltd) C:\Users\Ich\AppData\Roaming\Spotify\spotify.exe () C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe (Akamai Technologies, Inc.) C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe (LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [MKLOL] => C:\Program Files (x86)\MKJogo\MKLOL\MK.exe [1277128 2014-05-02] (MK) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Spotify Web Helper] => C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-12] (Spotify Ltd) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30873192 2014-12-11] (Skype Technologies S.A.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [HS TOOL] => C:\Program Files (x86)\MKJogo\MKHSTOOL\HS_TOOL.exe [884424 2014-11-14] (Hs Tool) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Spotify] => C:\Users\Ich\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-12] (Spotify Ltd) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [nvhlpr] => C:\Users\Ich\AppData\Local\ContextTrue\nvhlpr.exe [601584 2014-07-11] () HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [cnthlpr] => C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe [601584 2014-07-11] () HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [SwvUpdtr] => C:\Users\Ich\AppData\Local\24759\Updater.exe [773632 2014-12-24] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3979035309-3685434384-2670183491-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.speedlounge.in/download/last SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3979035309-3685434384-2670183491-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-3979035309-3685434384-2670183491-1004 -> DefaultScope {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta= SearchScopes: HKU\S-1-5-21-3979035309-3685434384-2670183491-1004 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3979035309-3685434384-2670183491-1004 -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta= BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKU\S-1-5-21-3979035309-3685434384-2670183491-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default FF DefaultSearchEngine: Yahoo DE FF SelectedSearchEngine: Yahoo DE FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll () FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Extension: Avira Browser Safety - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\abs@avira.com [2014-12-24] FF Extension: Firefox Old Version Update Hotfix - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-10-04] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14] Chrome: ======= CHR Profile: C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-24] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-24] CHR Extension: (YouTube) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-24] CHR Extension: (Google Search) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-24] CHR Extension: (Avira Browser Safety) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-12-24] CHR Extension: (Google Wallet) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-24] CHR Extension: (Gmail) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-24] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-04] () R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation) R2 slsvc; C:\Windows\slsvc.exe [10240 2012-09-25] (Microsoft Corporation) [File not signed] S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation) S2 serverca; C:\Users\Ich\AppData\Local\ConvertAd\CASrv.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-04] () R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek ) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45112 2014-12-01] (LogMeIn Inc.) R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2013-01-25] (ASUSTeK Computer Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-24 17:06 - 2014-12-24 17:07 - 00017167 _____ () C:\Users\Ich\Downloads\FRST.txt 2014-12-24 17:06 - 2014-12-24 17:07 - 00000000 ____D () C:\FRST 2014-12-24 17:06 - 2014-12-24 17:06 - 02122240 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe 2014-12-24 16:06 - 2014-12-24 16:06 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\QuickScan 2014-12-24 16:02 - 2014-12-24 16:02 - 02173952 _____ () C:\Users\Ich\Downloads\adwcleaner_4.106 (1).exe 2014-12-24 15:59 - 2014-12-24 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-12-24 15:58 - 2014-12-24 15:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-12-24 15:53 - 2014-12-24 16:14 - 123540231 _____ () C:\Users\Ich\Downloads\X15-65741.iso.crdownload 2014-12-24 15:37 - 2014-12-24 15:37 - 00001442 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-12-24 15:23 - 2014-12-24 15:57 - 00000000 ___HD () C:\Users\Public\Temp 2014-12-24 15:22 - 2014-12-24 15:22 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-24 15:22 - 2014-12-24 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-12-24 15:21 - 2014-12-24 16:26 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-24 15:21 - 2014-12-24 16:19 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-24 15:21 - 2014-12-24 15:21 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-12-24 15:21 - 2014-12-24 15:21 - 00003646 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-12-24 15:19 - 2014-12-24 15:19 - 00871360 _____ () C:\Users\Ich\Downloads\google_chrome.exe 2014-12-24 15:14 - 2014-12-24 15:13 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-12-24 15:12 - 2014-12-24 15:12 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Avira 2014-12-24 15:12 - 2014-12-05 00:09 - 00370880 _____ (Abengine) C:\Windows\system32\abengine64.dll 2014-12-24 15:12 - 2014-12-05 00:09 - 00324592 _____ (Abengine) C:\Windows\SysWOW64\abengine.dll 2014-12-24 14:37 - 2014-12-24 16:15 - 00000000 ____D () C:\AdwCleaner 2014-12-24 14:37 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-12-24 14:37 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-12-24 14:37 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-12-24 14:36 - 2014-12-24 14:36 - 02173952 _____ () C:\Users\Ich\Downloads\adwcleaner_4.106.exe 2014-12-24 14:35 - 2014-12-24 14:35 - 00000000 ____D () C:\Users\Ich\AppData\Local\24759 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\ProgramData\Avira 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-24 14:27 - 2014-12-24 14:27 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\Ich\Downloads\avira_de_av___ws.exe 2014-12-24 14:27 - 2014-12-24 14:27 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-24 14:25 - 2014-12-24 14:25 - 00003498 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Kristian-Ich 2014-12-24 14:25 - 2014-12-24 14:25 - 00000112 ____H () C:\A459BAE54B93 2014-12-24 14:25 - 2014-12-24 14:25 - 00000040 ____H () C:\5B0AE88E56FC 2014-12-24 14:25 - 2014-12-24 14:25 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2014-12-24 14:25 - 2014-12-24 14:25 - 00000000 ____D () C:\ProgramData\Adobe 2014-12-24 14:23 - 2014-12-24 14:23 - 00000000 ____D () C:\Users\Ich\AppData\Local\Sparta 2014-12-24 14:22 - 2014-12-24 14:22 - 108640372 _____ () C:\Users\Ich\Downloads\PhotoShop CS6 Crack SkaZinKiN.rar 2014-12-24 14:22 - 2011-12-29 22:51 - 00000000 ____D () C:\Users\Ich\Desktop\photoshop cs6 2014-12-24 14:13 - 2014-12-24 16:18 - 00001340 _____ () C:\Windows\Tasks\BW.job 2014-12-24 14:13 - 2014-12-24 14:13 - 00004340 _____ () C:\Windows\System32\Tasks\BW 2014-12-24 14:12 - 2014-12-24 16:18 - 00001694 _____ () C:\Windows\Tasks\BCZQOTW.job 2014-12-24 14:12 - 2014-12-24 14:13 - 00000000 ____D () C:\Program Files (x86)\db698c94-f0f9-4cbe-95bb-3e7396d3dbb7 2014-12-24 14:12 - 2014-12-24 14:12 - 00004696 _____ () C:\Windows\System32\Tasks\BCZQOTW 2014-12-24 14:12 - 2014-12-24 14:12 - 00000000 ____D () C:\Users\Ich\AppData\Local\ContextTrue 2014-12-24 14:11 - 2014-12-24 14:31 - 00004704 _____ () C:\Windows\SysWOW64\abengine.ini 2014-12-24 14:11 - 2014-12-24 14:31 - 00002608 _____ () C:\Windows\SysWOW64\abengineOff.ini 2014-12-24 14:11 - 2014-12-24 14:31 - 00002608 _____ () C:\Windows\system32\abengineOff.ini 2014-12-24 14:10 - 2014-12-24 16:20 - 00000000 ____D () C:\Program Files (x86)\Flwsrf 2014-12-24 14:10 - 2014-12-24 14:10 - 00573632 _____ () C:\Users\Ich\Downloads\Menu__6629_i1430428382_il467025.exe 2014-12-24 14:10 - 2014-12-24 14:10 - 00003082 _____ () C:\Windows\System32\Tasks\upfs7235 2014-12-24 14:10 - 2014-12-24 14:10 - 00000000 ____D () C:\Program Files (x86)\pre_installer_de 2014-12-24 14:04 - 2014-12-24 14:04 - 00573632 _____ () C:\Users\Ich\Downloads\Menu__6629_i1430423469_il467025.exe 2014-12-21 12:40 - 2014-12-21 12:40 - 12495254 _____ () C:\Users\Ich\Downloads\tPC Parkour Ver 2.2.zip 2014-12-21 12:33 - 2014-12-24 16:34 - 00000000 ____D () C:\Program Files (x86)\Photo Enlarge 2014-12-21 12:33 - 2014-12-24 14:39 - 00000000 ____D () C:\Program Files (x86)\YoutuBeAduBloCKe 2014-12-21 12:32 - 2014-12-24 14:39 - 00000000 ____D () C:\Program Files (x86)\PrIceChop 2014-12-21 12:32 - 2014-12-21 12:32 - 00000000 ____D () C:\ProgramData\fcfkciaojmeemnpdfhehfchkaaicjecd 2014-12-21 12:32 - 2014-12-21 12:32 - 00000000 ____D () C:\Program Files (x86)\PriceChoop 2014-12-21 12:31 - 2014-12-21 12:31 - 01254256 _____ () C:\Users\Ich\Downloads\minecraftdl_9950.exe 2014-12-20 21:36 - 2014-12-20 21:38 - 28535909 _____ () C:\Users\Ich\Downloads\WynnCraft.zip 2014-12-14 16:06 - 2014-12-14 16:06 - 07518634 _____ () C:\Users\Ich\Downloads\OBS_0_638b_Installer (1).exe 2014-12-09 13:47 - 2014-12-09 13:48 - 13554590 _____ () C:\Users\Ich\Downloads\Kobe vs Messi- Legends on Board - Turkish Airlines.mp4 2014-12-08 20:37 - 2014-12-08 20:38 - 06298840 _____ () C:\Users\Ich\Downloads\Background music -- Hintergrundmusik.mp4 2014-12-08 20:36 - 2014-12-08 20:36 - 14673168 _____ () C:\Users\Ich\Downloads\Youtube Videos kostenlos ohne Programm DOWNLOADEN! [TUT] [GERMAN].mp4 2014-12-08 20:31 - 2014-12-08 20:32 - 02263435 _____ () C:\Users\Ich\Downloads\videoplayback (4) 2014-12-08 20:30 - 2014-12-08 20:30 - 00946397 _____ () C:\Users\Ich\Downloads\videoplayback (3) 2014-12-08 16:39 - 2014-12-08 16:39 - 10420256 _____ (CCCP Project ) C:\Users\Ich\Downloads\Combined-Community-Codec-Pack-2014-07-13.exe 2014-12-08 16:33 - 2014-12-08 16:33 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center 2014-12-08 16:32 - 2014-12-08 16:37 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\WindSolutions 2014-12-08 16:32 - 2014-12-08 16:37 - 00000000 ____D () C:\ProgramData\WindSolutions 2014-12-08 16:32 - 2014-12-08 16:32 - 05102256 _____ (WindSolutions) C:\Users\Ich\Downloads\Install_CopyTransControlCenter.exe 2014-12-08 16:11 - 2014-12-08 16:24 - 00023906 _____ () C:\Windows\SysWOW64\msrsb04.dll 2014-12-08 16:11 - 2014-12-08 16:11 - 04143696 _____ (Marx Software ) C:\Users\Ich\Downloads\IDMSetup_4.5.0.3.exe 2014-12-08 16:11 - 2014-12-08 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDevice Manager 2014-12-07 18:16 - 2014-12-07 18:16 - 00128402 _____ () C:\Users\Ich\Downloads\DamageIndicators[1.4.7]2.4.8.zip 2014-12-07 18:10 - 2014-12-07 18:10 - 00307390 _____ () C:\Users\Ich\Downloads\1.6.4 DamageIndicatorsv2.9.2.4.zip 2014-12-07 18:10 - 2014-12-07 18:10 - 00000000 ____D () C:\Users\Ich\AppData\Local\LogMeIn 2014-12-07 18:10 - 2014-12-07 18:10 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-12-07 18:08 - 2014-12-07 18:08 - 08536064 _____ () C:\Users\Ich\Downloads\hamachi279.msi 2014-12-07 15:31 - 2014-12-07 15:31 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\StunlockStudios 2014-12-07 14:10 - 2014-12-07 14:10 - 00082064 _____ () C:\Users\Ich\Downloads\DamageIndicatorsMod1.4.6.zip 2014-12-07 13:07 - 2014-12-07 13:07 - 00000222 _____ () C:\Users\Ich\Desktop\Dead Island Epidemic.url 2014-12-06 16:48 - 2014-12-06 16:49 - 00000000 ____D () C:\Users\Ich\Downloads\divinerpg 2014-12-06 16:06 - 2014-12-24 13:46 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Craften Terminal 2014-12-06 16:05 - 2014-12-06 16:06 - 00000000 ____D () C:\Program Files (x86)\Craften Terminal 2014-12-06 16:05 - 2014-12-06 16:05 - 00001107 _____ () C:\Users\Public\Desktop\Craften Terminal.lnk 2014-12-06 16:05 - 2014-12-06 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal 2014-12-06 16:04 - 2014-12-06 16:05 - 17033651 _____ (Craften.de ) C:\Users\Ich\Downloads\craftenterminal.exe 2014-12-06 15:58 - 2014-12-06 15:58 - 02269863 _____ () C:\Users\Ich\Downloads\forge-1.6.4-9.11.1.965-installer.jar 2014-12-06 15:55 - 2014-12-06 15:56 - 14731653 _____ () C:\Users\Ich\Downloads\[1.6.4][Beta V6.1]DivineRPG.zip 2014-12-06 15:55 - 2014-12-06 15:55 - 00000243 _____ () C:\Users\Ich\Downloads\DivineRPG-Link.zip 2014-12-06 15:17 - 2014-12-06 15:17 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-12-06 15:17 - 2014-12-06 15:17 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-12-05 15:20 - 2014-12-05 15:20 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-12-05 15:19 - 2014-12-05 15:20 - 31029672 _____ (Oracle Corporation) C:\Users\Ich\Downloads\jre-7u71-windows-x64.exe 2014-12-05 14:53 - 2014-12-05 14:53 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\java 2014-12-05 14:08 - 2014-12-05 14:08 - 19934576 _____ () C:\Users\Ich\Downloads\DrakensangOnlineSetup (1).exe 2014-12-05 14:08 - 2014-12-05 14:08 - 00001972 _____ () C:\Users\Ich\Desktop\Drakensang Online.lnk 2014-12-05 14:08 - 2014-12-05 14:08 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online 2014-12-05 14:08 - 2014-12-05 14:08 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online 2014-12-05 14:01 - 2014-12-05 14:04 - 92658088 _____ (Oracle Corporation) C:\Users\Ich\Downloads\jre-8u25-windows-x64.exe 2014-12-05 13:59 - 2014-12-05 13:59 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25 (2).exe 2014-12-05 13:57 - 2014-12-05 13:57 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25 (1).exe 2014-12-05 13:55 - 2014-12-05 13:55 - 00000000 ____D () C:\ProgramData\Oracle 2014-12-05 13:52 - 2014-12-05 13:52 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25.exe 2014-12-05 06:22 - 2014-12-06 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo 2014-12-05 06:22 - 2014-12-05 06:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Comodo 2014-12-05 06:20 - 2014-12-05 06:26 - 00000000 ____D () C:\FFOutput 2014-12-05 06:20 - 2014-12-05 06:20 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory 2014-12-05 06:20 - 2014-11-07 16:13 - 31417672 _____ (AVM Software Inc.) C:\Users\Ich\Documents\pal_install_a4650_r131001_p127000.exe 2014-12-05 06:19 - 2014-12-05 06:19 - 00000000 ____D () C:\Program Files (x86)\FreeTime 2014-12-05 06:17 - 2014-12-05 06:19 - 56201784 _____ (Free Time) C:\Users\Ich\Downloads\FFSetup3.5.0.0.exe 2014-12-04 21:23 - 2014-12-04 21:23 - 13537227 _____ () C:\Users\Ich\Downloads\videoplayback (2) 2014-12-04 21:22 - 2014-12-04 21:23 - 18563916 _____ () C:\Users\Ich\Downloads\videoplayback (1) 2014-12-04 21:21 - 2014-12-04 21:22 - 18563916 _____ () C:\Users\Ich\Downloads\videoplayback 2014-12-04 19:54 - 2014-12-04 19:54 - 00078514 _____ () C:\Users\Ich\Downloads\Farbbalken mit Ton (PAL).mp4 2014-12-04 19:02 - 2014-12-04 19:02 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TechSmith 2014-12-04 19:01 - 2014-12-09 13:54 - 00000000 ____D () C:\Users\Ich\Documents\Camtasia Studio 2014-12-04 19:01 - 2014-12-04 19:01 - 00000000 ____D () C:\Users\Ich\AppData\Local\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\regid.1995-08.com.techsmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\Program Files (x86)\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-12-04 18:50 - 2014-12-04 18:57 - 257705272 _____ () C:\Users\Ich\Downloads\camtasiade844.exe 2014-12-04 18:49 - 2014-12-04 18:49 - 00139984 _____ () C:\Users\Ich\Downloads\camtasia crack.zip 2014-12-04 17:57 - 2014-12-04 17:57 - 00240164 _____ () C:\Users\Ich\Downloads\Neue Aufnahme.m4a 2014-12-01 18:26 - 2014-12-01 18:26 - 00001164 _____ () C:\Users\Public\Desktop\Elsword.lnk 2014-12-01 15:51 - 2014-12-01 15:51 - 00045112 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys 2014-11-30 16:34 - 2014-12-03 16:52 - 00000000 ____D () C:\Users\Ich\Downloads\direwolf20_17 2014-11-30 15:09 - 2014-11-30 15:09 - 00000000 ____D () C:\Users\Ich\Downloads\MagicFarm2 2014-11-30 14:19 - 2014-11-30 14:19 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Trove 2014-11-30 11:14 - 2014-11-30 11:14 - 00001865 _____ () C:\Users\Ich\Desktop\Trove.lnk 2014-11-30 11:07 - 2014-11-30 11:09 - 31884400 _____ (Trion Worlds Inc.) C:\Users\Ich\Downloads\GlyphInstall-0-131.exe 2014-11-29 13:50 - 2014-11-29 13:51 - 00000000 ____D () C:\Users\Ich\Downloads\FTBLite 2014-11-29 13:39 - 2014-11-29 13:51 - 00000000 ____D () C:\Users\Ich\Downloads\assets 2014-11-29 13:39 - 2014-11-29 13:50 - 00000000 ____D () C:\Users\Ich\Downloads\versions 2014-11-29 13:39 - 2014-11-29 13:40 - 00000000 ____D () C:\Users\Ich\Downloads\libraries 2014-11-29 13:37 - 2014-11-29 13:44 - 00000000 ____D () C:\Users\Ich\Downloads\FTBMageQuest 2014-11-29 13:35 - 2014-12-07 18:13 - 00000000 ____D () C:\Users\Ich\AppData\Local\ftblauncher 2014-11-29 13:35 - 2014-11-29 13:35 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\ftblauncher 2014-11-26 18:29 - 2014-11-19 08:29 - 00582552 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe 2014-11-26 18:29 - 2014-11-19 08:29 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-11-25 14:42 - 2014-11-25 14:42 - 02421104 _____ () C:\Users\Ich\Downloads\Fraps.rar 2014-11-25 14:25 - 2014-11-25 14:25 - 07518634 _____ () C:\Users\Ich\Downloads\OBS_0_638b_Installer.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-24 17:07 - 2014-02-22 17:49 - 00000000 ____D () C:\Users\Ich\AppData\Local\CrashDumps 2014-12-24 17:04 - 2014-04-25 14:12 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Spotify 2014-12-24 17:02 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2014-12-24 16:56 - 2014-02-17 16:05 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Skype 2014-12-24 16:47 - 2014-02-17 00:34 - 01216700 _____ () C:\Windows\WindowsUpdate.log 2014-12-24 16:40 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF 2014-12-24 16:35 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-24 16:34 - 2014-02-17 01:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-24 16:32 - 2014-02-17 01:02 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-24 16:27 - 2014-02-17 00:51 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3979035309-3685434384-2670183491-1001 2014-12-24 16:23 - 2012-07-26 11:27 - 00752930 _____ () C:\Windows\system32\perfh007.dat 2014-12-24 16:23 - 2012-07-26 11:27 - 00156156 _____ () C:\Windows\system32\perfc007.dat 2014-12-24 16:23 - 2012-07-26 08:28 - 01748838 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-24 16:17 - 2014-03-13 16:53 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-24 16:17 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-24 16:16 - 2014-02-17 00:27 - 00640266 _____ () C:\Windows\PFRO.log 2014-12-24 15:22 - 2014-02-17 01:33 - 00000000 ____D () C:\Program Files (x86)\Google 2014-12-24 14:43 - 2014-02-18 18:39 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe 2014-12-24 14:43 - 2014-02-17 00:35 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Adobe 2014-12-24 14:18 - 2014-02-18 18:36 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-12-24 14:13 - 2014-02-28 16:16 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-12-24 13:48 - 2014-02-17 16:31 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\.minecraft 2014-12-22 11:53 - 2014-09-26 08:13 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-12-20 13:49 - 2014-02-19 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Local\Battle.net 2014-12-20 10:01 - 2014-04-25 14:13 - 00000000 ____D () C:\Users\Ich\AppData\Local\Spotify 2014-12-19 19:29 - 2014-11-11 15:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft 2014-12-18 19:22 - 2014-02-23 14:56 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-12-17 18:50 - 2014-03-22 16:07 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\OBS 2014-12-15 20:29 - 2014-02-17 18:19 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TS3Client 2014-12-14 10:32 - 2014-02-17 16:05 - 00000000 ____D () C:\ProgramData\Skype 2014-12-12 14:58 - 2014-02-19 17:15 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-12-09 20:01 - 2014-11-02 10:49 - 00000000 ____D () C:\Program Files (x86)\Glyph 2014-12-08 18:02 - 2012-07-26 08:21 - 00023752 _____ () C:\Windows\setupact.log 2014-12-08 16:47 - 2014-11-10 16:28 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\iFunbox_UserCache 2014-12-07 16:47 - 2014-02-23 15:06 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-12-07 12:04 - 2014-02-19 17:18 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-12-07 09:50 - 2014-02-17 01:35 - 00000000 ____D () C:\Program Files\Google 2014-12-06 15:22 - 2014-07-12 19:47 - 00000000 ____D () C:\Users\Ich\AppData\Local\Deployment 2014-12-06 15:20 - 2014-02-17 01:33 - 00000000 ____D () C:\Users\Ich\AppData\Local\Google 2014-12-06 15:19 - 2014-03-31 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live 2014-12-06 15:19 - 2014-03-31 08:58 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive 2014-12-06 15:18 - 2014-10-04 15:41 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames 2014-12-06 15:18 - 2014-08-05 21:27 - 00000000 ____D () C:\AeriaGames 2014-12-06 15:18 - 2014-03-22 16:04 - 00000000 ____D () C:\Fraps 2014-12-06 15:18 - 2014-02-28 16:20 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-12-06 15:16 - 2014-02-17 16:13 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin 2014-12-05 21:05 - 2012-07-26 09:12 - 00000000 __RHD () C:\Users\Public\Libraries 2014-12-05 15:23 - 2014-07-12 14:44 - 00000000 ____D () C:\ProgramData\Hi-Rez Studios 2014-12-05 15:23 - 2014-07-12 14:44 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios 2014-12-05 15:23 - 2014-02-18 14:38 - 00000000 ____D () C:\Program Files (x86)\The Mighty Quest For Epic Loot 2014-12-05 15:23 - 2014-02-17 01:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\NCSOFT 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Users\Ich\AppData\Local\NCSOFT 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Program Files (x86)\NCSOFT 2014-12-05 15:21 - 2014-04-03 17:28 - 00000000 ____D () C:\Users\Ich\AppData\Local\Unity 2014-12-05 15:17 - 2014-02-17 16:30 - 00000000 ____D () C:\Program Files\Java 2014-12-05 14:48 - 2012-07-26 06:26 - 00524288 ___SH () C:\Windows\system32\config\BBI 2014-12-05 13:55 - 2014-02-17 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-12-04 21:23 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-12-04 19:01 - 2014-02-17 00:35 - 00000000 ____D () C:\Users\Ich 2014-12-02 14:28 - 2014-03-31 08:59 - 00000000 ____D () C:\Users\Ich\Downloads\Gameforge Live 2014-11-25 14:26 - 2014-03-22 16:07 - 00000000 ____D () C:\Program Files\OBS 2014-11-25 14:26 - 2014-03-22 16:07 - 00000000 ____D () C:\Program Files (x86)\OBS 2014-11-24 19:42 - 2014-05-12 09:36 - 00001582 _____ () C:\Windows\Sandboxie.ini 2014-11-24 16:04 - 2014-09-11 18:39 - 00000000 ____D () C:\Users\Ich\Documents\Clownfish Avatars Some content of TEMP: ==================== C:\Users\Ich\AppData\Local\Temp\aA042aFFf.exe C:\Users\Ich\AppData\Local\Temp\AskPIP_FF_.exe C:\Users\Ich\AppData\Local\Temp\avgnt.exe C:\Users\Ich\AppData\Local\Temp\BackupSetup.exe C:\Users\Ich\AppData\Local\Temp\LiveSupport_setup.exe C:\Users\Ich\AppData\Local\Temp\nsz915D.exe C:\Users\Ich\AppData\Local\Temp\ochelper.dll C:\Users\Ich\AppData\Local\Temp\ochelper.exe C:\Users\Ich\AppData\Local\Temp\optprosetup.exe C:\Users\Ich\AppData\Local\Temp\Quarantine.exe C:\Users\Ich\AppData\Local\Temp\setup_384.exe C:\Users\Ich\AppData\Local\Temp\Shop2.exe C:\Users\Ich\AppData\Local\Temp\SkypeSetup.exe C:\Users\Ich\AppData\Local\Temp\SpOrder.dll C:\Users\Ich\AppData\Local\Temp\sqlite3.dll C:\Users\Ich\AppData\Local\Temp\sSetup-se.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-17 16:31 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-12-2014 Ran by Ich at 2014-12-24 17:07:47 Running from C:\Users\Ich\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated) Akamai NetSession Interface (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Akamai) (Version: - Akamai Technologies, Inc) Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.020 - ASUSTek Computer Inc.) Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG) Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version: - 2K Australia) Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version: - ) Call of Duty: Black Ops II - Zombies (HKLM-x32\...\Steam App 212910) (Version: - ) Call of Duty: Black Ops II (HKLM-x32\...\Steam App 202970) (Version: - Treyarch) Camtasia Studio 8 (HKLM-x32\...\{6BED66AA-1DC6-474B-AC70-205CC3A68A39}) (Version: 8.4.4.1859 - TechSmith Corporation) ContextTrue (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\ContextTrue) (Version: - ) CopyTrans Control Center deinstallieren (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Craften Terminal 4.0.2 (HKLM-x32\...\{4e7c3936-7c06-4ef0-928b-c5d92f372578}_is1) (Version: 4.0.2 - Craften.de) Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version: - Stunlock Studios) Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) Diablo III Public Test (HKLM-x32\...\Diablo III Public Test) (Version: - Blizzard Entertainment) Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve) Dragon's Prophet (HKLM-x32\...\{C31556D7-F2B9-4787-B223-F7A035067E89}_is1) (Version: 2.0.1296.18 - Infernum Productions AG) Drakensang Online (HKLM-x32\...\Drakensang Online) (Version: - ) Elsword (HKLM-x32\...\Elsword_de_is1) (Version: - ) Flwsrf (HKLM-x32\...\Flwsrf) (Version: 3.0.0.2 - Flwsrf) <==== ATTENTION! FormatFactory 3.5.0.0 (HKLM-x32\...\FormatFactory) (Version: 3.5.0.0 - Format Factory) Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.65 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden GotClip Downloader (HKLM-x32\...\GotClip) (Version: - ) Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) iFunbox (v2.7.2386.747), iFunbox DevTeam (HKLM-x32\...\iFunbox_is1) (Version: v2.7.2386.747 - ) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.) Java 7 Update 71 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417071FF}) (Version: 7.0.710 - Oracle) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.9.1 - www.leaguereplays.com) Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) MK HS TOOL (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\HS TOOL) (Version: - ) MKLOL (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\MKLOL) (Version: - ) Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.1.0 - Vitalwerks Internet Solutions LLC) Nostale(DE) (HKLM-x32\...\NosTale(DE)_is1) (Version: - Gameforge 4D GmbH) NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation) NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - ) Path of Exile (HKLM-x32\...\Steam App 238960) (Version: - Grinding Gear Games) Photo Enlarge (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) Realm of the Mad God (HKLM-x32\...\Steam App 200210) (Version: - Wild Shadow Studios) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6782 - Realtek Semiconductor Corp.) SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Spotify (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) TeamSpeak 3 Client (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH) The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version: - Edmund McMillen and Florian Himsl) TP-LINK TL-WN781ND Driver (HKLM-x32\...\{87C7B472-9BC2-43C8-9F03-86D2908E1A51}) (Version: 1.3.1 - TP-LINK) Trove (HKLM-x32\...\Glyph Trove) (Version: - Trion Worlds, Inc.) WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH) World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment) Zombie Invasion (HKLM-x32\...\ZombieInvasion) (Version: 2.7.50 - Time Lapse Solutions) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 04-12-2014 18:59:37 Camtasia Studio 8 wird installiert 05-12-2014 21:03:16 Removed BlueStacks Notification Center 07-12-2014 18:09:41 Installed LogMeIn Hamachi 13-12-2014 11:48:14 Removed LogMeIn Hamachi 24-12-2014 15:05:26 Windows Modules Installer ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2012-07-26 06:26 - 2014-12-04 19:02 - 00001472 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {04B86A77-D2C8-4326-AAC0-3A86139B9CE7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-24] (Microsoft Corporation) Task: {17432E68-5AC9-49E2-A100-2A41CC4FFF0B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-24] (Google Inc.) Task: {2BC030A5-7604-4A86-995B-6D977D89F4FF} - System32\Tasks\BCZQOTW => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: {304B146B-1B1C-4BFF-B600-AEDF35C231F5} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-01-25] (ASUSTek Computer Inc.) Task: {3C06769A-B485-427D-9FAF-898CBCC9D9E1} - System32\Tasks\{FB5AA185-EDB5-47F6-89E9-5D0185903BCD} => pcalua.exe -a "C:\Riot Games\League of Legends\lol.launcher.exe" -d "C:\Riot Games\League of Legends\" Task: {63162C5D-C5B8-4031-B91A-2ADB9A7DC968} - System32\Tasks\BW => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: {A511457E-5C67-48AC-AF66-038C5F94A915} - System32\Tasks\Auto Aktivierung => C:\Windows\Setup\Scripts\TriggerKMS.exe [2013-01-24] () Task: {B0459DEC-6D70-4521-9666-A01DB56011BE} - System32\Tasks\AdobeAAMUpdater-1.0-Kristian-Ich => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe Task: {C9CE5827-8BAD-4B3A-81A9-9965D2A6A58D} - System32\Tasks\upfs7235 => C:\PROGRA~2\Flwsrf\upfs7235.exe Task: {CAF34C64-B85E-474C-A603-69D5CB1AEA9E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {DA3FD1ED-1F85-41CB-BB93-F31EB7CD98A8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-24] (Google Inc.) Task: {FE73FE89-4939-4E5D-B560-5F6FA656ABA5} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\WatTask => C:\Windows Activation Technologies\wat.exe [2006-04-21] () Task: C:\Windows\Tasks\BCZQOTW.job => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: C:\Windows\Tasks\BW.job => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-03-13 16:53 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-02-17 01:03 - 2013-07-04 03:32 - 00936728 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe 2014-02-17 00:40 - 2012-09-28 02:26 - 00087040 _____ () C:\Windows\PersonalizeEnabler.exe 2014-02-17 00:40 - 2012-09-27 00:31 - 00084992 _____ () C:\Windows\SLCHook.dll 2014-02-17 00:40 - 2009-03-07 06:02 - 00102912 _____ () C:\Windows\EasyHook64.dll 2014-07-11 13:17 - 2014-07-11 13:17 - 00601584 _____ () C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe 2014-04-25 14:13 - 2014-12-12 18:36 - 00374840 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe 2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-17 01:03 - 2014-12-24 16:17 - 00027136 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll 2014-02-17 01:03 - 2013-07-04 03:32 - 00104448 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\ATKEX.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 36966968 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libcef.dll 2014-07-04 15:44 - 2014-07-04 15:44 - 00401408 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll 2014-02-17 01:40 - 2013-03-12 13:19 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2014-07-17 20:28 - 2014-12-12 18:36 - 00867896 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\ffmpegsumo.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 00886840 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libglesv2.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 00108600 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libegl.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libglesv2.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libegl.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\pdf.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\ffmpegsumo.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData\TEMP:AD022376 AlternateDataStreams: C:\Users\Ich\Downloads\Menu__6629_i1430428382_il467025.exe:typelib ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "nvhlpr" HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "HS TOOL" HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "SwvUpdtr" ========================= Accounts: ========================== Administrator (S-1-5-21-3979035309-3685434384-2670183491-500 - Administrator - Disabled) Gast (S-1-5-21-3979035309-3685434384-2670183491-501 - Limited - Disabled) Ich (S-1-5-21-3979035309-3685434384-2670183491-1001 - Administrator - Enabled) => C:\Users\Ich kobol_000 (S-1-5-21-3979035309-3685434384-2670183491-1004 - Limited - Enabled) => C:\Users\kobol_000 ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (12/24/2014 05:06:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FRST64.exe, Version: 24.12.2014.0, Zeitstempel: 0x549a8da8 Name des fehlerhaften Moduls: FRST64.exe, Version: 24.12.2014.0, Zeitstempel: 0x549a8da8 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000247c9 ID des fehlerhaften Prozesses: 0x1350 Startzeit der fehlerhaften Anwendung: 0xFRST64.exe0 Pfad der fehlerhaften Anwendung: FRST64.exe1 Pfad des fehlerhaften Moduls: FRST64.exe2 Berichtskennung: FRST64.exe3 Vollständiger Name des fehlerhaften Pakets: FRST64.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FRST64.exe5 Error: (12/24/2014 04:14:29 PM) (Source: rcores) (EventID: 0) (User: ) Description: Service failed on stop: 301: Interrupted. Error: (12/24/2014 04:07:37 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: PCSUQuickScan.exe, Version: 0.0.0.0, Zeitstempel: 0x54539729 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16864, Zeitstempel: 0x531d34d8 Ausnahmecode: 0xe06d7363 Fehleroffset: 0x0000000000047b8c ID des fehlerhaften Prozesses: 0x1240 Startzeit der fehlerhaften Anwendung: 0xPCSUQuickScan.exe0 Pfad der fehlerhaften Anwendung: PCSUQuickScan.exe1 Pfad des fehlerhaften Moduls: PCSUQuickScan.exe2 Berichtskennung: PCSUQuickScan.exe3 Vollständiger Name des fehlerhaften Pakets: PCSUQuickScan.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PCSUQuickScan.exe5 Error: (12/24/2014 03:25:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.65, Zeitstempel: 0x546659db Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4 Ausnahmecode: 0xc0000142 Fehleroffset: 0x00078c9e ID des fehlerhaften Prozesses: 0x1948 Startzeit der fehlerhaften Anwendung: 0xchrome.exe0 Pfad der fehlerhaften Anwendung: chrome.exe1 Pfad des fehlerhaften Moduls: chrome.exe2 Berichtskennung: chrome.exe3 Vollständiger Name des fehlerhaften Pakets: chrome.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5 Error: (12/24/2014 02:29:04 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Photoshop.exe, Version: 13.0.0.0, Zeitstempel: 0x4e9569dd Name des fehlerhaften Moduls: Photoshop.exe, Version: 13.0.0.0, Zeitstempel: 0x4e9569dd Ausnahmecode: 0xc0000005 Fehleroffset: 0x00472d67 ID des fehlerhaften Prozesses: 0x13fc Startzeit der fehlerhaften Anwendung: 0xPhotoshop.exe0 Pfad der fehlerhaften Anwendung: Photoshop.exe1 Pfad des fehlerhaften Moduls: Photoshop.exe2 Berichtskennung: Photoshop.exe3 Vollständiger Name des fehlerhaften Pakets: Photoshop.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Photoshop.exe5 Error: (12/24/2014 02:29:03 PM) (Source: Winlogon) (EventID: 4005) (User: ) Description: Der Windows-Anmeldeprozess wurde unerwartet beendet. Error: (12/24/2014 02:28:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 39.0.2171.95, Zeitstempel: 0x548243f3 Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x53b621ae Ausnahmecode: 0xc0000005 Fehleroffset: 0x0008ff3a ID des fehlerhaften Prozesses: 0x2844 Startzeit der fehlerhaften Anwendung: 0xchrome.exe0 Pfad der fehlerhaften Anwendung: chrome.exe1 Pfad des fehlerhaften Moduls: chrome.exe2 Berichtskennung: chrome.exe3 Vollständiger Name des fehlerhaften Pakets: chrome.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5 Error: (12/24/2014 02:12:55 PM) (Source: MsiInstaller) (EventID: 11309) (User: Kristian) Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it. Error: (12/22/2014 04:18:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: Craften Terminal.exe, Version: 4.0.5342.32399, Zeitstempel: 0x53f0df8f Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0d155878 ID des fehlerhaften Prozesses: 0x90c Startzeit der fehlerhaften Anwendung: 0xCraften Terminal.exe0 Pfad der fehlerhaften Anwendung: Craften Terminal.exe1 Pfad des fehlerhaften Moduls: Craften Terminal.exe2 Berichtskennung: Craften Terminal.exe3 Vollständiger Name des fehlerhaften Pakets: Craften Terminal.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Craften Terminal.exe5 Error: (12/22/2014 01:23:44 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm League of Legends.exe, Version 4.21.0.397 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 8a0 Startzeit: 01d01de1fa9666b4 Endzeit: 4294967295 Anwendungspfad: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.71\deploy\League of Legends.exe Berichts-ID: 58403f39-89d5-11e4-bfde-bcee7b5d6d5a Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: System errors: ============= Error: (12/24/2014 04:17:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "CA Service component" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (12/24/2014 04:16:28 PM) (Source: volmgr) (EventID: 49) (User: ) Description: Die Konfiguration der Auslagerungsdatei für das Absturzbild ist fehlgeschlagen. Stellen Sie sicher, dass eine Auslagerungsdatei auf der Startpartition vorhanden ist und dass diese groß genug ist, um den gesamten physischen Speicher abbilden zu können. Error: (12/24/2014 04:15:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (12/24/2014 04:15:43 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "WSearch" konnte sich nicht als "NT AUTHORITY\SYSTEM" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%50 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (12/24/2014 04:15:30 PM) (Source: DCOM) (EventID: 10010) (User: Kristian) Description: {3EB3C877-1F16-487C-9050-104DBCD66683} Error: (12/24/2014 04:15:30 PM) (Source: DCOM) (EventID: 10010) (User: Kristian) Description: {3EB3C877-1F16-487C-9050-104DBCD66683} Error: (12/24/2014 04:15:30 PM) (Source: DCOM) (EventID: 10010) (User: Kristian) Description: {3EB3C877-1F16-487C-9050-104DBCD66683} Error: (12/24/2014 04:15:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Error: (12/24/2014 04:15:13 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (12/24/2014 04:15:12 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Volumeschattenkopie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office Sessions: ========================= Error: (12/24/2014 05:06:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FRST64.exe24.12.2014.0549a8da8FRST64.exe24.12.2014.0549a8da8c000000500000000000247c9135001d01f939624cbe7C:\Users\Ich\Downloads\FRST64.exeC:\Users\Ich\Downloads\FRST64.exee2316c45-8b86-11e4-bfe4-bcee7b5d6d5a Error: (12/24/2014 04:14:29 PM) (Source: rcores) (EventID: 0) (User: ) Description: Service failed on stop: 301: Interrupted. Error: (12/24/2014 04:07:37 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: PCSUQuickScan.exe0.0.0.054539729KERNELBASE.dll6.2.9200.16864531d34d8e06d73630000000000047b8c124001d01f8b266ca9e2C:\Program Files (x86)\PC Speed Up\PCSUQuickScan.exeC:\Windows\system32\KERNELBASE.dll98008dba-8b7e-11e4-bfe3-bcee7b5d6d5a Error: (12/24/2014 03:25:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: chrome.exe39.0.2171.65546659dbntdll.dll6.2.9200.1704653b485c4c000014200078c9e194801d01f8580a60d81C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dllbf489d5c-8b78-11e4-bfe2-bcee7b5d6d5a Error: (12/24/2014 02:29:04 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Photoshop.exe13.0.0.04e9569ddPhotoshop.exe13.0.0.04e9569ddc000000500472d6713fc01d01f7d100c3db8C:\Users\Ich\Desktop\photoshop cs6\AdobePhotoshopCS6Portable\App\PhotoshopCS6\Photoshop.exeC:\Users\Ich\Desktop\photoshop cs6\AdobePhotoshopCS6Portable\App\PhotoshopCS6\Photoshop.exed3fb9f08-8b70-11e4-bfdf-bcee7b5d6d5a Error: (12/24/2014 02:29:03 PM) (Source: Winlogon) (EventID: 4005) (User: ) Description: Error: (12/24/2014 02:28:46 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: chrome.exe39.0.2171.95548243f3DpInterface32.dll3.0.2.348253b621aec00000050008ff3a284401d01f7d8ad52fdeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\SupTab\DpInterface32.dllc92f57d3-8b70-11e4-bfdf-bcee7b5d6d5a Error: (12/24/2014 02:12:55 PM) (Source: MsiInstaller) (EventID: 11309) (User: Kristian) Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (12/22/2014 04:18:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Craften Terminal.exe4.0.5342.3239953f0df8funknown0.0.0.000000000c00000050d15587890c01d01dfa7f114ba9C:\Program Files (x86)\Craften Terminal\Craften Terminal.exeunknownd4edd4b0-89ed-11e4-bfdf-bcee7b5d6d5a Error: (12/22/2014 01:23:44 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: League of Legends.exe4.21.0.3978a001d01de1fa9666b44294967295C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.71\deploy\League of Legends.exe58403f39-89d5-11e4-bfde-bcee7b5d6d5a CodeIntegrity Errors: =================================== Date: 2014-12-24 16:16:52.496 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 15:32:33.436 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 15:08:19.764 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 14:40:44.496 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 14:30:39.199 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-22 13:24:50.186 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-21 10:38:28.234 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-20 21:08:47.499 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-20 09:57:56.058 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-19 17:21:51.655 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-4440 CPU @ 3.10GHz Percentage of memory in use: 29% Total physical RAM: 8130.14 MB Available physical RAM: 5739.82 MB Total Pagefile: 16834.14 MB Available Pagefile: 13861.2 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.17 GB) (Free:672.49 GB) NTFS Drive e: (24 Mrz 2013) (CDROM) (Total:0.27 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00180018) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=931.2 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
24.12.2014, 17:18 | #4 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit Werbung Virenscanner-Logs? Zitat:
Lesestoff: Illegale Software: Cracks, Keygens und Co Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html Es geht weiter wenn du alles Illegale entfernt hast. Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.
__________________ Logfiles bitte immer in CODE-Tags posten |
24.12.2014, 20:29 | #5 |
| Internet öffnet immer neue tabs mit Werbung Oh, sorry. Habe es natürlich gelöscht und hoffe das ich da nichts mehr habe. Wenn da noch was ist, dann tut es mir leid aber ich meine ich habe nichts illegales mehr. Wollte nochmal danken das du mir hilfst Zu den antiviren-log ich habe keinen log gemacht. Geändert von Vali0 (24.12.2014 um 20:48 Uhr) |
24.12.2014, 23:34 | #6 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit WerbungZitat:
__________________ --> Internet öffnet immer neue tabs mit Werbung |
25.12.2014, 14:36 | #7 |
| Internet öffnet immer neue tabs mit Werbung Dort steht das ich keine neuen Virenscanns durchführen soll und ich habe seit monaten kein viren-scan gemacht. Sorry bin ich jetzt ganz Dumm oder was soll ich tun ? LG |
25.12.2014, 17:24 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit Werbung Dann schreib es doch auch, bin doch kein Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
26.12.2014, 11:17 | #9 |
| Internet öffnet immer neue tabs mit Werbung Ehm AdwCleaner habe ich schonmal gemacht, da ich mich im internet schlau gelesen habe und sie sagten das dies hilft. Nun ich poste jetzt den ersten log wo ich das gemacht habe, weil den den ich jetzt gemacht habe hat er nichts gefunden. Code:
ATTFilter # AdwCleaner v4.106 - Bericht erstellt am 24/12/2014 um 14:37:02 # Aktualisiert 21/12/2014 von Xplode # Database : 2014-12-21.4 [Live] # Betriebssystem : Windows 8 Pro (64 bits) # Benutzername : Ich - KRISTIAN # Gestartet von : C:\Users\Ich\Downloads\adwcleaner_4.106.exe # Option : Suchen ***** [ Dienste ] ***** Dienst Gefunden : globalUpdate Dienst Gefunden : globalUpdatem Dienst Gefunden : IePluginServices Dienst Gefunden : servervo Dienst Gefunden : WindowsMangerProtect Dienst Gefunden : fc67e7a0 Dienst Gefunden : InjectorService Dienst Gefunden : abengine ***** [ Dateien / Ordner ] ***** Datei Gefunden : C:\END Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\webssearches.xml Datei Gefunden : C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage Datei Gefunden : C:\Users\Ich\AppData\Local\speedial.crx Datei Gefunden : C:\Users\Ich\AppData\Roaming\LiveSupport.exe_log.txt Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\{74904424-ec46-4d61-bd52-8b528a96f6d1}.xpi Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\searchplugins\Mysearchdial.xml Datei Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\searchplugins\trovi-search.xml Datei Gefunden : C:\Users\Ich\AppData\Roaming\regsvr32.exe_log.txt Datei Gefunden : C:\Users\Ich\Desktop\Continue Live Installation.lnk Ordner Gefunden : C:\Program Files (x86)\CinemaP-1.4cV24.12 Ordner Gefunden : C:\Program Files (x86)\DeltaFix Ordner Gefunden : C:\Program Files (x86)\globalUpdate Ordner Gefunden : C:\Program Files (x86)\GotClip Ordner Gefunden : C:\Program Files (x86)\mbot_de_372 Ordner Gefunden : C:\Program Files (x86)\Mysearchdial Ordner Gefunden : C:\Program Files (x86)\software4u Ordner Gefunden : C:\Program Files (x86)\SupTab Ordner Gefunden : C:\ProgramData\9711429445394706898 Ordner Gefunden : C:\ProgramData\baidu Ordner Gefunden : C:\ProgramData\IePluginServices Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyBestOffersToday Ordner Gefunden : C:\ProgramData\software4u Ordner Gefunden : C:\ProgramData\WindowsMangerProtect Ordner Gefunden : C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko Ordner Gefunden : C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja Ordner Gefunden : C:\Users\Ich\AppData\Local\ConvertAd Ordner Gefunden : C:\Users\Ich\AppData\Local\globalUpdate Ordner Gefunden : C:\Users\Ich\AppData\Local\mbot_de_372 Ordner Gefunden : C:\Users\Ich\AppData\LocalLow\Mysearchdial Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GotClip Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\23fb8bb3-ac21-4230-bbfa-49b94968bc63@gmail.com Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\faststartff@gmail.com Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\ffxtlbr@mysearchdial.com Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\R@LPeyY.net Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\YS8G7x70@g.edu Ordner Gefunden : C:\Users\Ich\AppData\Roaming\Mysearchdial Ordner Gefunden : C:\Users\Ich\AppData\Roaming\SkypEmoticons Ordner Gefunden : C:\Users\Ich\AppData\Roaming\software4u Ordner Gefunden : C:\Users\Ich\AppData\Roaming\VOPackage Ordner Gefunden : C:\Users\Ich\Documents\PC Speed Maximizer Ordner Gefunden : C:\Users\Public\Documents\baidu ***** [ Tasks ] ***** Task Gefunden : globalUpdateUpdateTaskMachineCore Task Gefunden : globalUpdateUpdateTaskMachineUA Task Gefunden : MySearchDial Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-1 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-2 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-3 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-4 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-5 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-5_user Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-6 Task Gefunden : 1c397cd3-39c3-46f8-81e1-9b182093dd7c-7 ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\CinemaP-1.4cV24.12 Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gefunden : HKCU\Software\GlobalUpdate Schlüssel Gefunden : HKCU\Software\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa Schlüssel Gefunden : HKCU\Software\InstallCore Schlüssel Gefunden : HKCU\Software\InstalledBrowserExtensions Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{637D6E3C-DF93-48A5-8362-159A8AC56B11} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} Schlüssel Gefunden : HKCU\Software\Mozilla\Extends Schlüssel Gefunden : HKCU\Software\mysearchdial Schlüssel Gefunden : HKCU\Software\mysearchdial.com Schlüssel Gefunden : HKCU\Software\Optimizer Pro Schlüssel Gefunden : HKCU\Software\SupHpUISoft Schlüssel Gefunden : HKCU\Software\Tutorials Schlüssel Gefunden : HKCU\Software\TutoTag Schlüssel Gefunden : [x64] HKCU\Software\GlobalUpdate Schlüssel Gefunden : [x64] HKCU\Software\InstallCore Schlüssel Gefunden : [x64] HKCU\Software\InstalledBrowserExtensions Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{637D6E3C-DF93-48A5-8362-159A8AC56B11} Schlüssel Gefunden : [x64] HKCU\Software\mysearchdial Schlüssel Gefunden : [x64] HKCU\Software\mysearchdial.com Schlüssel Gefunden : [x64] HKCU\Software\Optimizer Pro Schlüssel Gefunden : [x64] HKCU\Software\SupHpUISoft Schlüssel Gefunden : [x64] HKCU\Software\Tutorials Schlüssel Gefunden : [x64] HKCU\Software\TutoTag Schlüssel Gefunden : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Schlüssel Gefunden : HKLM\SOFTWARE\CinemaP-1.4cV24.12 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\. Schlüssel Gefunden : HKLM\SOFTWARE\Classes\. Schlüssel Gefunden : HKLM\SOFTWARE\Classes\..9 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\..9 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611571181} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622572281} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3004627E-F8E9-4E8B-909D-316753CBA923} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{4ED063C9-4A0B-4B44-A9DC-23AFF424A0D3} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{6b3f7962-b91b-4e19-8cab-eb2a5c201005} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{d5543dff-3a82-44b9-9c8e-4469bd0274be} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc Schlüssel Gefunden : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc Schlüssel Gefunden : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655575581} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666576681} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr Schlüssel Gefunden : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644574481} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440644574481} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{FBC322D5-407E-4854-8C0B-555B951FD8E3} Schlüssel Gefunden : HKLM\SOFTWARE\FlowSurf Schlüssel Gefunden : HKLM\SOFTWARE\GlobalUpdate Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Schlüssel Gefunden : HKLM\SOFTWARE\InstallCore Schlüssel Gefunden : HKLM\SOFTWARE\InstalledBrowserExtensions Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9ec1214e-f643-4e55-aeb3-bce9f3599de7} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d18fa074-7185-4cd3-863c-15888501dbbf} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571181} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6b3f7962-b91b-4e19-8cab-eb2a5c201005} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d5543dff-3a82-44b9-9c8e-4469bd0274be} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6b3f7962-b91b-4e19-8cab-eb2a5c201005} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{d5543dff-3a82-44b9-9c8e-4469bd0274be} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{fc67e7a0} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D8A9D3D9-F414-952D-AC93-E5F96D47B5BD} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CinemaP-1.4cV24.12 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ConvertAd Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FE5AE7DC-7B01-4263-A94C-B4526C276550_is1 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mbot_de_372_is1 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysearchdial Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10 Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4 Schlüssel Gefunden : HKLM\SOFTWARE\MyBestOffersToday Schlüssel Gefunden : HKLM\SOFTWARE\SupDp Schlüssel Gefunden : HKLM\SOFTWARE\SupTab Schlüssel Gefunden : HKLM\SOFTWARE\supWindowsMangerProtect Schlüssel Gefunden : HKLM\SOFTWARE\supWPM Schlüssel Gefunden : HKLM\SOFTWARE\Tutorials Schlüssel Gefunden : HKLM\SOFTWARE\webssearchesSoftware Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611571181} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622572281} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{6b3f7962-b91b-4e19-8cab-eb2a5c201005} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{d5543dff-3a82-44b9-9c8e-4469bd0274be} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655575581} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666576681} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa Schlüssel Gefunden : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9ec1214e-f643-4e55-aeb3-bce9f3599de7} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d18fa074-7185-4cd3-863c-15888501dbbf} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571181} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6b3f7962-b91b-4e19-8cab-eb2a5c201005} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d5543dff-3a82-44b9-9c8e-4469bd0274be} Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}] Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [framei] Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [iDevice Manager Launcher] Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [livesupport] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{3004627E-F8E9-4E8B-909D-316753CBA923}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mbot_de_372] Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com] ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.17148 Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://istart.webssearches.com/web/?type=ds&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX&q={searchTerms} Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://istart.webssearches.com/web/?type=ds&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX&q={searchTerms} Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://istart.webssearches.com/web/?type=ds&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX&q={searchTerms} Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://istart.webssearches.com/?type=hp&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://istart.webssearches.com/web/?type=ds&ts=1419426715&from=cvs4&uid=TOSHIBAXDT01ACA100_Z3DKH00NSXXZ3DKH00NSX&q={searchTerms} -\\ Mozilla Firefox v28.0 (de) [s9d7ok7u.default] - Zeile gefunden : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html"); [s9d7ok7u.default] - Zeile gefunden : user_pref("browser.search.order.1", "Mysearchdial"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.NFyFo17LvcuZGVhl.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.index[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.a23fb8bb3ac214230bbfa49b94968bc63gmailcom65781.65781.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.crossrider.bic", "14a7c7b735f67343cadf52a23aa5ec9f"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.enabledAddons", "ffxtlbr%40mysearchdial.com:1.6.0,faststartff%40gmail.com:4.3.0,23fb8bb3-ac21-4230-bbfa-49b94968bc63%40gmail.com:0.95.46,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.irmysearch.aflt", "ir_14_17_ch"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0DtD0EyCtCtCyBtGtBzztAtDt[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.irmysearch.cr", "936283171"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.irmysearch.instlRef", "140305_a"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.AL", 2); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.aflt", "ir_14_17_ch"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0DtD0EyCtCtCyBtGtBzztAt[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.cntry", "DE"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.cr", "936283171"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.dfltLng", ""); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.dfltSrch", true); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.dnsErr", true); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,18285[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.excTlbr", false); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.hdrMd5", "8AF1D4265CB4FDC2AB03EE965AA77601"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.hmpg", true); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtD[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.id", "BCEE7B5D6D5A602E"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.instlDay", "16182"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.instlRef", "140305_a"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtA[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.29.020:34:26"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyE[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"96\",\"lastVrsn\":\"96\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.prdct", "mysearchdial"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.sg", "none"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.tlbrId", "base"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0ByD0DyC0DyD0AyCtDtB0EtN0D0Tzu0SzzyEtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutC[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.vrsn", "1.8.29.0"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial.vrsni", "1.8.29.0"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial_i.newTab", false); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial_i.smplGrp", "none"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.020:34:26"); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.p3nTlQDjMaToGtnR.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.index[...] [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.quick_start.enable_search1", false); [s9d7ok7u.default] - Zeile gefunden : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false); -\\ Google Chrome v39.0.2171.95 -\\ Comodo Dragon v [C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-12-05&apn_dtid=%5ECMD127%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms} [C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Gefunden [Extension] : cmaiofennmphjldldcpphcechfnnohja [C:\Users\Ich\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Gefunden [Extension] : aaaalipaokhkccgmgkdglfinfnfhflko ************************* AdwCleaner[R0].txt - [35834 octets] - [24/12/2014 14:37:02] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [35895 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.4.0 (11.29.2014:1) OS: Windows 8 Pro x64 Ran by Ich on 26.12.2014 at 11:07:09,08 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin" ~~~ FireFox Successfully deleted the following from C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\s9d7ok7u.default\prefs.js user_pref("extensions.p3nTlQDjMaToGtnR.url", "hxxp://canadafirstforeverygroup.net/sync2/?q=hfZ9ofV9CShEAen0rjkHpihTB6lKDzt4okmxtNtVh7n0rjnFrTsFrjwHrHa7tMFHhd9FqdwGrTwFrjr5qjrM Emptied folder: C:\Users\Ich\AppData\Roaming\mozilla\firefox\profiles\s9d7ok7u.default\minidumps [2 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 26.12.2014 at 11:08:50,79 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-12-2014 Ran by Ich (administrator) on KRISTIAN on 26-12-2014 11:10:50 Running from C:\Users\Ich\Downloads Loaded Profile: Ich (Available profiles: Ich & kobol_000) Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Windows\slsvc.exe () C:\Windows\PersonalizeEnabler.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Spotify Ltd) C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Akamai Technologies, Inc.) C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Spotify Ltd) C:\Users\Ich\AppData\Roaming\Spotify\spotify.exe () C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe (LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Thisisu) C:\Users\Ich\Desktop\JRT.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [MKLOL] => C:\Program Files (x86)\MKJogo\MKLOL\MK.exe [1277128 2014-05-02] (MK) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Spotify Web Helper] => C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-12] (Spotify Ltd) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Ich\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30873192 2014-12-11] (Skype Technologies S.A.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [HS TOOL] => C:\Program Files (x86)\MKJogo\MKHSTOOL\HS_TOOL.exe [884424 2014-11-14] (Hs Tool) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [Spotify] => C:\Users\Ich\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-12] (Spotify Ltd) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [nvhlpr] => C:\Users\Ich\AppData\Local\ContextTrue\nvhlpr.exe [601584 2014-07-11] () HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [cnthlpr] => C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe [601584 2014-07-11] () HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Run: [SwvUpdtr] => C:\Users\Ich\AppData\Local\24759\Updater.exe [773632 2014-12-24] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3979035309-3685434384-2670183491-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKU\S-1-5-21-3979035309-3685434384-2670183491-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default FF DefaultSearchEngine: Yahoo DE FF SelectedSearchEngine: Yahoo DE FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll () FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Extension: Avira Browser Safety - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\abs@avira.com [2014-12-24] FF Extension: Firefox Old Version Update Hotfix - C:\Users\Ich\AppData\Roaming\Mozilla\Firefox\Profiles\s9d7ok7u.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-10-04] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14] Chrome: ======= CHR Profile: C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-24] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-24] CHR Extension: (YouTube) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-24] CHR Extension: (Google Search) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-24] CHR Extension: (Avira Browser Safety) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-12-24] CHR Extension: (Google Wallet) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-24] CHR Extension: (Gmail) - C:\Users\Ich\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-24] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-04] () R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation) R2 slsvc; C:\Windows\slsvc.exe [10240 2012-09-25] (Microsoft Corporation) [File not signed] S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation) S2 serverca; C:\Users\Ich\AppData\Local\ConvertAd\CASrv.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-04] () R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek ) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45112 2014-12-01] (LogMeIn Inc.) R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2013-01-25] (ASUSTeK Computer Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-26 11:08 - 2014-12-26 11:08 - 00001113 _____ () C:\Users\Ich\Desktop\JRT.txt 2014-12-26 11:07 - 2014-12-26 11:07 - 00000000 ____D () C:\Windows\ERUNT 2014-12-26 11:06 - 2014-12-26 11:06 - 01707646 _____ (Thisisu) C:\Users\Ich\Downloads\JRT.exe 2014-12-26 11:06 - 2014-12-26 11:06 - 01707646 _____ (Thisisu) C:\Users\Ich\Desktop\JRT.exe 2014-12-26 10:54 - 2012-10-07 01:32 - 10094592 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-12-26 10:53 - 2014-12-26 10:53 - 02173952 _____ () C:\Users\Ich\Downloads\AdwCleaner_4.106 (2).exe 2014-12-25 16:34 - 2014-12-25 16:34 - 05603624 _____ (Swearware) C:\Users\Ich\Downloads\ComboFix.exe 2014-12-25 14:28 - 2014-12-25 14:28 - 00000862 _____ () C:\Users\Ich\Desktop\Ereignisse.txt 2014-12-24 22:38 - 2014-12-24 22:39 - 13444288 _____ (BlueStack Systems Inc.) C:\Users\Ich\Downloads\BlueStacks-SplitInstaller_native.exe 2014-12-24 17:07 - 2014-12-24 17:08 - 00032186 _____ () C:\Users\Ich\Downloads\Addition.txt 2014-12-24 17:06 - 2014-12-26 11:10 - 00016515 _____ () C:\Users\Ich\Downloads\FRST.txt 2014-12-24 17:06 - 2014-12-26 11:10 - 00000000 ____D () C:\FRST 2014-12-24 17:06 - 2014-12-24 17:06 - 02122240 _____ (Farbar) C:\Users\Ich\Downloads\FRST64.exe 2014-12-24 16:31 - 2014-10-09 05:00 - 01519104 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll 2014-12-24 16:31 - 2014-10-09 05:00 - 01484288 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe 2014-12-24 16:31 - 2014-10-09 05:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\vsstrace.dll 2014-12-24 16:31 - 2014-10-09 04:59 - 01195520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll 2014-12-24 16:31 - 2014-10-09 04:59 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vsstrace.dll 2014-12-24 16:06 - 2014-12-24 16:06 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\QuickScan 2014-12-24 16:02 - 2014-12-24 16:02 - 02173952 _____ () C:\Users\Ich\Downloads\adwcleaner_4.106 (1).exe 2014-12-24 15:59 - 2014-12-24 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-12-24 15:58 - 2014-12-24 15:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-12-24 15:53 - 2014-12-24 16:14 - 123540231 _____ () C:\Users\Ich\Downloads\X15-65741.iso.crdownload 2014-12-24 15:37 - 2014-12-24 15:37 - 00001442 _____ () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-12-24 15:23 - 2014-12-24 15:57 - 00000000 ___HD () C:\Users\Public\Temp 2014-12-24 15:22 - 2014-12-24 15:22 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-24 15:22 - 2014-12-24 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-12-24 15:21 - 2014-12-26 11:02 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-24 15:21 - 2014-12-25 21:26 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-24 15:21 - 2014-12-24 15:21 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-12-24 15:21 - 2014-12-24 15:21 - 00003646 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-12-24 15:19 - 2014-12-24 15:19 - 00871360 _____ () C:\Users\Ich\Downloads\google_chrome.exe 2014-12-24 15:14 - 2014-12-24 15:13 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-12-24 15:12 - 2014-12-24 15:12 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Avira 2014-12-24 15:12 - 2014-12-05 00:09 - 00370880 _____ (Abengine) C:\Windows\system32\abengine64.dll 2014-12-24 15:12 - 2014-12-05 00:09 - 00324592 _____ (Abengine) C:\Windows\SysWOW64\abengine.dll 2014-12-24 14:37 - 2014-12-26 11:04 - 00000000 ____D () C:\AdwCleaner 2014-12-24 14:37 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-12-24 14:37 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-12-24 14:37 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-12-24 14:36 - 2014-12-24 14:36 - 02173952 _____ () C:\Users\Ich\Downloads\adwcleaner_4.106.exe 2014-12-24 14:35 - 2014-12-24 14:35 - 00000000 ____D () C:\Users\Ich\AppData\Local\24759 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\ProgramData\Avira 2014-12-24 14:27 - 2014-12-24 14:37 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-12-24 14:27 - 2014-12-24 14:27 - 04549888 _____ (Avira Operations & Co. KG) C:\Users\Ich\Downloads\avira_de_av___ws.exe 2014-12-24 14:27 - 2014-12-24 14:27 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-24 14:25 - 2014-12-24 14:25 - 00003498 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Kristian-Ich 2014-12-24 14:25 - 2014-12-24 14:25 - 00000112 ____H () C:\A459BAE54B93 2014-12-24 14:25 - 2014-12-24 14:25 - 00000040 ____H () C:\5B0AE88E56FC 2014-12-24 14:25 - 2014-12-24 14:25 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2014-12-24 14:25 - 2014-12-24 14:25 - 00000000 ____D () C:\ProgramData\Adobe 2014-12-24 14:23 - 2014-12-24 14:23 - 00000000 ____D () C:\Users\Ich\AppData\Local\Sparta 2014-12-24 14:13 - 2014-12-26 11:02 - 00001340 _____ () C:\Windows\Tasks\BW.job 2014-12-24 14:13 - 2014-12-24 14:13 - 00004340 _____ () C:\Windows\System32\Tasks\BW 2014-12-24 14:12 - 2014-12-26 11:02 - 00001694 _____ () C:\Windows\Tasks\BCZQOTW.job 2014-12-24 14:12 - 2014-12-24 14:13 - 00000000 ____D () C:\Program Files (x86)\db698c94-f0f9-4cbe-95bb-3e7396d3dbb7 2014-12-24 14:12 - 2014-12-24 14:12 - 00004696 _____ () C:\Windows\System32\Tasks\BCZQOTW 2014-12-24 14:12 - 2014-12-24 14:12 - 00000000 ____D () C:\Users\Ich\AppData\Local\ContextTrue 2014-12-24 14:11 - 2014-12-24 14:31 - 00004704 _____ () C:\Windows\SysWOW64\abengine.ini 2014-12-24 14:11 - 2014-12-24 14:31 - 00002608 _____ () C:\Windows\SysWOW64\abengineOff.ini 2014-12-24 14:11 - 2014-12-24 14:31 - 00002608 _____ () C:\Windows\system32\abengineOff.ini 2014-12-24 14:10 - 2014-12-24 16:20 - 00000000 ____D () C:\Program Files (x86)\Flwsrf 2014-12-24 14:10 - 2014-12-24 14:10 - 00573632 _____ () C:\Users\Ich\Downloads\Menu__6629_i1430428382_il467025.exe 2014-12-24 14:10 - 2014-12-24 14:10 - 00003082 _____ () C:\Windows\System32\Tasks\upfs7235 2014-12-24 14:10 - 2014-12-24 14:10 - 00000000 ____D () C:\Program Files (x86)\pre_installer_de 2014-12-24 14:04 - 2014-12-24 14:04 - 00573632 _____ () C:\Users\Ich\Downloads\Menu__6629_i1430423469_il467025.exe 2014-12-24 10:51 - 2014-11-21 09:38 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-24 10:51 - 2014-11-21 09:38 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-24 10:51 - 2014-11-21 09:37 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-24 10:51 - 2014-11-21 09:37 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-12-24 10:51 - 2014-11-21 09:37 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 19283456 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 15400960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-24 10:51 - 2014-11-21 09:36 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-24 10:51 - 2014-11-21 09:35 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-24 10:51 - 2014-11-21 08:17 - 14364672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-24 10:51 - 2014-11-21 08:17 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-24 10:51 - 2014-11-21 08:17 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-24 10:51 - 2014-11-21 08:17 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-24 10:51 - 2014-11-21 08:17 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-24 10:51 - 2014-11-21 08:17 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 13758976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-24 10:51 - 2014-11-21 08:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-24 10:51 - 2014-11-21 08:16 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-24 10:51 - 2014-11-21 08:00 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-24 10:51 - 2014-11-21 07:54 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-24 10:51 - 2014-11-21 05:30 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-12-24 10:51 - 2014-10-11 06:57 - 17562112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-12-24 10:51 - 2014-10-09 04:59 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll 2014-12-24 10:51 - 2014-10-09 04:59 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll 2014-12-24 10:51 - 2014-10-09 04:58 - 00458240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll 2014-12-24 10:51 - 2014-09-22 06:38 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll 2014-12-24 10:51 - 2014-09-22 04:56 - 00513536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll 2014-12-24 10:51 - 2014-09-18 00:24 - 00987136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srmclient.dll 2014-12-24 10:51 - 2014-09-18 00:24 - 00487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srmscan.dll 2014-12-24 10:51 - 2014-09-18 00:24 - 00278528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srm.dll 2014-12-24 10:51 - 2014-09-18 00:24 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adrclient.dll 2014-12-24 10:51 - 2014-09-17 23:57 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\srmclient.dll 2014-12-24 10:51 - 2014-09-17 23:57 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\srmscan.dll 2014-12-24 10:51 - 2014-09-17 23:57 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\srm.dll 2014-12-24 10:51 - 2014-09-17 23:57 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\adrclient.dll 2014-12-24 10:51 - 2012-09-19 10:25 - 19778048 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-12-24 10:50 - 2014-12-09 08:12 - 00590816 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe 2014-12-24 10:50 - 2014-12-09 08:12 - 00467408 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-12-24 10:50 - 2014-11-06 07:50 - 01627648 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-24 10:50 - 2014-11-06 06:03 - 01339392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-24 10:46 - 2014-10-30 08:20 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-12-24 10:46 - 2014-10-30 06:22 - 01569792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-12-21 12:40 - 2014-12-21 12:40 - 12495254 _____ () C:\Users\Ich\Downloads\tPC Parkour Ver 2.2.zip 2014-12-21 12:33 - 2014-12-24 16:34 - 00000000 ____D () C:\Program Files (x86)\Photo Enlarge 2014-12-21 12:33 - 2014-12-24 14:39 - 00000000 ____D () C:\Program Files (x86)\YoutuBeAduBloCKe 2014-12-21 12:32 - 2014-12-24 14:39 - 00000000 ____D () C:\Program Files (x86)\PrIceChop 2014-12-21 12:32 - 2014-12-21 12:32 - 00000000 ____D () C:\ProgramData\fcfkciaojmeemnpdfhehfchkaaicjecd 2014-12-21 12:32 - 2014-12-21 12:32 - 00000000 ____D () C:\Program Files (x86)\PriceChoop 2014-12-21 12:31 - 2014-12-21 12:31 - 01254256 _____ () C:\Users\Ich\Downloads\minecraftdl_9950.exe 2014-12-20 21:36 - 2014-12-20 21:38 - 28535909 _____ () C:\Users\Ich\Downloads\WynnCraft.zip 2014-12-14 16:06 - 2014-12-14 16:06 - 07518634 _____ () C:\Users\Ich\Downloads\OBS_0_638b_Installer (1).exe 2014-12-09 13:47 - 2014-12-09 13:48 - 13554590 _____ () C:\Users\Ich\Downloads\Kobe vs Messi- Legends on Board - Turkish Airlines.mp4 2014-12-08 20:37 - 2014-12-08 20:38 - 06298840 _____ () C:\Users\Ich\Downloads\Background music -- Hintergrundmusik.mp4 2014-12-08 20:36 - 2014-12-08 20:36 - 14673168 _____ () C:\Users\Ich\Downloads\Youtube Videos kostenlos ohne Programm DOWNLOADEN! [TUT] [GERMAN].mp4 2014-12-08 20:31 - 2014-12-08 20:32 - 02263435 _____ () C:\Users\Ich\Downloads\videoplayback (4) 2014-12-08 20:30 - 2014-12-08 20:30 - 00946397 _____ () C:\Users\Ich\Downloads\videoplayback (3) 2014-12-08 16:39 - 2014-12-08 16:39 - 10420256 _____ (CCCP Project ) C:\Users\Ich\Downloads\Combined-Community-Codec-Pack-2014-07-13.exe 2014-12-08 16:33 - 2014-12-08 16:33 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Control Center 2014-12-08 16:32 - 2014-12-08 16:37 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\WindSolutions 2014-12-08 16:32 - 2014-12-08 16:37 - 00000000 ____D () C:\ProgramData\WindSolutions 2014-12-08 16:32 - 2014-12-08 16:32 - 05102256 _____ (WindSolutions) C:\Users\Ich\Downloads\Install_CopyTransControlCenter.exe 2014-12-08 16:11 - 2014-12-08 16:24 - 00023906 _____ () C:\Windows\SysWOW64\msrsb04.dll 2014-12-08 16:11 - 2014-12-08 16:11 - 04143696 _____ (Marx Software ) C:\Users\Ich\Downloads\IDMSetup_4.5.0.3.exe 2014-12-08 16:11 - 2014-12-08 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDevice Manager 2014-12-07 18:16 - 2014-12-07 18:16 - 00128402 _____ () C:\Users\Ich\Downloads\DamageIndicators[1.4.7]2.4.8.zip 2014-12-07 18:10 - 2014-12-07 18:10 - 00307390 _____ () C:\Users\Ich\Downloads\1.6.4 DamageIndicatorsv2.9.2.4.zip 2014-12-07 18:10 - 2014-12-07 18:10 - 00000000 ____D () C:\Users\Ich\AppData\Local\LogMeIn 2014-12-07 18:10 - 2014-12-07 18:10 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-12-07 18:08 - 2014-12-07 18:08 - 08536064 _____ () C:\Users\Ich\Downloads\hamachi279.msi 2014-12-07 15:31 - 2014-12-07 15:31 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\StunlockStudios 2014-12-07 14:10 - 2014-12-07 14:10 - 00082064 _____ () C:\Users\Ich\Downloads\DamageIndicatorsMod1.4.6.zip 2014-12-07 13:07 - 2014-12-07 13:07 - 00000222 _____ () C:\Users\Ich\Desktop\Dead Island Epidemic.url 2014-12-06 16:48 - 2014-12-06 16:49 - 00000000 ____D () C:\Users\Ich\Downloads\divinerpg 2014-12-06 16:06 - 2014-12-25 18:40 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Craften Terminal 2014-12-06 16:05 - 2014-12-06 16:06 - 00000000 ____D () C:\Program Files (x86)\Craften Terminal 2014-12-06 16:05 - 2014-12-06 16:05 - 00001107 _____ () C:\Users\Public\Desktop\Craften Terminal.lnk 2014-12-06 16:05 - 2014-12-06 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal 2014-12-06 16:04 - 2014-12-06 16:05 - 17033651 _____ (Craften.de ) C:\Users\Ich\Downloads\craftenterminal.exe 2014-12-06 15:58 - 2014-12-06 15:58 - 02269863 _____ () C:\Users\Ich\Downloads\forge-1.6.4-9.11.1.965-installer.jar 2014-12-06 15:55 - 2014-12-06 15:56 - 14731653 _____ () C:\Users\Ich\Downloads\[1.6.4][Beta V6.1]DivineRPG.zip 2014-12-06 15:55 - 2014-12-06 15:55 - 00000243 _____ () C:\Users\Ich\Downloads\DivineRPG-Link.zip 2014-12-06 15:17 - 2014-12-06 15:17 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-12-06 15:17 - 2014-12-06 15:17 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-12-05 15:20 - 2014-12-05 15:20 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-12-05 15:20 - 2014-12-05 15:20 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-12-05 15:19 - 2014-12-05 15:20 - 31029672 _____ (Oracle Corporation) C:\Users\Ich\Downloads\jre-7u71-windows-x64.exe 2014-12-05 14:53 - 2014-12-05 14:53 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\java 2014-12-05 14:08 - 2014-12-05 14:08 - 19934576 _____ () C:\Users\Ich\Downloads\DrakensangOnlineSetup (1).exe 2014-12-05 14:08 - 2014-12-05 14:08 - 00001972 _____ () C:\Users\Ich\Desktop\Drakensang Online.lnk 2014-12-05 14:08 - 2014-12-05 14:08 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online 2014-12-05 14:08 - 2014-12-05 14:08 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online 2014-12-05 14:01 - 2014-12-05 14:04 - 92658088 _____ (Oracle Corporation) C:\Users\Ich\Downloads\jre-8u25-windows-x64.exe 2014-12-05 13:59 - 2014-12-05 13:59 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25 (2).exe 2014-12-05 13:57 - 2014-12-05 13:57 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25 (1).exe 2014-12-05 13:55 - 2014-12-05 13:55 - 00000000 ____D () C:\ProgramData\Oracle 2014-12-05 13:52 - 2014-12-05 13:52 - 00638888 _____ (Oracle Corporation) C:\Users\Ich\Downloads\chromeinstall-8u25.exe 2014-12-05 06:22 - 2014-12-06 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo 2014-12-05 06:22 - 2014-12-05 06:22 - 00000000 ____D () C:\Users\Ich\AppData\Local\Comodo 2014-12-05 06:20 - 2014-12-05 06:26 - 00000000 ____D () C:\FFOutput 2014-12-05 06:20 - 2014-12-05 06:20 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory 2014-12-05 06:20 - 2014-11-07 16:13 - 31417672 _____ (AVM Software Inc.) C:\Users\Ich\Documents\pal_install_a4650_r131001_p127000.exe 2014-12-05 06:19 - 2014-12-05 06:19 - 00000000 ____D () C:\Program Files (x86)\FreeTime 2014-12-05 06:17 - 2014-12-05 06:19 - 56201784 _____ (Free Time) C:\Users\Ich\Downloads\FFSetup3.5.0.0.exe 2014-12-04 21:23 - 2014-12-04 21:23 - 13537227 _____ () C:\Users\Ich\Downloads\videoplayback (2) 2014-12-04 21:22 - 2014-12-04 21:23 - 18563916 _____ () C:\Users\Ich\Downloads\videoplayback (1) 2014-12-04 21:21 - 2014-12-04 21:22 - 18563916 _____ () C:\Users\Ich\Downloads\videoplayback 2014-12-04 19:54 - 2014-12-04 19:54 - 00078514 _____ () C:\Users\Ich\Downloads\Farbbalken mit Ton (PAL).mp4 2014-12-04 19:02 - 2014-12-04 19:02 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TechSmith 2014-12-04 19:01 - 2014-12-09 13:54 - 00000000 ____D () C:\Users\Ich\Documents\Camtasia Studio 2014-12-04 19:01 - 2014-12-04 19:01 - 00000000 ____D () C:\Users\Ich\AppData\Local\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\regid.1995-08.com.techsmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\Program Files (x86)\TechSmith 2014-12-04 19:00 - 2014-12-04 19:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-12-04 18:50 - 2014-12-04 18:57 - 257705272 _____ () C:\Users\Ich\Downloads\camtasiade844.exe 2014-12-04 17:57 - 2014-12-04 17:57 - 00240164 _____ () C:\Users\Ich\Downloads\Neue Aufnahme.m4a 2014-12-01 18:26 - 2014-12-01 18:26 - 00001164 _____ () C:\Users\Public\Desktop\Elsword.lnk 2014-12-01 15:51 - 2014-12-01 15:51 - 00045112 ____H (LogMeIn Inc.) C:\Windows\system32\Drivers\Hamdrv.sys 2014-11-30 16:34 - 2014-12-03 16:52 - 00000000 ____D () C:\Users\Ich\Downloads\direwolf20_17 2014-11-30 15:09 - 2014-11-30 15:09 - 00000000 ____D () C:\Users\Ich\Downloads\MagicFarm2 2014-11-30 14:19 - 2014-11-30 14:19 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Trove 2014-11-30 11:14 - 2014-11-30 11:14 - 00001865 _____ () C:\Users\Ich\Desktop\Trove.lnk 2014-11-30 11:07 - 2014-11-30 11:09 - 31884400 _____ (Trion Worlds Inc.) C:\Users\Ich\Downloads\GlyphInstall-0-131.exe 2014-11-29 13:50 - 2014-11-29 13:51 - 00000000 ____D () C:\Users\Ich\Downloads\FTBLite 2014-11-29 13:39 - 2014-11-29 13:51 - 00000000 ____D () C:\Users\Ich\Downloads\assets 2014-11-29 13:39 - 2014-11-29 13:50 - 00000000 ____D () C:\Users\Ich\Downloads\versions 2014-11-29 13:39 - 2014-11-29 13:40 - 00000000 ____D () C:\Users\Ich\Downloads\libraries 2014-11-29 13:37 - 2014-11-29 13:44 - 00000000 ____D () C:\Users\Ich\Downloads\FTBMageQuest 2014-11-29 13:35 - 2014-12-07 18:13 - 00000000 ____D () C:\Users\Ich\AppData\Local\ftblauncher 2014-11-29 13:35 - 2014-11-29 13:35 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\ftblauncher ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-26 11:08 - 2012-07-26 11:27 - 00752930 _____ () C:\Windows\system32\perfh007.dat 2014-12-26 11:08 - 2012-07-26 11:27 - 00156156 _____ () C:\Windows\system32\perfc007.dat 2014-12-26 11:08 - 2012-07-26 08:28 - 01748838 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-26 11:04 - 2014-02-17 16:05 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Skype 2014-12-26 11:03 - 2014-04-25 14:12 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Spotify 2014-12-26 11:02 - 2014-03-13 16:53 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-26 11:02 - 2014-02-17 00:27 - 00640580 _____ () C:\Windows\PFRO.log 2014-12-26 11:02 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-26 11:01 - 2014-02-17 00:51 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3979035309-3685434384-2670183491-1001 2014-12-26 11:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2014-12-26 10:55 - 2014-02-17 00:34 - 01305791 _____ () C:\Windows\WindowsUpdate.log 2014-12-26 10:55 - 2012-07-26 06:26 - 00524288 ___SH () C:\Windows\system32\config\BBI 2014-12-26 10:46 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData 2014-12-25 18:42 - 2014-02-17 16:31 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\.minecraft 2014-12-24 18:12 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache 2014-12-24 17:07 - 2014-02-22 17:49 - 00000000 ____D () C:\Users\Ich\AppData\Local\CrashDumps 2014-12-24 16:40 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF 2014-12-24 16:35 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-24 16:34 - 2014-02-17 01:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-24 16:32 - 2014-02-17 01:02 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-24 15:22 - 2014-02-17 01:33 - 00000000 ____D () C:\Program Files (x86)\Google 2014-12-24 14:43 - 2014-02-18 18:39 - 00000000 ____D () C:\Users\Ich\AppData\Local\Adobe 2014-12-24 14:43 - 2014-02-17 00:35 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Adobe 2014-12-24 14:18 - 2014-02-18 18:36 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-12-24 14:13 - 2014-02-28 16:16 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-12-22 11:53 - 2014-09-26 08:13 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-12-20 13:49 - 2014-02-19 17:15 - 00000000 ____D () C:\Users\Ich\AppData\Local\Battle.net 2014-12-20 10:01 - 2014-04-25 14:13 - 00000000 ____D () C:\Users\Ich\AppData\Local\Spotify 2014-12-19 19:29 - 2014-11-11 15:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft 2014-12-18 19:22 - 2014-02-23 14:56 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-12-17 18:50 - 2014-03-22 16:07 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\OBS 2014-12-15 20:29 - 2014-02-17 18:19 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\TS3Client 2014-12-14 10:32 - 2014-02-17 16:05 - 00000000 ____D () C:\ProgramData\Skype 2014-12-12 14:58 - 2014-02-19 17:15 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-12-09 20:01 - 2014-11-02 10:49 - 00000000 ____D () C:\Program Files (x86)\Glyph 2014-12-08 18:02 - 2012-07-26 08:21 - 00023752 _____ () C:\Windows\setupact.log 2014-12-08 16:47 - 2014-11-10 16:28 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\iFunbox_UserCache 2014-12-07 16:47 - 2014-02-23 15:06 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-12-07 12:04 - 2014-02-19 17:18 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-12-07 09:50 - 2014-02-17 01:35 - 00000000 ____D () C:\Program Files\Google 2014-12-06 15:22 - 2014-07-12 19:47 - 00000000 ____D () C:\Users\Ich\AppData\Local\Deployment 2014-12-06 15:20 - 2014-02-17 01:33 - 00000000 ____D () C:\Users\Ich\AppData\Local\Google 2014-12-06 15:19 - 2014-03-31 08:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live 2014-12-06 15:19 - 2014-03-31 08:58 - 00000000 ____D () C:\Program Files (x86)\GameforgeLive 2014-12-06 15:18 - 2014-10-04 15:41 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames 2014-12-06 15:18 - 2014-08-05 21:27 - 00000000 ____D () C:\AeriaGames 2014-12-06 15:18 - 2014-02-28 16:20 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-12-05 21:05 - 2012-07-26 09:12 - 00000000 __RHD () C:\Users\Public\Libraries 2014-12-05 15:23 - 2014-07-12 14:44 - 00000000 ____D () C:\ProgramData\Hi-Rez Studios 2014-12-05 15:23 - 2014-07-12 14:44 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios 2014-12-05 15:23 - 2014-02-18 14:38 - 00000000 ____D () C:\Program Files (x86)\The Mighty Quest For Epic Loot 2014-12-05 15:23 - 2014-02-17 01:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Users\Ich\AppData\Roaming\NCSOFT 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Users\Ich\AppData\Local\NCSOFT 2014-12-05 15:21 - 2014-05-13 10:42 - 00000000 ____D () C:\Program Files (x86)\NCSOFT 2014-12-05 15:21 - 2014-04-03 17:28 - 00000000 ____D () C:\Users\Ich\AppData\Local\Unity 2014-12-05 15:17 - 2014-02-17 16:30 - 00000000 ____D () C:\Program Files\Java 2014-12-05 13:55 - 2014-02-17 16:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-12-04 21:23 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-12-04 19:01 - 2014-02-17 00:35 - 00000000 ____D () C:\Users\Ich 2014-12-02 14:28 - 2014-03-31 08:59 - 00000000 ____D () C:\Users\Ich\Downloads\Gameforge Live 2014-11-26 22:11 - 2014-11-17 15:38 - 00714184 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-26 22:11 - 2014-11-17 15:38 - 00106440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\Ich\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-17 16:31 ==================== End Of Log ============================ --- --- --- Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-12-2014 Ran by Ich at 2014-12-26 11:11:10 Running from C:\Users\Ich\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated) Akamai NetSession Interface (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Akamai) (Version: - Akamai Technologies, Inc) Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.020 - ASUSTek Computer Inc.) Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG) Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version: - 2K Australia) Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version: - ) Call of Duty: Black Ops II - Zombies (HKLM-x32\...\Steam App 212910) (Version: - ) Call of Duty: Black Ops II (HKLM-x32\...\Steam App 202970) (Version: - Treyarch) Camtasia Studio 8 (HKLM-x32\...\{6BED66AA-1DC6-474B-AC70-205CC3A68A39}) (Version: 8.4.4.1859 - TechSmith Corporation) ContextTrue (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\ContextTrue) (Version: - ) CopyTrans Control Center deinstallieren (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Craften Terminal 4.0.2 (HKLM-x32\...\{4e7c3936-7c06-4ef0-928b-c5d92f372578}_is1) (Version: 4.0.2 - Craften.de) Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version: - Stunlock Studios) Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) Diablo III Public Test (HKLM-x32\...\Diablo III Public Test) (Version: - Blizzard Entertainment) Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve) Dragon's Prophet (HKLM-x32\...\{C31556D7-F2B9-4787-B223-F7A035067E89}_is1) (Version: 2.0.1296.18 - Infernum Productions AG) Drakensang Online (HKLM-x32\...\Drakensang Online) (Version: - ) Elsword (HKLM-x32\...\Elsword_de_is1) (Version: - ) Flwsrf (HKLM-x32\...\Flwsrf) (Version: 3.0.0.2 - Flwsrf) <==== ATTENTION! FormatFactory 3.5.0.0 (HKLM-x32\...\FormatFactory) (Version: 3.5.0.0 - Format Factory) Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.65 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden GotClip Downloader (HKLM-x32\...\GotClip) (Version: - ) Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) iFunbox (v2.7.2386.747), iFunbox DevTeam (HKLM-x32\...\iFunbox_is1) (Version: v2.7.2386.747 - ) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.) Java 7 Update 71 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417071FF}) (Version: 7.0.710 - Oracle) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.9.1 - www.leaguereplays.com) Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) MK HS TOOL (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\HS TOOL) (Version: - ) MKLOL (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\MKLOL) (Version: - ) Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.1.0 - Vitalwerks Internet Solutions LLC) Nostale(DE) (HKLM-x32\...\NosTale(DE)_is1) (Version: - Gameforge 4D GmbH) NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation) NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - ) Path of Exile (HKLM-x32\...\Steam App 238960) (Version: - Grinding Gear Games) Photo Enlarge (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) Realm of the Mad God (HKLM-x32\...\Steam App 200210) (Version: - Wild Shadow Studios) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6782 - Realtek Semiconductor Corp.) SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Spotify (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) TeamSpeak 3 Client (HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\TeamSpeak 3 Client) (Version: 3.0.13 - TeamSpeak Systems GmbH) The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version: - Edmund McMillen and Florian Himsl) TP-LINK TL-WN781ND Driver (HKLM-x32\...\{87C7B472-9BC2-43C8-9F03-86D2908E1A51}) (Version: 1.3.1 - TP-LINK) Trove (HKLM-x32\...\Glyph Trove) (Version: - Trion Worlds, Inc.) WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH) World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment) Zombie Invasion (HKLM-x32\...\ZombieInvasion) (Version: 2.7.50 - Time Lapse Solutions) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 24-12-2014 15:05:26 Windows Modules Installer ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2012-07-26 06:26 - 2014-12-04 19:02 - 00001472 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {17432E68-5AC9-49E2-A100-2A41CC4FFF0B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-24] (Google Inc.) Task: {2BC030A5-7604-4A86-995B-6D977D89F4FF} - System32\Tasks\BCZQOTW => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: {304B146B-1B1C-4BFF-B600-AEDF35C231F5} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-01-25] (ASUSTek Computer Inc.) Task: {3C06769A-B485-427D-9FAF-898CBCC9D9E1} - System32\Tasks\{FB5AA185-EDB5-47F6-89E9-5D0185903BCD} => pcalua.exe -a "C:\Riot Games\League of Legends\lol.launcher.exe" -d "C:\Riot Games\League of Legends\" Task: {63162C5D-C5B8-4031-B91A-2ADB9A7DC968} - System32\Tasks\BW => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: {A511457E-5C67-48AC-AF66-038C5F94A915} - System32\Tasks\Auto Aktivierung => C:\Windows\Setup\Scripts\TriggerKMS.exe [2013-01-24] () Task: {B0459DEC-6D70-4521-9666-A01DB56011BE} - System32\Tasks\AdobeAAMUpdater-1.0-Kristian-Ich => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe Task: {C9CE5827-8BAD-4B3A-81A9-9965D2A6A58D} - System32\Tasks\upfs7235 => C:\PROGRA~2\Flwsrf\upfs7235.exe Task: {CAF34C64-B85E-474C-A603-69D5CB1AEA9E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {CC9C2B19-C1B5-4783-89B2-E6A69FB6FBE2} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-24] (Microsoft Corporation) Task: {DA3FD1ED-1F85-41CB-BB93-F31EB7CD98A8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-24] (Google Inc.) Task: {FE73FE89-4939-4E5D-B560-5F6FA656ABA5} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\WatTask => C:\Windows Activation Technologies\wat.exe [2006-04-21] () Task: C:\Windows\Tasks\BCZQOTW.job => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: C:\Windows\Tasks\BW.job => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-03-13 16:53 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-02-17 01:03 - 2013-07-04 03:32 - 00936728 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe 2014-02-17 00:40 - 2012-09-28 02:26 - 00087040 _____ () C:\Windows\PersonalizeEnabler.exe 2014-02-17 00:40 - 2012-09-27 00:31 - 00084992 _____ () C:\Windows\SLCHook.dll 2014-02-17 00:40 - 2009-03-07 06:02 - 00102912 _____ () C:\Windows\EasyHook64.dll 2014-07-11 13:17 - 2014-07-11 13:17 - 00601584 _____ () C:\Users\Ich\AppData\Local\ContextTrue\cnthlpr.exe 2014-04-25 14:13 - 2014-12-12 18:36 - 00374840 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\SpotifyHelper.exe 2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-17 01:03 - 2014-12-26 11:02 - 00027136 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll 2014-02-17 01:03 - 2013-07-04 03:32 - 00104448 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\ATKEX.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 36966968 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libcef.dll 2014-07-04 15:44 - 2014-07-04 15:44 - 00401408 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll 2014-07-17 20:28 - 2014-12-12 18:36 - 00867896 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\ffmpegsumo.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 00886840 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libglesv2.dll 2014-04-25 14:13 - 2014-12-12 18:36 - 00108600 _____ () C:\Users\Ich\AppData\Roaming\Spotify\Data\libegl.dll 2014-02-17 01:40 - 2013-03-12 13:19 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libglesv2.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libegl.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\pdf.dll 2014-12-24 15:22 - 2014-11-14 22:15 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\ffmpegsumo.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData\TEMP:AD022376 AlternateDataStreams: C:\Users\Ich\Downloads\Menu__6629_i1430428382_il467025.exe:typelib ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\abengine => ""="service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "nvhlpr" HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "HS TOOL" HKU\S-1-5-21-3979035309-3685434384-2670183491-1001\...\StartupApproved\Run: => "SwvUpdtr" ========================= Accounts: ========================== Administrator (S-1-5-21-3979035309-3685434384-2670183491-500 - Administrator - Disabled) Gast (S-1-5-21-3979035309-3685434384-2670183491-501 - Limited - Disabled) Ich (S-1-5-21-3979035309-3685434384-2670183491-1001 - Administrator - Enabled) => C:\Users\Ich kobol_000 (S-1-5-21-3979035309-3685434384-2670183491-1004 - Limited - Enabled) => C:\Users\kobol_000 ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Error: (12/26/2014 11:10:10 AM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MEDIA-HP", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{BDE77C34-8EB0-4A06-880B-DD789380824E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2014-12-26 11:02:24.280 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-26 10:55:44.733 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 16:16:52.496 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 15:32:33.436 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 15:08:19.764 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 14:40:44.496 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-24 14:30:39.199 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-22 13:24:50.186 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-21 10:38:28.234 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. Date: 2014-12-20 21:08:47.499 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\System32\smss.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\shell32.dll with signing level Unsigned while the system requires signing level Windows or better to load. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-4440 CPU @ 3.10GHz Percentage of memory in use: 25% Total physical RAM: 8130.14 MB Available physical RAM: 6070.06 MB Total Pagefile: 16834.14 MB Available Pagefile: 14351.76 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.17 GB) (Free:676.95 GB) NTFS Drive e: (24 Mrz 2013) (CDROM) (Total:0.27 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00180018) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=931.2 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
26.12.2014, 18:25 | #10 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit WerbungZitat:
Die Funde auch löschen lassen. Bitte die Anleitungen sorgfältiger lesen und umsetzen.
__________________ Logfiles bitte immer in CODE-Tags posten |
26.12.2014, 19:23 | #11 |
| Internet öffnet immer neue tabs mit Werbung Das ist der log vom 24 da habe ich es zum erstenmal gemacht, als ich ihn aber heute gemacht habe (26) hat er nichts gefunden, deswegen habe ich den ersten log gepostet . Und vielen dank für deine Hilfe, wollte anmerken dass bis jetzt sich keine neuen Tabs öffnen. |
26.12.2014, 19:32 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit Werbung Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Task: {2BC030A5-7604-4A86-995B-6D977D89F4FF} - System32\Tasks\BCZQOTW => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: {63162C5D-C5B8-4031-B91A-2ADB9A7DC968} - System32\Tasks\BW => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: C:\Windows\Tasks\BCZQOTW.job => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: C:\Windows\Tasks\BW.job => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION C:\Users\Ich\AppData\Roaming\BCZQOTW.exe C:\Users\Ich\AppData\Roaming\BW.exe EmptyTemp: Hosts: Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
26.12.2014, 21:22 | #13 |
| Internet öffnet immer neue tabs mit WerbungCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-12-2014 Ran by Ich at 2014-12-26 21:17:44 Run:2 Running from C:\Users\Ich\Desktop Loaded Profile: Ich (Available profiles: Ich & kobol_000) Boot Mode: Normal ============================================== Content of fixlist: ***************** Task: {2BC030A5-7604-4A86-995B-6D977D89F4FF} - System32\Tasks\BCZQOTW => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: {63162C5D-C5B8-4031-B91A-2ADB9A7DC968} - System32\Tasks\BW => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION Task: C:\Windows\Tasks\BCZQOTW.job => C:\Users\Ich\AppData\Roaming\BCZQOTW.exe <==== ATTENTION Task: C:\Windows\Tasks\BW.job => C:\Users\Ich\AppData\Roaming\BW.exe <==== ATTENTION C:\Users\Ich\AppData\Roaming\BCZQOTW.exe C:\Users\Ich\AppData\Roaming\BW.exe EmptyTemp: Hosts: ***************** HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2BC030A5-7604-4A86-995B-6D977D89F4FF} => Key not found. C:\Windows\System32\Tasks\BCZQOTW not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BCZQOTW => Key not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{63162C5D-C5B8-4031-B91A-2ADB9A7DC968} => Key not found. C:\Windows\System32\Tasks\BW not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BW => Key not found. C:\Windows\Tasks\BCZQOTW.job not found. C:\Windows\Tasks\BW.job not found. "C:\Users\Ich\AppData\Roaming\BCZQOTW.exe" => File/Directory not found. "C:\Users\Ich\AppData\Roaming\BW.exe" => File/Directory not found. C:\Windows\System32\Drivers\etc\hosts => Moved successfully. Hosts was reset successfully. EmptyTemp: => Removed 511.5 MB temporary data. The system needed a reboot. ==== End of Fixlog 21:18:29 ==== |
27.12.2014, 00:33 | #14 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Internet öffnet immer neue tabs mit Werbung Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
27.12.2014, 12:55 | #15 |
| Internet öffnet immer neue tabs mit Werbung Ich habe aber nichts externes also kein usb-stick oder sonstiges, soll ich es trotzdem tun ? |
Themen zu Internet öffnet immer neue tabs mit Werbung |
andere, datei, einfach, hoffe, inter, interne, internet, internet werbung, leute, neu, neue, neue tabs, neue tabs mit werbung, runtergeladen, sache, sachen, schmoll, tabs mit werbung, werbun, werbung, öffnet |