| |
| |||||||
Log-Analyse und Auswertung: PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
28.12.2014, 17:53
| #1 |
 |  PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Hallo Jungs! Seit ca. einem halben Jahr ist mein Rechner ohne ersichtlichen Grund und Anlass ziemlich langsam. Vor ca. 2 Monaten war ein Familienfreund zu Besuch, der sich nach eigener Aussage "mit Computern auskennt", und hat diverse kleinere Arbeiten (Betriebssystem-Update, andere Updates und Hilfsprogramme installiert) zur Verbesserung des Systems durchgeführt. Es hat sich jedoch nichts geändert. Zum Virenschutz benutze ich den Windows-Firewall und Avira-Antivir (und glaubte damit, einen sicheren Rechner zu haben - hatte ja auch nie Probleme mit Viren). Bisher hatte ich nie Virenmeldungen o.ä. Doch vor ca. 1 Woche, am 23.12., meldete Antivir erstmals einen Fund. Spätere Scans ergaben sogar mehr Funde (bis zu 39!). Mein Bruder (der sich tatsächlich mit Rechnern auskennt, leider aber einige Hundert Kilometer weit weg wohnt) riet mir auf meinen Hilferuf hin, Antimalware von Malwarebytes zu installieren. Das tat ich - und ein Scan damit ergab prompt über 60 Funde (alles "non-malware"). Ich ließ es alles in die Quarantäne verschieben und ein erneuter Scan ergab dann 0 (keine) Funde. Auch bei Avira folgte ich den Anweisungen: ich ließ alles in die Quarantäne verschieben, startete das System neu und führte einen neuen Scan durch, der ebenfalls 0 (keine) Funde ergab. Allerdings bekomme ich weiterhin immer wieder Viren-Meldungen von Avira (Trojaner XY sei gefunden worden usw.). Auch besteht das Problem der extremen Langsamkeit meines Systems ungemindert weiter! Ich bin verzweifelt! Könnt Ihr mir helfen? Die entsprechenden Antivir- und MBAM-Logs, die ich auftreiben konnte, sowie alle Logs laut Forum-Hinweisen habe ich als ZIP-Datei angehängt. (Ich wurde dazu aufgefordert...) Bitte helft mir, meinen PC wiederherzustellen! Vielen Dank im voraus Eure Justelene_dk PS. Mein Bruder meinte, als er vor ca. 1 Jahr zuletzt hier war, dass ich mal meinen Arbeitsspeicher aufrüsten sollte. Das ist geplant und wird nach den Weihnachtsferien in Angriff genommen... |
|
28.12.2014, 17:59
| #2 |
| /// the machine /// TB-Ausbilder    | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
28.12.2014, 18:12
| #3 |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Ich wurde zwar vom Forum dazu aufgefordert (290006 statt max. 120000 Zeichen), aber gut!
__________________Hier sind die Logs: Avira Anti-Vir Code:
ATTFilter Avira Free Antivirus Report file date: Tuesday, December 23th 2014 23:55 The program is running as an unrestricted full version. Online services are available. Licensee : Avira Antivirus Free Serial number : 0000149996-AVHOE-0000001 Platform : Microsoft Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : USER-5FB402D855 Version information: BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00 AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30 AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02 LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32 AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31 REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24 REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01 AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58 AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20 AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59 XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11 XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12 XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13 XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14 XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14 XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14 XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14 XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14 XBV00190.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00191.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00192.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00193.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00194.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00195.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00196.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00197.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00198.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00199.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00200.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00201.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00202.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00203.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00204.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00205.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00206.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00207.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00208.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00209.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00210.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00211.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00212.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00213.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:55 XBV00214.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00215.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00216.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00217.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00218.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00219.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00220.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00221.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00222.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00223.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00224.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00225.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00226.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00227.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00228.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00229.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00230.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00231.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00232.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00233.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00234.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00235.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00236.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00237.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00238.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00239.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00240.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00241.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:56 XBV00242.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00243.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00244.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00245.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00246.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00247.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00248.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00249.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00250.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00251.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00252.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00253.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00254.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00255.VDF : 8.11.190.32 2048 Bytes 3/12/2014 14:20:57 XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44 XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04 XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27 XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42 XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41 XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10 XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38 XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02 XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11 XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51 XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59 XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21 XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45 XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45 XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46 XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01 XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01 XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01 XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01 XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01 XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01 XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01 XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01 XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48 XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48 XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48 XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48 XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48 XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24 XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24 XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24 XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59 XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59 XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59 XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00 XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00 XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00 XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06 XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06 XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06 XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06 XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06 XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06 XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07 XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07 XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07 XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39 XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40 XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40 XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40 XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40 XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40 XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40 XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40 XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40 XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41 XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41 XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41 XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41 XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41 XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41 XBV00090.VDF : 8.11.193.210 2048 Bytes 9/12/2014 15:31:42 XBV00091.VDF : 8.11.193.212 82432 Bytes 9/12/2014 15:31:42 XBV00092.VDF : 8.11.193.214 2048 Bytes 9/12/2014 15:31:42 XBV00093.VDF : 8.11.193.236 93696 Bytes 10/12/2014 15:31:43 XBV00094.VDF : 8.11.193.254 2048 Bytes 10/12/2014 15:31:43 XBV00095.VDF : 8.11.194.0 4608 Bytes 10/12/2014 15:31:43 XBV00096.VDF : 8.11.194.18 16896 Bytes 10/12/2014 15:31:43 XBV00097.VDF : 8.11.194.38 29696 Bytes 10/12/2014 15:31:43 XBV00098.VDF : 8.11.194.56 24576 Bytes 10/12/2014 15:31:43 XBV00099.VDF : 8.11.194.58 11776 Bytes 10/12/2014 15:31:43 XBV00100.VDF : 8.11.194.62 7680 Bytes 10/12/2014 15:31:43 XBV00101.VDF : 8.11.194.64 4096 Bytes 10/12/2014 15:31:44 XBV00102.VDF : 8.11.194.68 17408 Bytes 11/12/2014 15:31:44 XBV00103.VDF : 8.11.194.70 2048 Bytes 11/12/2014 15:31:44 XBV00104.VDF : 8.11.194.72 25600 Bytes 11/12/2014 15:31:44 XBV00105.VDF : 8.11.194.74 2048 Bytes 11/12/2014 15:31:44 XBV00106.VDF : 8.11.194.92 10240 Bytes 11/12/2014 15:31:44 XBV00107.VDF : 8.11.194.110 24064 Bytes 11/12/2014 14:48:35 XBV00108.VDF : 8.11.194.128 2048 Bytes 11/12/2014 14:48:35 XBV00109.VDF : 8.11.194.148 74752 Bytes 11/12/2014 14:48:35 XBV00110.VDF : 8.11.194.166 2048 Bytes 11/12/2014 14:48:35 XBV00111.VDF : 8.11.194.188 17920 Bytes 12/12/2014 14:48:35 XBV00112.VDF : 8.11.194.192 33280 Bytes 12/12/2014 14:48:36 XBV00113.VDF : 8.11.194.194 10752 Bytes 12/12/2014 14:48:36 XBV00114.VDF : 8.11.194.212 59904 Bytes 12/12/2014 20:46:02 XBV00115.VDF : 8.11.194.230 2048 Bytes 12/12/2014 20:46:03 XBV00116.VDF : 8.11.194.246 10240 Bytes 12/12/2014 20:46:03 XBV00117.VDF : 8.11.195.6 11776 Bytes 12/12/2014 13:53:47 XBV00118.VDF : 8.11.195.22 2048 Bytes 12/12/2014 13:53:47 XBV00119.VDF : 8.11.195.24 2048 Bytes 12/12/2014 13:53:47 XBV00120.VDF : 8.11.195.42 28672 Bytes 12/12/2014 13:53:47 XBV00121.VDF : 8.11.195.44 8192 Bytes 12/12/2014 13:53:47 XBV00122.VDF : 8.11.195.48 33792 Bytes 13/12/2014 13:53:48 XBV00123.VDF : 8.11.195.50 2048 Bytes 13/12/2014 13:53:48 XBV00124.VDF : 8.11.195.52 16384 Bytes 13/12/2014 13:53:48 XBV00125.VDF : 8.11.195.54 19968 Bytes 13/12/2014 13:53:48 XBV00126.VDF : 8.11.195.56 2048 Bytes 13/12/2014 13:53:48 XBV00127.VDF : 8.11.195.74 83968 Bytes 14/12/2014 13:53:48 XBV00128.VDF : 8.11.195.90 2048 Bytes 14/12/2014 13:53:48 XBV00129.VDF : 8.11.195.92 2048 Bytes 14/12/2014 13:53:49 XBV00130.VDF : 8.11.195.108 31232 Bytes 14/12/2014 14:14:52 XBV00131.VDF : 8.11.195.124 19968 Bytes 14/12/2014 14:14:53 XBV00132.VDF : 8.11.195.126 2048 Bytes 14/12/2014 14:14:53 XBV00133.VDF : 8.11.195.142 53760 Bytes 15/12/2014 14:14:53 XBV00134.VDF : 8.11.195.144 2048 Bytes 15/12/2014 14:14:53 XBV00135.VDF : 8.11.195.146 11264 Bytes 15/12/2014 14:14:54 XBV00136.VDF : 8.11.195.162 6144 Bytes 15/12/2014 14:14:54 XBV00137.VDF : 8.11.195.176 22016 Bytes 15/12/2014 14:14:54 XBV00138.VDF : 8.11.195.178 6144 Bytes 15/12/2014 14:14:54 XBV00139.VDF : 8.11.195.194 2048 Bytes 15/12/2014 14:14:54 XBV00140.VDF : 8.11.195.208 28672 Bytes 15/12/2014 20:13:32 XBV00141.VDF : 8.11.195.224 18944 Bytes 15/12/2014 20:13:32 XBV00142.VDF : 8.11.195.226 7680 Bytes 15/12/2014 20:13:32 XBV00143.VDF : 8.11.195.230 26112 Bytes 15/12/2014 05:39:12 XBV00144.VDF : 8.11.195.232 23552 Bytes 15/12/2014 05:39:12 XBV00145.VDF : 8.11.195.250 38400 Bytes 16/12/2014 20:21:41 XBV00146.VDF : 8.11.196.8 51200 Bytes 16/12/2014 20:21:41 XBV00147.VDF : 8.11.196.10 2048 Bytes 16/12/2014 20:21:41 XBV00148.VDF : 8.11.196.12 2048 Bytes 16/12/2014 20:21:41 XBV00149.VDF : 8.11.196.28 22528 Bytes 16/12/2014 20:21:41 XBV00150.VDF : 8.11.196.44 23552 Bytes 16/12/2014 20:21:42 XBV00151.VDF : 8.11.196.48 2048 Bytes 16/12/2014 20:21:42 XBV00152.VDF : 8.11.196.50 12288 Bytes 16/12/2014 20:21:42 XBV00153.VDF : 8.11.196.52 2048 Bytes 16/12/2014 20:21:42 XBV00154.VDF : 8.11.196.68 37888 Bytes 17/12/2014 20:21:42 XBV00155.VDF : 8.11.196.80 7680 Bytes 17/12/2014 20:21:42 XBV00156.VDF : 8.11.196.92 8704 Bytes 17/12/2014 20:21:43 XBV00157.VDF : 8.11.196.94 2048 Bytes 17/12/2014 20:21:43 XBV00158.VDF : 8.11.196.106 2048 Bytes 17/12/2014 20:21:43 XBV00159.VDF : 8.11.196.118 22016 Bytes 17/12/2014 20:21:43 XBV00160.VDF : 8.11.196.122 16896 Bytes 17/12/2014 20:21:43 XBV00161.VDF : 8.11.196.124 7680 Bytes 17/12/2014 20:21:43 XBV00162.VDF : 8.11.196.126 8192 Bytes 17/12/2014 20:21:43 XBV00163.VDF : 8.11.196.128 13312 Bytes 17/12/2014 20:21:43 XBV00164.VDF : 8.11.196.130 7680 Bytes 17/12/2014 20:21:43 XBV00165.VDF : 8.11.196.132 2048 Bytes 18/12/2014 20:21:43 XBV00166.VDF : 8.11.196.136 27648 Bytes 18/12/2014 20:21:44 XBV00167.VDF : 8.11.196.138 2048 Bytes 18/12/2014 20:21:44 XBV00168.VDF : 8.11.196.140 7168 Bytes 18/12/2014 20:21:44 XBV00169.VDF : 8.11.196.142 2048 Bytes 18/12/2014 20:21:44 XBV00170.VDF : 8.11.196.144 11776 Bytes 18/12/2014 20:21:44 XBV00171.VDF : 8.11.196.146 9728 Bytes 18/12/2014 20:21:44 XBV00172.VDF : 8.11.196.150 33792 Bytes 18/12/2014 20:21:44 XBV00173.VDF : 8.11.196.154 18944 Bytes 18/12/2014 20:21:45 XBV00174.VDF : 8.11.196.158 11264 Bytes 18/12/2014 20:21:45 XBV00175.VDF : 8.11.196.160 11776 Bytes 18/12/2014 20:21:45 XBV00176.VDF : 8.11.196.174 8192 Bytes 19/12/2014 20:21:45 XBV00177.VDF : 8.11.196.186 4096 Bytes 19/12/2014 20:21:46 XBV00178.VDF : 8.11.196.198 12800 Bytes 19/12/2014 20:21:46 XBV00179.VDF : 8.11.196.210 2560 Bytes 19/12/2014 20:21:46 XBV00180.VDF : 8.11.196.212 15872 Bytes 19/12/2014 20:21:46 XBV00181.VDF : 8.11.196.214 10240 Bytes 19/12/2014 20:21:46 XBV00182.VDF : 8.11.196.216 2048 Bytes 19/12/2014 20:21:46 XBV00183.VDF : 8.11.196.218 2048 Bytes 19/12/2014 20:21:46 XBV00184.VDF : 8.11.196.222 13824 Bytes 19/12/2014 11:34:45 XBV00185.VDF : 8.11.196.224 2048 Bytes 19/12/2014 11:34:45 XBV00186.VDF : 8.11.196.226 2048 Bytes 19/12/2014 11:34:45 XBV00187.VDF : 8.11.196.230 12288 Bytes 19/12/2014 11:34:45 XBV00188.VDF : 8.11.196.234 12288 Bytes 20/12/2014 11:34:45 XBV00189.VDF : 8.11.196.236 8192 Bytes 20/12/2014 11:34:45 LOCAL001.VDF : 8.11.196.236 117420032 Bytes 20/12/2014 11:35:35 Engine version : 8.3.28.4 AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43 AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06 AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07 AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13 AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02 AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58 AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55 AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09 AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04 AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16 AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40 AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32 AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51 AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08 AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38 AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50 AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47 AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57 AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59 AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48 AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16 SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04 AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03 NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58 RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47 RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47 Configuration settings for the scan: Jobname.............................: AVGuardAsyncScan Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_5499e24a\guard_slideup.avp Reporting...........................: default Primary action......................: Interactive Secondary action....................: Quarantine Scan master boot sector.............: on Scan boot sector....................: off Process scan........................: on Scan registry.......................: off Search for rootkits.................: off Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Limit recursion depth...............: 20 Smart extensions....................: on Macrovirus heuristic................: on File heuristic......................: Complete Deviating risk categories...........: +APPL,+PFS, Start of the scan: Tuesday, December 23th 2014 23:55 The scan of running processes will be started: Scan process 'avscan.exe' - '93' Module(s) have been scanned Scan process 'avcenter.exe' - '100' Module(s) have been scanned Scan process 'unsecapp.exe' - '37' Module(s) have been scanned Scan process 'alg.exe' - '35' Module(s) have been scanned Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned Scan process 'NMIndexingService.exe' - '37' Module(s) have been scanned Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned Scan process 'avshadow.exe' - '20' Module(s) have been scanned Scan process 'firefox.exe' - '116' Module(s) have been scanned Scan process 'wscntfy.exe' - '20' Module(s) have been scanned Scan process 'wmiprvse.exe' - '50' Module(s) have been scanned Scan process 'Avira.OE.ServiceHost.exe' - '128' Module(s) have been scanned Scan process 'ehmsas.exe' - '20' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '54' Module(s) have been scanned Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned Scan process 'svchost.exe' - '48' Module(s) have been scanned Scan process 'c2c_service.exe' - '30' Module(s) have been scanned Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned Scan process 'NBService.exe' - '38' Module(s) have been scanned Scan process 'MDM.EXE' - '22' Module(s) have been scanned Scan process 'WindowsSearch.exe' - '66' Module(s) have been scanned Scan process 'Skype.exe' - '127' Module(s) have been scanned Scan process 'msmsgs.exe' - '42' Module(s) have been scanned Scan process 'NMIndexStoreSvr.exe' - '48' Module(s) have been scanned Scan process 'ctfmon.exe' - '26' Module(s) have been scanned Scan process 'Avira.OE.Systray.exe' - '131' Module(s) have been scanned Scan process 'ehSched.exe' - '40' Module(s) have been scanned Scan process 'TBNotifier.exe' - '65' Module(s) have been scanned Scan process 'brs.exe' - '19' Module(s) have been scanned Scan process 'ehtray.exe' - '39' Module(s) have been scanned Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned Scan process 'pdf24.exe' - '28' Module(s) have been scanned Scan process 'CameraHelperShell.exe' - '52' Module(s) have been scanned Scan process 'PDVD8Serv.exe' - '24' Module(s) have been scanned Scan process '4zsrchmn.exe' - '13' Module(s) have been scanned Scan process '4zbrmon.exe' - '20' Module(s) have been scanned Scan process 'jusched.exe' - '21' Module(s) have been scanned Scan process 'avgnt.exe' - '94' Module(s) have been scanned Scan process 'LWS.exe' - '35' Module(s) have been scanned Scan process 'apnmcp.exe' - '34' Module(s) have been scanned Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned Scan process 'igfxpers.exe' - '23' Module(s) have been scanned Scan process 'hkcmd.exe' - '26' Module(s) have been scanned Scan process 'igfxtray.exe' - '27' Module(s) have been scanned Scan process 'HDeck.exe' - '41' Module(s) have been scanned Scan process 'avguard.exe' - '110' Module(s) have been scanned Scan process 'svchost.exe' - '34' Module(s) have been scanned Scan process 'sched.exe' - '45' Module(s) have been scanned Scan process 'Explorer.EXE' - '134' Module(s) have been scanned Scan process 'spoolsv.exe' - '58' Module(s) have been scanned Scan process 'svchost.exe' - '39' Module(s) have been scanned Scan process 'svchost.exe' - '28' Module(s) have been scanned Scan process 'svchost.exe' - '164' Module(s) have been scanned Scan process 'svchost.exe' - '39' Module(s) have been scanned Scan process 'svchost.exe' - '51' Module(s) have been scanned Scan process 'lsass.exe' - '59' Module(s) have been scanned Scan process 'services.exe' - '27' Module(s) have been scanned Scan process 'winlogon.exe' - '71' Module(s) have been scanned Scan process 'csrss.exe' - '12' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting the file scan: Begin scan in 'C:\Documents and Settings\user\Desktop\find subtitles setup.exe' C:\Documents and Settings\user\Desktop\find subtitles setup.exe [DETECTION] Contains recognition pattern of the APPL/Downware.AK application Beginning disinfection: C:\Documents and Settings\user\Desktop\find subtitles setup.exe [DETECTION] Contains recognition pattern of the APPL/Downware.AK application [WARNING] The file was ignored. End of the scan: Tuesday, December 23th 2014 23:56 Used time: 00:23 Minute(s) The scan has been done completely. 0 Scanned directories 611 Files were scanned 1 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 Files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 610 Files not concerned 0 Archives were scanned 1 Warnings 0 Notes The scan results will be transferred to the Guard. Code:
ATTFilter
Avira Free Antivirus
Report file date: Saturday, December 27th 2014 01:53
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Microsoft Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : USER-5FB402D855
Version information:
BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00
AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30
AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02
LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32
AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31
REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24
REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01
AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58
AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20
AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59
XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11
XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00114.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00115.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00116.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00117.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00118.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00119.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00120.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00121.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00122.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00123.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00124.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00125.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00126.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00127.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00128.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00129.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00130.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00131.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00132.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00133.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00134.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00135.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00136.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00137.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00138.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00139.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00140.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00141.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00142.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00143.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00144.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00145.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00146.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00147.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00148.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00149.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00150.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00151.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00152.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00153.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00154.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00155.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00156.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00157.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00158.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00159.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00160.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00161.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00162.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00163.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00164.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00165.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00166.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00167.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00168.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00169.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00170.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00171.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00172.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00173.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00174.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00175.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00176.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00177.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00178.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00179.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00180.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00181.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00182.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00183.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00184.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00185.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00186.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00187.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00188.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00189.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00190.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00191.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00192.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00193.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00194.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00195.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00196.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00197.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00198.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00199.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00200.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00201.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00202.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00203.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00204.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00205.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00206.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00207.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00208.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00209.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00210.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00211.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00212.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00213.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00214.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00215.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00216.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00217.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00218.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00219.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00220.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00221.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00222.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00223.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00224.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00225.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00226.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00227.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00228.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00229.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00230.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00231.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00232.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00233.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00234.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00235.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00236.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00237.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00238.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00239.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00240.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00241.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00242.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00243.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00244.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00245.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00246.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00247.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00248.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00249.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00250.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00251.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00252.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00253.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00254.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00255.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38
XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02
XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21
XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45
XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45
XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46
XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01
XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01
XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01
XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01
XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01
XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01
XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01
XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01
XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48
XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48
XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48
XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48
XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48
XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24
XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24
XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24
XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59
XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59
XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59
XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00
XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00
XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00
XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06
XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06
XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06
XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06
XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06
XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06
XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07
XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07
XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07
XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39
XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40
XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40
XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40
XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40
XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40
XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40
XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40
XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40
XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41
XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41
XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41
XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41
XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41
XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41
XBV00090.VDF : 8.11.197.100 1426944 Bytes 23/12/2014 21:59:28
XBV00091.VDF : 8.11.197.116 5120 Bytes 23/12/2014 21:59:28
XBV00092.VDF : 8.11.197.134 22016 Bytes 23/12/2014 21:59:28
XBV00093.VDF : 8.11.197.152 21504 Bytes 23/12/2014 21:59:28
XBV00094.VDF : 8.11.197.154 2048 Bytes 23/12/2014 21:59:28
XBV00095.VDF : 8.11.197.156 12288 Bytes 23/12/2014 18:20:14
XBV00096.VDF : 8.11.197.158 8192 Bytes 23/12/2014 18:20:14
XBV00097.VDF : 8.11.197.160 26112 Bytes 24/12/2014 18:20:15
XBV00098.VDF : 8.11.197.162 8192 Bytes 24/12/2014 18:20:15
XBV00099.VDF : 8.11.197.164 20480 Bytes 24/12/2014 18:20:15
XBV00100.VDF : 8.11.197.166 7680 Bytes 24/12/2014 18:20:15
XBV00101.VDF : 8.11.197.170 22016 Bytes 24/12/2014 18:20:15
XBV00102.VDF : 8.11.197.172 6144 Bytes 24/12/2014 18:20:15
XBV00103.VDF : 8.11.197.174 6144 Bytes 24/12/2014 18:20:15
XBV00104.VDF : 8.11.197.190 44032 Bytes 25/12/2014 18:20:15
XBV00105.VDF : 8.11.197.204 2048 Bytes 25/12/2014 18:20:15
XBV00106.VDF : 8.11.197.218 16896 Bytes 25/12/2014 18:20:15
XBV00107.VDF : 8.11.197.232 6656 Bytes 25/12/2014 18:20:16
XBV00108.VDF : 8.11.197.248 94208 Bytes 26/12/2014 15:20:24
XBV00109.VDF : 8.11.198.6 12288 Bytes 26/12/2014 15:20:25
XBV00110.VDF : 8.11.198.20 13824 Bytes 26/12/2014 15:20:25
XBV00111.VDF : 8.11.198.36 10752 Bytes 26/12/2014 21:20:29
XBV00112.VDF : 8.11.198.38 2048 Bytes 26/12/2014 21:20:29
XBV00113.VDF : 8.11.198.40 2048 Bytes 26/12/2014 21:20:29
LOCAL001.VDF : 8.11.198.40 117863424 Bytes 26/12/2014 21:21:01
Engine version : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06
AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07
AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13
AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02
AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04
AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16
AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40
AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32
AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51
AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08
AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38
AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50
AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47
AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57
AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59
AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48
AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16
SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04
AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03
NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58
RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47
RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended
Deviating risk categories...........: +APPL,+PFS,
Start of the scan: Saturday, December 27th 2014 01:53
Start scanning boot sectors:
Boot sector 'HDD0(C:)'
[INFO] No virus was found!
Starting search for hidden objects.
The scan of running processes will be started:
Scan process 'rsmsink.exe' - '28' Module(s) have been scanned
Scan process 'logon.scr' - '18' Module(s) have been scanned
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '60' Module(s) have been scanned
Scan process 'dllhost.exe' - '45' Module(s) have been scanned
Scan process 'vssvc.exe' - '48' Module(s) have been scanned
Scan process 'avscan.exe' - '99' Module(s) have been scanned
Scan process 'alg.exe' - '35' Module(s) have been scanned
Scan process 'unsecapp.exe' - '37' Module(s) have been scanned
Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '37' Module(s) have been scanned
Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned
Scan process 'avshadow.exe' - '26' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '61' Module(s) have been scanned
Scan process 'ehmsas.exe' - '20' Module(s) have been scanned
Scan process 'Avira.OE.ServiceHost.exe' - '130' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '54' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'c2c_service.exe' - '30' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned
Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned
Scan process 'NBService.exe' - '38' Module(s) have been scanned
Scan process 'MDM.EXE' - '22' Module(s) have been scanned
Scan process 'ehSched.exe' - '40' Module(s) have been scanned
Scan process 'apnmcp.exe' - '37' Module(s) have been scanned
Scan process 'WindowsSearch.exe' - '65' Module(s) have been scanned
Scan process 'avguard.exe' - '111' Module(s) have been scanned
Scan process 'Skype.exe' - '128' Module(s) have been scanned
Scan process 'msmsgs.exe' - '42' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '48' Module(s) have been scanned
Scan process 'ctfmon.exe' - '25' Module(s) have been scanned
Scan process 'Avira.OE.Systray.exe' - '132' Module(s) have been scanned
Scan process 'TBNotifier.exe' - '67' Module(s) have been scanned
Scan process 'brs.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '40' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned
Scan process 'pdf24.exe' - '37' Module(s) have been scanned
Scan process 'PDVD8Serv.exe' - '27' Module(s) have been scanned
Scan process '4zbrmon.exe' - '20' Module(s) have been scanned
Scan process 'jusched.exe' - '21' Module(s) have been scanned
Scan process 'avgnt.exe' - '97' Module(s) have been scanned
Scan process 'CameraHelperShell.exe' - '51' Module(s) have been scanned
Scan process 'LWS.exe' - '34' Module(s) have been scanned
Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
Scan process 'igfxpers.exe' - '23' Module(s) have been scanned
Scan process 'hkcmd.exe' - '26' Module(s) have been scanned
Scan process 'igfxtray.exe' - '27' Module(s) have been scanned
Scan process 'HDeck.exe' - '40' Module(s) have been scanned
Scan process 'svchost.exe' - '34' Module(s) have been scanned
Scan process 'Explorer.EXE' - '109' Module(s) have been scanned
Scan process 'sched.exe' - '46' Module(s) have been scanned
Scan process 'spoolsv.exe' - '58' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '175' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '53' Module(s) have been scanned
Scan process 'lsass.exe' - '59' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '78' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting to scan executable files (registry):
The registry was scanned ( '2520' files ).
Starting the file scan:
Begin scan in 'C:\' <Hard disk>
C:\Documents and Settings\user\Desktop\find subtitles setup.exe
[DETECTION] Contains recognition pattern of the APPL/Downware.AK application
[0] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Desktop\Backup\windows media center\Documents and Settings\Ελίζα\Local Settings\Temp\jre-6u21-windows-i586-iftw-rv.exe
[1] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Desktop\Backup\windows xp\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_140002_30267a\Setup.exe
[2] Archive type: RSRC
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u22-windows-i586-iftw-rv.exe
[3] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u23-windows-i586-iftw-rv.exe
[4] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u24-windows-i586-iftw-rv.exe
[5] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u26-windows-i586-iftw-rv.exe
[6] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u29-windows-i586-iftw-rv.exe
[7] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u31-windows-i586-iftw-rv.exe
[8] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u34-windows-i586-iftw.exe
[9] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u35-windows-i586-iftw.exe
[10] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u37-windows-i586-iftw.exe
[11] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-6u39-windows-i586-iftw.exe
[12] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u21-windows-i586-iftw.exe
[13] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u45-windows-i586-iftw.exe
[14] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe
[15] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u55-windows-i586-iftw.exe
[16] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u65-windows-i586-iftw.exe
[17] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\jre-7u67-windows-i586-iftw.exe
[18] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\LimeWireWin.exe
[19] Archive type: NSIS
--> C:\Documents and Settings\user\Local Settings\Temp\ooTE72_i.exe.part
[20] Archive type: Runtime Packed
--> C:\Documents and Settings\user\Local Settings\Temp\UpdateCheckerSetup.exe
[21] Archive type: NSIS
--> ProgramFilesDir/update_checker.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.itz application
[WARNING] Infected files in archives cannot be repaired
C:\Documents and Settings\user\Local Settings\Temp\UpdateCheckerSetup.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.itz application
--> C:\Elisa\Mama\Diadrastika Systimata\How To Download Videos from YouTube\FreeYouTubeDownloaderInstaller.exe
[21] Archive type: NSIS
--> ProgramFilesDir/BetterInstaller.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.Gen2 application
[WARNING] Infected files in archives cannot be repaired
C:\Elisa\Mama\Diadrastika Systimata\How To Download Videos from YouTube\FreeYouTubeDownloaderInstaller.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.Gen2 application
Beginning disinfection:
C:\Elisa\Mama\Diadrastika Systimata\How To Download Videos from YouTube\FreeYouTubeDownloaderInstaller.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.Gen2 application
[NOTE] The file was moved to the quarantine directory under the name '56ed1762.qua'!
C:\Documents and Settings\user\Local Settings\Temp\UpdateCheckerSetup.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.itz application
[NOTE] The file was moved to the quarantine directory under the name '4e7b38c5.qua'!
C:\Documents and Settings\user\Desktop\find subtitles setup.exe
[DETECTION] Contains recognition pattern of the APPL/Downware.AK application
[NOTE] The file was moved to the quarantine directory under the name '1c2a6227.qua'!
End of the scan: Saturday, December 27th 2014 15:24
Used time: 5:10:07 Hour(s)
The scan has been done completely.
17537 Scanned directories
811440 Files were scanned
5 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
3 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
811435 Files not concerned
16078 Archives were scanned
2 Warnings
3 Notes
532628 Objects were scanned with rootkit scan
0 Hidden objects were found
Code:
ATTFilter
Avira Free Antivirus
Report file date: Saturday, December 27th 2014 18:21
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Microsoft Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : USER-5FB402D855
Version information:
BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00
AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30
AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02
LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32
AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31
REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24
REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01
AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58
AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20
AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59
XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11
XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00117.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00118.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00119.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00120.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00121.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00122.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00123.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00124.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00125.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00126.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00127.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00128.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00129.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00130.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00131.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00132.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00133.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00134.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00135.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00136.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00137.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00138.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00139.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00140.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00141.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00142.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00143.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00144.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00145.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00146.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00147.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00148.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00149.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00150.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00151.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00152.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00153.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00154.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00155.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00156.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00157.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00158.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00159.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00160.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00161.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00162.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00163.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00164.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00165.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00166.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00167.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00168.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00169.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00170.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00171.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00172.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00173.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00174.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00175.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00176.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00177.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00178.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00179.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00180.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00181.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00182.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00183.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00184.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00185.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00186.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00187.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00188.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00189.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00190.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00191.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00192.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00193.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00194.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00195.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00196.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00197.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00198.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00199.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00200.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00201.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00202.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00203.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00204.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00205.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00206.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00207.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00208.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00209.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00210.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00211.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00212.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00213.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00214.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00215.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00216.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00217.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00218.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00219.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00220.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00221.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00222.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00223.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00224.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00225.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00226.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00227.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00228.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00229.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00230.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00231.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00232.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00233.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00234.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00235.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00236.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00237.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00238.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00239.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00240.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00241.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00242.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00243.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00244.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00245.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00246.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00247.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00248.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00249.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00250.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00251.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00252.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00253.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00254.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00255.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38
XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02
XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21
XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45
XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45
XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46
XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01
XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01
XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01
XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01
XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01
XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01
XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01
XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01
XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48
XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48
XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48
XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48
XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48
XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24
XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24
XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24
XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59
XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59
XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59
XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00
XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00
XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00
XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06
XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06
XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06
XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06
XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06
XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06
XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07
XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07
XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07
XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39
XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40
XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40
XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40
XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40
XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40
XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40
XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40
XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40
XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41
XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41
XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41
XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41
XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41
XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41
XBV00090.VDF : 8.11.197.100 1426944 Bytes 23/12/2014 21:59:28
XBV00091.VDF : 8.11.197.116 5120 Bytes 23/12/2014 21:59:28
XBV00092.VDF : 8.11.197.134 22016 Bytes 23/12/2014 21:59:28
XBV00093.VDF : 8.11.197.152 21504 Bytes 23/12/2014 21:59:28
XBV00094.VDF : 8.11.197.154 2048 Bytes 23/12/2014 21:59:28
XBV00095.VDF : 8.11.197.156 12288 Bytes 23/12/2014 18:20:14
XBV00096.VDF : 8.11.197.158 8192 Bytes 23/12/2014 18:20:14
XBV00097.VDF : 8.11.197.160 26112 Bytes 24/12/2014 18:20:15
XBV00098.VDF : 8.11.197.162 8192 Bytes 24/12/2014 18:20:15
XBV00099.VDF : 8.11.197.164 20480 Bytes 24/12/2014 18:20:15
XBV00100.VDF : 8.11.197.166 7680 Bytes 24/12/2014 18:20:15
XBV00101.VDF : 8.11.197.170 22016 Bytes 24/12/2014 18:20:15
XBV00102.VDF : 8.11.197.172 6144 Bytes 24/12/2014 18:20:15
XBV00103.VDF : 8.11.197.174 6144 Bytes 24/12/2014 18:20:15
XBV00104.VDF : 8.11.197.190 44032 Bytes 25/12/2014 18:20:15
XBV00105.VDF : 8.11.197.204 2048 Bytes 25/12/2014 18:20:15
XBV00106.VDF : 8.11.197.218 16896 Bytes 25/12/2014 18:20:15
XBV00107.VDF : 8.11.197.232 6656 Bytes 25/12/2014 18:20:16
XBV00108.VDF : 8.11.197.248 94208 Bytes 26/12/2014 15:20:24
XBV00109.VDF : 8.11.198.6 12288 Bytes 26/12/2014 15:20:25
XBV00110.VDF : 8.11.198.20 13824 Bytes 26/12/2014 15:20:25
XBV00111.VDF : 8.11.198.36 10752 Bytes 26/12/2014 21:20:29
XBV00112.VDF : 8.11.198.38 2048 Bytes 26/12/2014 21:20:29
XBV00113.VDF : 8.11.198.40 2048 Bytes 26/12/2014 21:20:29
XBV00114.VDF : 8.11.198.54 108544 Bytes 27/12/2014 15:21:36
XBV00115.VDF : 8.11.198.56 2048 Bytes 27/12/2014 15:21:36
XBV00116.VDF : 8.11.198.70 23552 Bytes 27/12/2014 15:21:36
LOCAL000.VDF : 8.11.198.70 117995008 Bytes 27/12/2014 15:23:20
Engine version : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06
AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07
AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13
AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02
AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04
AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16
AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40
AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32
AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51
AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08
AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38
AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50
AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47
AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57
AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59
AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48
AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16
SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04
AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03
NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58
RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47
RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47
Configuration settings for the scan:
Jobname.............................: AVGuardAsyncScan
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_549d26be\guard_slideup.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: Complete
Deviating risk categories...........: +APPL,+PFS,
Start of the scan: Saturday, December 27th 2014 18:21
The scan of running processes will be started:
Scan process 'avscan.exe' - '93' Module(s) have been scanned
Scan process 'mbam.exe' - '65' Module(s) have been scanned
Scan process 'mbamscheduler.exe' - '31' Module(s) have been scanned
Scan process 'mbamservice.exe' - '47' Module(s) have been scanned
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '60' Module(s) have been scanned
Scan process 'alg.exe' - '35' Module(s) have been scanned
Scan process 'unsecapp.exe' - '37' Module(s) have been scanned
Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '37' Module(s) have been scanned
Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned
Scan process 'avshadow.exe' - '26' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '61' Module(s) have been scanned
Scan process 'ehmsas.exe' - '20' Module(s) have been scanned
Scan process 'Avira.OE.ServiceHost.exe' - '131' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '56' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'c2c_service.exe' - '30' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned
Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned
Scan process 'NBService.exe' - '38' Module(s) have been scanned
Scan process 'MDM.EXE' - '22' Module(s) have been scanned
Scan process 'ehSched.exe' - '40' Module(s) have been scanned
Scan process 'apnmcp.exe' - '37' Module(s) have been scanned
Scan process 'WindowsSearch.exe' - '65' Module(s) have been scanned
Scan process 'avguard.exe' - '112' Module(s) have been scanned
Scan process 'Skype.exe' - '129' Module(s) have been scanned
Scan process 'msmsgs.exe' - '42' Module(s) have been scanned
Scan process 'ctfmon.exe' - '25' Module(s) have been scanned
Scan process 'Avira.OE.Systray.exe' - '131' Module(s) have been scanned
Scan process 'TBNotifier.exe' - '69' Module(s) have been scanned
Scan process 'brs.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '40' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned
Scan process 'pdf24.exe' - '37' Module(s) have been scanned
Scan process 'PDVD8Serv.exe' - '27' Module(s) have been scanned
Scan process '4zbrmon.exe' - '20' Module(s) have been scanned
Scan process 'jusched.exe' - '21' Module(s) have been scanned
Scan process 'avgnt.exe' - '98' Module(s) have been scanned
Scan process 'CameraHelperShell.exe' - '51' Module(s) have been scanned
Scan process 'LWS.exe' - '34' Module(s) have been scanned
Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
Scan process 'igfxpers.exe' - '23' Module(s) have been scanned
Scan process 'hkcmd.exe' - '26' Module(s) have been scanned
Scan process 'igfxtray.exe' - '27' Module(s) have been scanned
Scan process 'HDeck.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '34' Module(s) have been scanned
Scan process 'Explorer.EXE' - '156' Module(s) have been scanned
Scan process 'sched.exe' - '46' Module(s) have been scanned
Scan process 'spoolsv.exe' - '58' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '172' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '53' Module(s) have been scanned
Scan process 'lsass.exe' - '59' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '78' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting the file scan:
Begin scan in 'C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165838.exe'
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165838.exe
[0] Archive type: NSIS
--> ProgramFilesDir/BetterInstaller.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.Gen2 application
[WARNING] Infected files in archives cannot be repaired
Beginning disinfection:
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165838.exe
[DETECTION] Contains recognition pattern of the APPL/Somoto.Gen2 application
[NOTE] The file was moved to the quarantine directory under the name '57787a99.qua'!
End of the scan: Saturday, December 27th 2014 18:28
Used time: 04:10 Minute(s)
The scan has been done completely.
0 Scanned directories
619 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
618 Files not concerned
2 Archives were scanned
1 Warnings
1 Notes
The scan results will be transferred to the Guard.
Code:
ATTFilter
Avira Free Antivirus
Report file date: Saturday, December 27th 2014 19:58
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Microsoft Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : USER-5FB402D855
Version information:
BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00
AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30
AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02
LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32
AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31
REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24
REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01
AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58
AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20
AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59
XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11
XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00117.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00118.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00119.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00120.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00121.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00122.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00123.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00124.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00125.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00126.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00127.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00128.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00129.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00130.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00131.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00132.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00133.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00134.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00135.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00136.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00137.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00138.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00139.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00140.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00141.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00142.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00143.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00144.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00145.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00146.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00147.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00148.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00149.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00150.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00151.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00152.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00153.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00154.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00155.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00156.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00157.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00158.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00159.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00160.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00161.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00162.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00163.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00164.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00165.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00166.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00167.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00168.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00169.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00170.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00171.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00172.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00173.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00174.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00175.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00176.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00177.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00178.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00179.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00180.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00181.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00182.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00183.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00184.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00185.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00186.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00187.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00188.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00189.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00190.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00191.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00192.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00193.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00194.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00195.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00196.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00197.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00198.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00199.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00200.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00201.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00202.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00203.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00204.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00205.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00206.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00207.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00208.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00209.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00210.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00211.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00212.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00213.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00214.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00215.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00216.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00217.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00218.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00219.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00220.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00221.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00222.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00223.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00224.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00225.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00226.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00227.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00228.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00229.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00230.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00231.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00232.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00233.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00234.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00235.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00236.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00237.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00238.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00239.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00240.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00241.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00242.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00243.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00244.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00245.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00246.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00247.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00248.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00249.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00250.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00251.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00252.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00253.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00254.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00255.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38
XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02
XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21
XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45
XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45
XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46
XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01
XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01
XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01
XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01
XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01
XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01
XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01
XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01
XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48
XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48
XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48
XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48
XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48
XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24
XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24
XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24
XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59
XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59
XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59
XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00
XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00
XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00
XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06
XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06
XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06
XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06
XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06
XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06
XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07
XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07
XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07
XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39
XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40
XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40
XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40
XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40
XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40
XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40
XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40
XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40
XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41
XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41
XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41
XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41
XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41
XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41
XBV00090.VDF : 8.11.197.100 1426944 Bytes 23/12/2014 21:59:28
XBV00091.VDF : 8.11.197.116 5120 Bytes 23/12/2014 21:59:28
XBV00092.VDF : 8.11.197.134 22016 Bytes 23/12/2014 21:59:28
XBV00093.VDF : 8.11.197.152 21504 Bytes 23/12/2014 21:59:28
XBV00094.VDF : 8.11.197.154 2048 Bytes 23/12/2014 21:59:28
XBV00095.VDF : 8.11.197.156 12288 Bytes 23/12/2014 18:20:14
XBV00096.VDF : 8.11.197.158 8192 Bytes 23/12/2014 18:20:14
XBV00097.VDF : 8.11.197.160 26112 Bytes 24/12/2014 18:20:15
XBV00098.VDF : 8.11.197.162 8192 Bytes 24/12/2014 18:20:15
XBV00099.VDF : 8.11.197.164 20480 Bytes 24/12/2014 18:20:15
XBV00100.VDF : 8.11.197.166 7680 Bytes 24/12/2014 18:20:15
XBV00101.VDF : 8.11.197.170 22016 Bytes 24/12/2014 18:20:15
XBV00102.VDF : 8.11.197.172 6144 Bytes 24/12/2014 18:20:15
XBV00103.VDF : 8.11.197.174 6144 Bytes 24/12/2014 18:20:15
XBV00104.VDF : 8.11.197.190 44032 Bytes 25/12/2014 18:20:15
XBV00105.VDF : 8.11.197.204 2048 Bytes 25/12/2014 18:20:15
XBV00106.VDF : 8.11.197.218 16896 Bytes 25/12/2014 18:20:15
XBV00107.VDF : 8.11.197.232 6656 Bytes 25/12/2014 18:20:16
XBV00108.VDF : 8.11.197.248 94208 Bytes 26/12/2014 15:20:24
XBV00109.VDF : 8.11.198.6 12288 Bytes 26/12/2014 15:20:25
XBV00110.VDF : 8.11.198.20 13824 Bytes 26/12/2014 15:20:25
XBV00111.VDF : 8.11.198.36 10752 Bytes 26/12/2014 21:20:29
XBV00112.VDF : 8.11.198.38 2048 Bytes 26/12/2014 21:20:29
XBV00113.VDF : 8.11.198.40 2048 Bytes 26/12/2014 21:20:29
XBV00114.VDF : 8.11.198.54 108544 Bytes 27/12/2014 15:21:36
XBV00115.VDF : 8.11.198.56 2048 Bytes 27/12/2014 15:21:36
XBV00116.VDF : 8.11.198.70 23552 Bytes 27/12/2014 15:21:36
LOCAL000.VDF : 8.11.198.70 117995008 Bytes 27/12/2014 15:23:20
Engine version : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06
AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07
AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13
AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02
AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04
AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16
AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40
AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32
AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51
AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08
AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38
AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50
AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47
AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57
AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59
AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48
AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16
SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04
AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03
NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58
RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47
RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47
Configuration settings for the scan:
Jobname.............................: AVGuardAsyncScan
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_549d26be\guard_slideup.avp
Reporting...........................: default
Primary action......................: Repair
Secondary action....................: Quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: Complete
Deviating risk categories...........: +APPL,+PFS,
Start of the scan: Saturday, December 27th 2014 19:58
The scan of running processes will be started:
Scan process 'mmc.exe' - '47' Module(s) have been scanned
Scan process 'avscan.exe' - '93' Module(s) have been scanned
Scan process 'rundll32.exe' - '65' Module(s) have been scanned
Scan process 'mbam.exe' - '70' Module(s) have been scanned
Scan process 'mbamscheduler.exe' - '31' Module(s) have been scanned
Scan process 'mbamservice.exe' - '47' Module(s) have been scanned
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '60' Module(s) have been scanned
Scan process 'alg.exe' - '35' Module(s) have been scanned
Scan process 'unsecapp.exe' - '37' Module(s) have been scanned
Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '37' Module(s) have been scanned
Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned
Scan process 'avshadow.exe' - '26' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '61' Module(s) have been scanned
Scan process 'ehmsas.exe' - '20' Module(s) have been scanned
Scan process 'Avira.OE.ServiceHost.exe' - '146' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '56' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'c2c_service.exe' - '30' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned
Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned
Scan process 'NBService.exe' - '38' Module(s) have been scanned
Scan process 'MDM.EXE' - '22' Module(s) have been scanned
Scan process 'ehSched.exe' - '40' Module(s) have been scanned
Scan process 'apnmcp.exe' - '37' Module(s) have been scanned
Scan process 'WindowsSearch.exe' - '65' Module(s) have been scanned
Scan process 'avguard.exe' - '112' Module(s) have been scanned
Scan process 'Skype.exe' - '129' Module(s) have been scanned
Scan process 'msmsgs.exe' - '42' Module(s) have been scanned
Scan process 'ctfmon.exe' - '25' Module(s) have been scanned
Scan process 'Avira.OE.Systray.exe' - '131' Module(s) have been scanned
Scan process 'TBNotifier.exe' - '69' Module(s) have been scanned
Scan process 'brs.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '40' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned
Scan process 'pdf24.exe' - '37' Module(s) have been scanned
Scan process 'PDVD8Serv.exe' - '27' Module(s) have been scanned
Scan process '4zbrmon.exe' - '20' Module(s) have been scanned
Module is infected -> <C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe>
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] Process '4zbrmon.exe' was terminated
[NOTE] The file could not be copied to quarantine!
[NOTE] The file does not exist!
Module is infected -> <C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll>
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file could not be copied to quarantine!
[NOTE] The file does not exist!
Scan process 'jusched.exe' - '21' Module(s) have been scanned
Scan process 'avgnt.exe' - '98' Module(s) have been scanned
Scan process 'CameraHelperShell.exe' - '51' Module(s) have been scanned
Scan process 'LWS.exe' - '34' Module(s) have been scanned
Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
Scan process 'igfxpers.exe' - '23' Module(s) have been scanned
Scan process 'hkcmd.exe' - '26' Module(s) have been scanned
Scan process 'igfxtray.exe' - '27' Module(s) have been scanned
Scan process 'HDeck.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '34' Module(s) have been scanned
Scan process 'Explorer.EXE' - '151' Module(s) have been scanned
Module is OK -> <C:\WINDOWS\Explorer.EXE>
[NOTE] Process 'explorer.exe' was terminated
Module is infected -> <C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll>
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] It is recommended to restart your computer in order to finish the repair.
[NOTE] The file was moved to the quarantine directory under the name '0d9e5bc2.qua'!
Scan process 'sched.exe' - '46' Module(s) have been scanned
Scan process 'spoolsv.exe' - '58' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '172' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '53' Module(s) have been scanned
Scan process 'lsass.exe' - '59' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '78' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Scan process 'rsmsink.exe' - '28' Module(s) have been scanned
Scan process 'explorer.exe' - '84' Module(s) have been scanned
Scan process 'dllhost.exe' - '45' Module(s) have been scanned
Scan process 'vssvc.exe' - '48' Module(s) have been scanned
Scan process 'firefox.exe' - '92' Module(s) have been scanned
End of the scan: Saturday, December 27th 2014 20:10
Used time: 11:49 Minute(s)
The scan has been done completely.
0 Scanned directories
3512 Files were scanned
3 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
3 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
3509 Files not concerned
44 Archives were scanned
0 Warnings
4 Notes
|
|
28.12.2014, 18:14
| #4 |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Avira Anti-Vir (Fortsetzung) Code:
ATTFilter
Avira Free Antivirus
Report file date: Saturday, December 27th 2014 20:32
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Microsoft Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : USER-5FB402D855
Version information:
BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00
AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30
AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02
LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32
AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31
REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24
REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01
AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58
AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20
AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59
XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11
XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00117.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00118.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00119.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00120.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00121.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00122.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00123.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00124.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00125.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00126.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00127.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00128.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00129.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00130.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00131.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00132.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00133.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00134.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00135.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00136.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00137.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00138.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00139.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00140.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00141.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00142.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00143.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00144.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00145.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00146.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00147.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00148.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00149.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00150.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00151.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00152.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00153.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00154.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00155.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00156.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00157.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00158.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00159.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00160.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00161.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00162.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00163.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00164.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00165.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00166.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00167.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00168.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00169.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00170.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00171.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00172.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00173.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00174.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00175.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00176.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00177.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00178.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00179.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00180.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00181.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00182.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00183.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00184.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00185.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00186.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00187.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00188.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00189.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00190.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00191.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00192.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00193.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00194.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00195.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00196.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00197.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00198.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00199.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00200.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00201.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00202.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00203.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00204.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00205.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00206.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00207.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00208.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00209.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00210.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00211.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00212.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00213.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00214.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00215.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00216.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00217.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00218.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00219.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00220.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00221.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00222.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00223.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00224.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00225.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00226.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00227.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00228.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00229.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00230.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00231.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00232.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00233.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00234.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00235.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00236.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00237.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00238.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00239.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00240.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00241.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00242.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00243.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00244.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00245.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00246.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00247.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00248.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00249.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00250.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00251.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00252.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00253.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00254.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00255.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38
XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02
XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21
XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45
XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45
XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46
XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01
XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01
XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01
XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01
XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01
XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01
XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01
XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01
XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48
XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48
XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48
XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48
XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48
XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24
XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24
XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24
XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59
XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59
XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59
XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00
XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00
XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00
XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06
XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06
XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06
XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06
XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06
XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06
XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07
XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07
XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07
XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39
XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40
XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40
XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40
XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40
XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40
XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40
XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40
XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40
XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41
XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41
XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41
XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41
XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41
XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41
XBV00090.VDF : 8.11.197.100 1426944 Bytes 23/12/2014 21:59:28
XBV00091.VDF : 8.11.197.116 5120 Bytes 23/12/2014 21:59:28
XBV00092.VDF : 8.11.197.134 22016 Bytes 23/12/2014 21:59:28
XBV00093.VDF : 8.11.197.152 21504 Bytes 23/12/2014 21:59:28
XBV00094.VDF : 8.11.197.154 2048 Bytes 23/12/2014 21:59:28
XBV00095.VDF : 8.11.197.156 12288 Bytes 23/12/2014 18:20:14
XBV00096.VDF : 8.11.197.158 8192 Bytes 23/12/2014 18:20:14
XBV00097.VDF : 8.11.197.160 26112 Bytes 24/12/2014 18:20:15
XBV00098.VDF : 8.11.197.162 8192 Bytes 24/12/2014 18:20:15
XBV00099.VDF : 8.11.197.164 20480 Bytes 24/12/2014 18:20:15
XBV00100.VDF : 8.11.197.166 7680 Bytes 24/12/2014 18:20:15
XBV00101.VDF : 8.11.197.170 22016 Bytes 24/12/2014 18:20:15
XBV00102.VDF : 8.11.197.172 6144 Bytes 24/12/2014 18:20:15
XBV00103.VDF : 8.11.197.174 6144 Bytes 24/12/2014 18:20:15
XBV00104.VDF : 8.11.197.190 44032 Bytes 25/12/2014 18:20:15
XBV00105.VDF : 8.11.197.204 2048 Bytes 25/12/2014 18:20:15
XBV00106.VDF : 8.11.197.218 16896 Bytes 25/12/2014 18:20:15
XBV00107.VDF : 8.11.197.232 6656 Bytes 25/12/2014 18:20:16
XBV00108.VDF : 8.11.197.248 94208 Bytes 26/12/2014 15:20:24
XBV00109.VDF : 8.11.198.6 12288 Bytes 26/12/2014 15:20:25
XBV00110.VDF : 8.11.198.20 13824 Bytes 26/12/2014 15:20:25
XBV00111.VDF : 8.11.198.36 10752 Bytes 26/12/2014 21:20:29
XBV00112.VDF : 8.11.198.38 2048 Bytes 26/12/2014 21:20:29
XBV00113.VDF : 8.11.198.40 2048 Bytes 26/12/2014 21:20:29
XBV00114.VDF : 8.11.198.54 108544 Bytes 27/12/2014 15:21:36
XBV00115.VDF : 8.11.198.56 2048 Bytes 27/12/2014 15:21:36
XBV00116.VDF : 8.11.198.70 23552 Bytes 27/12/2014 15:21:36
LOCAL000.VDF : 8.11.198.70 117995008 Bytes 27/12/2014 15:23:20
Engine version : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06
AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07
AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13
AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02
AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04
AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16
AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40
AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32
AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51
AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08
AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38
AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50
AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47
AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57
AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59
AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48
AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16
SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04
AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03
NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58
RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47
RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\AVSCAN-20141227-201057-53D7AD90.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended
Deviating risk categories...........: +APPL,+PFS,
Start of the scan: Saturday, December 27th 2014 20:32
Start scanning boot sectors:
Boot sector 'HDD0(C:)'
[INFO] No virus was found!
Starting search for hidden objects.
The scan of running processes will be started:
Scan process 'logon.scr' - '14' Module(s) have been scanned
Scan process 'rsmsink.exe' - '28' Module(s) have been scanned
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '60' Module(s) have been scanned
Scan process 'dllhost.exe' - '45' Module(s) have been scanned
Scan process 'vssvc.exe' - '48' Module(s) have been scanned
Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned
Scan process 'unsecapp.exe' - '37' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '28' Module(s) have been scanned
Scan process 'WindowsSearch.exe' - '65' Module(s) have been scanned
Scan process 'avscan.exe' - '99' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '47' Module(s) have been scanned
Scan process 'ehmsas.exe' - '20' Module(s) have been scanned
Scan process 'Skype.exe' - '128' Module(s) have been scanned
Scan process 'msmsgs.exe' - '42' Module(s) have been scanned
Scan process 'ctfmon.exe' - '25' Module(s) have been scanned
Scan process 'Avira.OE.Systray.exe' - '126' Module(s) have been scanned
Scan process 'CameraHelperShell.exe' - '51' Module(s) have been scanned
Scan process 'TBNotifier.exe' - '67' Module(s) have been scanned
Scan process 'brs.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '39' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned
Scan process 'pdf24.exe' - '28' Module(s) have been scanned
Scan process 'PDVD8Serv.exe' - '24' Module(s) have been scanned
Scan process 'jusched.exe' - '21' Module(s) have been scanned
Scan process 'avgnt.exe' - '97' Module(s) have been scanned
Scan process 'LWS.exe' - '35' Module(s) have been scanned
Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
Scan process 'igfxpers.exe' - '23' Module(s) have been scanned
Scan process 'hkcmd.exe' - '26' Module(s) have been scanned
Scan process 'igfxtray.exe' - '27' Module(s) have been scanned
Scan process 'HDeck.exe' - '39' Module(s) have been scanned
Scan process 'alg.exe' - '31' Module(s) have been scanned
Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned
Scan process 'avshadow.exe' - '26' Module(s) have been scanned
Scan process 'Avira.OE.ServiceHost.exe' - '131' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '54' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
Scan process 'svchost.exe' - '38' Module(s) have been scanned
Scan process 'c2c_service.exe' - '30' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned
Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned
Scan process 'mbam.exe' - '61' Module(s) have been scanned
Scan process 'NBService.exe' - '38' Module(s) have been scanned
Scan process 'MDM.EXE' - '22' Module(s) have been scanned
Scan process 'mbamservice.exe' - '42' Module(s) have been scanned
Scan process 'mbamscheduler.exe' - '31' Module(s) have been scanned
Scan process 'ehSched.exe' - '40' Module(s) have been scanned
Scan process 'apnmcp.exe' - '24' Module(s) have been scanned
Scan process 'avguard.exe' - '111' Module(s) have been scanned
Scan process 'Explorer.EXE' - '86' Module(s) have been scanned
Scan process 'svchost.exe' - '34' Module(s) have been scanned
Scan process 'sched.exe' - '45' Module(s) have been scanned
Scan process 'spoolsv.exe' - '58' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '167' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '51' Module(s) have been scanned
Scan process 'lsass.exe' - '59' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '71' Module(s) have been scanned
Scan process 'csrss.exe' - '13' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting to scan executable files (registry):
The registry was scanned ( '2597' files ).
Starting the file scan:
Begin scan in 'C:\' <Hard disk>
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165841.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165842.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165843.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165844.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165845.DLL
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165846.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165848.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165849.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165850.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165851.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165852.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165853.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165854.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165855.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165856.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165857.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165858.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165859.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165860.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165861.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165862.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165863.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165864.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165865.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165866.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165867.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165868.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165869.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165870.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165871.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165873.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165874.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165875.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165876.DLL
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165877.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165878.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165881.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165882.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165883.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
Beginning disinfection:
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165883.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '55dcf1af.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165882.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '4d4bde09.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165881.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '1f1484e1.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165878.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '7923cb20.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165877.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '3ca7e61e.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165876.DLL
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '43bcd47f.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165875.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '0f04f835.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165874.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '731cb863.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165873.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '5e46972f.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165871.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '472eacb6.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165870.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '2b728086.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165869.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '5acbb913.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165868.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '54d189d4.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165867.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '11f8f096.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165866.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '18f3f43c.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165865.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '40b2ed55.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165864.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '6c469496.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165863.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '52b8f44c.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165862.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '31b6df3e.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165861.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '177e9f23.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165860.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '25eae486.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165859.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '2fafcffb.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165858.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '10fcabbe.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165857.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '6ed0a799.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165856.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '3ba8a352.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165855.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '363ed27a.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165854.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '2a63c673.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165853.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '1bb08bbc.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165852.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '77e69f8a.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165851.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '3e7cba8d.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165850.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '65e9b25c.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165849.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '035bbeb5.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165848.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '54d5cc1d.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165846.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '76a59b6e.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165845.DLL
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '1eb5e1f8.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165844.DLL
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '3ec3e57d.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165843.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '6be7a3c8.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165842.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to the quarantine directory under the name '0ac78277.qua'!
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165841.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '6f6bc0ff.qua'!
End of the scan: Sunday, December 28th 2014 02:55
Used time: 2:14:00 Hour(s)
The scan has been done completely.
17513 Scanned directories
812599 Files were scanned
39 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
39 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
812560 Files not concerned
16180 Archives were scanned
0 Warnings
39 Notes
534671 Objects were scanned with rootkit scan
0 Hidden objects were found
Code:
ATTFilter
Avira Free Antivirus
Report file date: Sunday, December 28th 2014 02:56
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Microsoft Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : USER-5FB402D855
Version information:
BUILD.DAT : 14.0.7.468 91859 Bytes 24/11/2014 10:23:00
AVSCAN.EXE : 14.0.7.462 1015544 Bytes 19/12/2014 20:20:30
AVSCANRC.DLL : 14.0.7.308 54576 Bytes 18/11/2014 20:51:02
LUKE.DLL : 14.0.7.462 60664 Bytes 19/12/2014 20:21:32
AVSCPLR.DLL : 14.0.7.440 93488 Bytes 19/12/2014 20:20:31
REPAIR.DLL : 14.0.7.412 366328 Bytes 19/12/2014 20:20:24
REPAIR.RDF : 1.0.2.30 596694 Bytes 24/10/2014 18:26:01
AVREG.DLL : 14.0.7.310 264952 Bytes 18/11/2014 20:50:58
AVLODE.DLL : 14.0.7.440 561456 Bytes 19/12/2014 20:20:20
AVLODE.RDF : 14.0.4.54 78895 Bytes 6/12/2014 07:45:59
XBV00013.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:11
XBV00014.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00015.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00016.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00017.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00018.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00019.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00020.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00021.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00022.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00023.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:12
XBV00024.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00025.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00026.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00027.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00028.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00029.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00030.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00031.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00032.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00033.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00034.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00035.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00036.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:13
XBV00037.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 7/8/2014 14:39:14
XBV00117.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00118.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00119.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00120.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:28
XBV00121.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00122.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00123.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00124.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00125.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00126.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00127.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00128.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00129.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00130.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00131.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00132.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00133.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00134.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00135.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00136.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00137.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00138.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00139.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00140.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00141.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00142.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00143.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00144.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00145.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00146.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00147.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00148.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00149.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00150.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00151.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00152.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00153.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00154.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00155.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00156.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00157.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00158.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00159.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00160.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:29
XBV00161.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00162.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00163.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00164.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00165.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00166.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00167.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00168.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00169.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00170.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00171.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00172.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00173.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00174.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00175.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00176.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00177.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00178.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00179.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00180.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00181.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00182.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00183.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00184.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00185.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00186.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00187.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00188.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00189.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00190.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00191.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00192.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00193.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00194.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00195.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00196.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00197.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00198.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00199.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00200.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00201.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:30
XBV00202.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00203.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00204.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00205.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00206.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00207.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00208.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00209.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00210.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00211.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00212.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00213.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00214.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00215.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00216.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00217.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00218.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00219.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00220.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00221.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00222.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00223.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00224.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00225.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00226.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00227.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00228.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00229.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00230.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:31
XBV00231.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00232.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00233.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00234.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00235.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00236.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00237.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00238.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00239.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00240.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00241.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00242.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00243.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00244.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00245.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00246.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00247.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00248.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00249.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00250.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00251.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00252.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00253.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00254.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00255.VDF : 8.11.197.100 2048 Bytes 23/12/2014 21:59:32
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 17:02:44
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30/4/2013 12:38:04
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28/5/2013 13:50:27
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21/6/2013 12:45:42
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23/7/2013 18:34:41
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29/8/2013 18:19:10
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27/3/2014 11:34:38
XBV00007.VDF : 7.11.152.100 4193792 Bytes 2/6/2014 20:05:02
XBV00008.VDF : 8.11.165.192 4251136 Bytes 7/8/2014 14:39:11
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15/9/2014 06:00:51
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14/10/2014 18:20:59
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11/11/2014 09:46:21
XBV00012.VDF : 8.11.190.32 1876992 Bytes 3/12/2014 14:20:45
XBV00042.VDF : 8.11.190.56 35840 Bytes 3/12/2014 14:20:45
XBV00043.VDF : 8.11.192.58 2048 Bytes 3/12/2014 14:20:46
XBV00044.VDF : 8.11.192.86 18944 Bytes 3/12/2014 14:12:01
XBV00045.VDF : 8.11.192.110 7680 Bytes 3/12/2014 14:12:01
XBV00046.VDF : 8.11.192.134 5120 Bytes 3/12/2014 14:12:01
XBV00047.VDF : 8.11.192.138 9216 Bytes 3/12/2014 14:12:01
XBV00048.VDF : 8.11.192.140 4608 Bytes 4/12/2014 14:12:01
XBV00049.VDF : 8.11.192.144 8192 Bytes 4/12/2014 14:12:01
XBV00050.VDF : 8.11.192.146 20480 Bytes 4/12/2014 14:12:01
XBV00051.VDF : 8.11.192.148 19456 Bytes 4/12/2014 14:12:01
XBV00052.VDF : 8.11.192.152 12800 Bytes 4/12/2014 20:10:48
XBV00053.VDF : 8.11.192.154 5120 Bytes 4/12/2014 20:10:48
XBV00054.VDF : 8.11.192.158 2048 Bytes 4/12/2014 20:10:48
XBV00055.VDF : 8.11.192.160 2048 Bytes 4/12/2014 20:10:48
XBV00056.VDF : 8.11.192.162 2048 Bytes 4/12/2014 20:10:48
XBV00057.VDF : 8.11.192.166 8192 Bytes 4/12/2014 07:20:24
XBV00058.VDF : 8.11.192.168 6144 Bytes 5/12/2014 07:20:24
XBV00059.VDF : 8.11.192.172 6144 Bytes 5/12/2014 07:20:24
XBV00060.VDF : 8.11.192.236 24064 Bytes 5/12/2014 07:45:59
XBV00061.VDF : 8.11.192.238 2048 Bytes 5/12/2014 07:45:59
XBV00062.VDF : 8.11.193.22 11776 Bytes 5/12/2014 07:45:59
XBV00063.VDF : 8.11.193.42 29696 Bytes 6/12/2014 07:40:00
XBV00064.VDF : 8.11.193.66 41472 Bytes 6/12/2014 07:40:00
XBV00065.VDF : 8.11.193.68 2048 Bytes 6/12/2014 07:40:00
XBV00066.VDF : 8.11.193.70 37888 Bytes 7/12/2014 14:22:06
XBV00067.VDF : 8.11.193.76 13824 Bytes 7/12/2014 14:22:06
XBV00068.VDF : 8.11.193.78 31744 Bytes 8/12/2014 14:22:06
XBV00069.VDF : 8.11.193.98 2048 Bytes 8/12/2014 14:22:06
XBV00070.VDF : 8.11.193.118 7680 Bytes 8/12/2014 14:22:06
XBV00071.VDF : 8.11.193.138 3584 Bytes 8/12/2014 14:22:06
XBV00072.VDF : 8.11.193.158 24064 Bytes 8/12/2014 14:22:07
XBV00073.VDF : 8.11.193.160 2048 Bytes 8/12/2014 14:22:07
XBV00074.VDF : 8.11.193.162 2048 Bytes 8/12/2014 14:22:07
XBV00075.VDF : 8.11.193.168 2560 Bytes 8/12/2014 15:31:39
XBV00076.VDF : 8.11.193.170 2048 Bytes 8/12/2014 15:31:40
XBV00077.VDF : 8.11.193.172 2048 Bytes 8/12/2014 15:31:40
XBV00078.VDF : 8.11.193.174 31232 Bytes 8/12/2014 15:31:40
XBV00079.VDF : 8.11.193.176 2048 Bytes 8/12/2014 15:31:40
XBV00080.VDF : 8.11.193.180 14336 Bytes 9/12/2014 15:31:40
XBV00081.VDF : 8.11.193.184 8192 Bytes 9/12/2014 15:31:40
XBV00082.VDF : 8.11.193.188 10240 Bytes 9/12/2014 15:31:40
XBV00083.VDF : 8.11.193.190 4096 Bytes 9/12/2014 15:31:40
XBV00084.VDF : 8.11.193.192 5120 Bytes 9/12/2014 15:31:41
XBV00085.VDF : 8.11.193.194 7680 Bytes 9/12/2014 15:31:41
XBV00086.VDF : 8.11.193.196 9216 Bytes 9/12/2014 15:31:41
XBV00087.VDF : 8.11.193.198 2048 Bytes 9/12/2014 15:31:41
XBV00088.VDF : 8.11.193.202 25088 Bytes 9/12/2014 15:31:41
XBV00089.VDF : 8.11.193.208 63488 Bytes 9/12/2014 15:31:41
XBV00090.VDF : 8.11.197.100 1426944 Bytes 23/12/2014 21:59:28
XBV00091.VDF : 8.11.197.116 5120 Bytes 23/12/2014 21:59:28
XBV00092.VDF : 8.11.197.134 22016 Bytes 23/12/2014 21:59:28
XBV00093.VDF : 8.11.197.152 21504 Bytes 23/12/2014 21:59:28
XBV00094.VDF : 8.11.197.154 2048 Bytes 23/12/2014 21:59:28
XBV00095.VDF : 8.11.197.156 12288 Bytes 23/12/2014 18:20:14
XBV00096.VDF : 8.11.197.158 8192 Bytes 23/12/2014 18:20:14
XBV00097.VDF : 8.11.197.160 26112 Bytes 24/12/2014 18:20:15
XBV00098.VDF : 8.11.197.162 8192 Bytes 24/12/2014 18:20:15
XBV00099.VDF : 8.11.197.164 20480 Bytes 24/12/2014 18:20:15
XBV00100.VDF : 8.11.197.166 7680 Bytes 24/12/2014 18:20:15
XBV00101.VDF : 8.11.197.170 22016 Bytes 24/12/2014 18:20:15
XBV00102.VDF : 8.11.197.172 6144 Bytes 24/12/2014 18:20:15
XBV00103.VDF : 8.11.197.174 6144 Bytes 24/12/2014 18:20:15
XBV00104.VDF : 8.11.197.190 44032 Bytes 25/12/2014 18:20:15
XBV00105.VDF : 8.11.197.204 2048 Bytes 25/12/2014 18:20:15
XBV00106.VDF : 8.11.197.218 16896 Bytes 25/12/2014 18:20:15
XBV00107.VDF : 8.11.197.232 6656 Bytes 25/12/2014 18:20:16
XBV00108.VDF : 8.11.197.248 94208 Bytes 26/12/2014 15:20:24
XBV00109.VDF : 8.11.198.6 12288 Bytes 26/12/2014 15:20:25
XBV00110.VDF : 8.11.198.20 13824 Bytes 26/12/2014 15:20:25
XBV00111.VDF : 8.11.198.36 10752 Bytes 26/12/2014 21:20:29
XBV00112.VDF : 8.11.198.38 2048 Bytes 26/12/2014 21:20:29
XBV00113.VDF : 8.11.198.40 2048 Bytes 26/12/2014 21:20:29
XBV00114.VDF : 8.11.198.54 108544 Bytes 27/12/2014 15:21:36
XBV00115.VDF : 8.11.198.56 2048 Bytes 27/12/2014 15:21:36
XBV00116.VDF : 8.11.198.70 23552 Bytes 27/12/2014 15:21:36
LOCAL000.VDF : 8.11.198.70 117995008 Bytes 27/12/2014 15:23:20
Engine version : 8.3.28.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 22/8/2014 18:18:43
AESCRIPT.DLL : 8.2.2.40 546728 Bytes 19/12/2014 20:20:06
AESCN.DLL : 8.3.2.2 139456 Bytes 2/8/2014 15:24:07
AESBX.DLL : 8.2.20.24 1409224 Bytes 9/5/2014 19:24:13
AERDL.DLL : 8.2.1.16 743328 Bytes 30/10/2014 19:35:02
AEPACK.DLL : 8.4.0.56 789360 Bytes 27/11/2014 14:27:58
AEOFFICE.DLL : 8.3.1.8 350120 Bytes 27/11/2014 14:27:55
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 19/12/2014 20:20:09
AEHEUR.DLL : 8.1.4.1454 7940008 Bytes 19/12/2014 20:20:04
AEHELP.DLL : 8.3.1.0 278728 Bytes 30/5/2014 12:49:16
AEGEN.DLL : 8.1.7.40 456608 Bytes 19/12/2014 20:19:40
AEEXP.DLL : 8.4.2.48 252776 Bytes 25/11/2014 14:12:32
AEEMU.DLL : 8.1.3.4 399264 Bytes 7/8/2014 14:38:51
AEDROID.DLL : 8.4.3.6 850800 Bytes 19/12/2014 20:20:08
AECORE.DLL : 8.3.4.0 243624 Bytes 19/12/2014 20:19:38
AEBB.DLL : 8.1.2.0 60448 Bytes 7/8/2014 14:38:50
AVWINLL.DLL : 14.0.7.308 25904 Bytes 18/11/2014 20:50:47
AVPREF.DLL : 14.0.7.308 52016 Bytes 18/11/2014 20:50:57
AVREP.DLL : 14.0.7.308 220976 Bytes 18/11/2014 20:50:59
AVARKT.DLL : 14.0.7.308 227632 Bytes 18/11/2014 20:50:48
AVEVTLOG.DLL : 14.0.7.440 184112 Bytes 19/12/2014 20:20:16
SQLITE3.DLL : 14.0.7.308 453936 Bytes 18/11/2014 20:52:04
AVSMTP.DLL : 14.0.7.308 79096 Bytes 18/11/2014 20:51:03
NETNT.DLL : 14.0.7.308 15152 Bytes 18/11/2014 20:51:58
RCIMAGE.DLL : 14.0.7.308 4866808 Bytes 18/11/2014 20:50:47
RCTEXT.DLL : 14.0.7.318 75568 Bytes 18/11/2014 20:50:47
Configuration settings for the scan:
Jobname.............................: AVGuardAsyncScan
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_549ef743\guard_slideup.avp
Reporting...........................: default
Primary action......................: Repair
Secondary action....................: Quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: Complete
Deviating risk categories...........: +APPL,+PFS,
Start of the scan: Sunday, December 28th 2014 02:56
The scan of running processes will be started:
Scan process 'avscan.exe' - '93' Module(s) have been scanned
Scan process 'msdtc.exe' - '40' Module(s) have been scanned
Scan process 'dllhost.exe' - '60' Module(s) have been scanned
Scan process 'WPFFontCache_v0400.exe' - '15' Module(s) have been scanned
Scan process 'unsecapp.exe' - '37' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '28' Module(s) have been scanned
Scan process 'WindowsSearch.exe' - '65' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '61' Module(s) have been scanned
Scan process 'ehmsas.exe' - '20' Module(s) have been scanned
Scan process 'Skype.exe' - '128' Module(s) have been scanned
Scan process 'msmsgs.exe' - '42' Module(s) have been scanned
Scan process 'ctfmon.exe' - '25' Module(s) have been scanned
Scan process 'Avira.OE.Systray.exe' - '126' Module(s) have been scanned
Scan process 'CameraHelperShell.exe' - '51' Module(s) have been scanned
Scan process 'TBNotifier.exe' - '67' Module(s) have been scanned
Scan process 'brs.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '39' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '18' Module(s) have been scanned
Scan process 'pdf24.exe' - '28' Module(s) have been scanned
Scan process 'PDVD8Serv.exe' - '24' Module(s) have been scanned
Scan process 'jusched.exe' - '21' Module(s) have been scanned
Scan process 'avgnt.exe' - '98' Module(s) have been scanned
Scan process 'LWS.exe' - '35' Module(s) have been scanned
Scan process 'hpztsb10.exe' - '20' Module(s) have been scanned
Scan process 'hpcmpmgr.exe' - '38' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '23' Module(s) have been scanned
Scan process 'igfxpers.exe' - '23' Module(s) have been scanned
Scan process 'hkcmd.exe' - '26' Module(s) have been scanned
Scan process 'igfxtray.exe' - '27' Module(s) have been scanned
Scan process 'HDeck.exe' - '39' Module(s) have been scanned
Scan process 'alg.exe' - '31' Module(s) have been scanned
Scan process 'AVWEBGRD.EXE' - '47' Module(s) have been scanned
Scan process 'avshadow.exe' - '26' Module(s) have been scanned
Scan process 'Avira.OE.ServiceHost.exe' - '146' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '54' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '15' Module(s) have been scanned
Scan process 'svchost.exe' - '38' Module(s) have been scanned
Scan process 'c2c_service.exe' - '30' Module(s) have been scanned
Scan process 'PsiService_2.exe' - '16' Module(s) have been scanned
Scan process 'IoctlSvc.exe' - '15' Module(s) have been scanned
Scan process 'mbam.exe' - '61' Module(s) have been scanned
Scan process 'NBService.exe' - '38' Module(s) have been scanned
Scan process 'MDM.EXE' - '22' Module(s) have been scanned
Scan process 'mbamservice.exe' - '42' Module(s) have been scanned
Scan process 'mbamscheduler.exe' - '31' Module(s) have been scanned
Scan process 'ehSched.exe' - '40' Module(s) have been scanned
Scan process 'apnmcp.exe' - '24' Module(s) have been scanned
Scan process 'avguard.exe' - '111' Module(s) have been scanned
Scan process 'Explorer.EXE' - '86' Module(s) have been scanned
Scan process 'svchost.exe' - '34' Module(s) have been scanned
Scan process 'sched.exe' - '45' Module(s) have been scanned
Scan process 'spoolsv.exe' - '58' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '167' Module(s) have been scanned
Scan process 'svchost.exe' - '39' Module(s) have been scanned
Scan process 'svchost.exe' - '51' Module(s) have been scanned
Scan process 'lsass.exe' - '59' Module(s) have been scanned
Scan process 'services.exe' - '27' Module(s) have been scanned
Scan process 'winlogon.exe' - '78' Module(s) have been scanned
Scan process 'csrss.exe' - '13' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting the file scan:
Begin scan in 'C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165841.exe'
Search path C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165841.exe could not be opened!
System error [2]: The system cannot find the file specified.
End of the scan: Sunday, December 28th 2014 02:57
Used time: 01:09 Minute(s)
The scan has been done completely.
0 Scanned directories
579 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
579 Files not concerned
1 Archives were scanned
0 Warnings
0 Notes
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 27/12/2014 Scan Time: 7:42:53 pm Logfile: mbam scan 27120742.txt Administrator: Yes Version: 0.00.0.0000 Malware Database: v2014.12.27.06 Rootkit Database: v2014.12.23.02 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Enabled OS: Windows XP Service Pack 3 CPU: x86 File System: NTFS User: user Scan Type: Custom Scan Result: Completed Objects Scanned: 456353 Time Elapsed: 4 hr, 1 min, 27 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Warn PUM: Warn Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 27/12/2014 3:33:01 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Starting, Protection, 27/12/2014 3:33:01 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Started, Protection, 27/12/2014 3:33:01 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 3:33:12 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 27/12/2014 3:33:14 pm, SYSTEM, USER-5FB402D855, Manual, Rootkit Database, 2014.11.18.1, 2014.12.23.2, Update, 27/12/2014 3:33:14 pm, SYSTEM, USER-5FB402D855, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, Update, 27/12/2014 3:33:41 pm, SYSTEM, USER-5FB402D855, Manual, Malware Database, 2014.11.20.6, 2014.12.27.4, Protection, 27/12/2014 3:33:41 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 27/12/2014 3:33:41 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 27/12/2014 3:33:42 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 27/12/2014 3:33:53 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 27/12/2014 3:33:53 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 3:34:06 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Detection, 27/12/2014 3:39:55 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, Quarantine Failed, 5, Access is denied. , [0dc3a7c00b712f070c66e84657ac22de] Detection, 27/12/2014 3:40:56 pm, user, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\T8RES.DLL, Quarantine Failed, 5, Access is denied. , [bb15db8c4b31bc7ab7bb7eb0f80b837d] Detection, 27/12/2014 3:56:26 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, Quarantine Failed, 5, Access is denied. , [0dc3a7c00b712f070c66e84657ac22de] Detection, 27/12/2014 6:12:50 pm, user, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, Quarantine Failed, 5, Access is denied. , [0dc3a7c00b712f070c66e84657ac22de] Detection, 27/12/2014 6:13:43 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zhkstub.dll, Quarantine, [696793d43349e0561c5639f57e850ff1] Update, 27/12/2014 6:40:58 pm, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.27.4, 2014.12.27.5, Protection, 27/12/2014 6:40:59 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 27/12/2014 6:41:00 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 27/12/2014 6:41:04 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 27/12/2014 6:49:04 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 27/12/2014 6:49:05 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 6:49:26 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 27/12/2014 7:42:01 pm, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.27.5, 2014.12.27.6, Protection, 27/12/2014 7:42:01 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 27/12/2014 7:42:01 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 27/12/2014 7:42:01 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 27/12/2014 7:42:17 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 27/12/2014 7:42:17 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 7:42:35 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Scan, 27/12/2014 7:50:36 pm, SYSTEM, USER-5FB402D855, Manual, Start:27/12/2014 3:35:24 pm, Duration:4 hr 1 min 27 sec, Custom Scan, Completed, 0 Malware Detections, 376 Non-Malware Detections, Protection, 27/12/2014 7:50:37 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 27/12/2014 7:50:37 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 27/12/2014 7:50:37 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 7:51:00 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Detection, 27/12/2014 7:57:06 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, Quarantine Failed, 5, Access is denied. , [7a588bdcbbc17bbb04d04ce2ce3551af] Detection, 27/12/2014 7:58:15 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, File, PUP.Optional.MindSpark.A, C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub.dll, Quarantine Failed, 5, Access is denied. , [7a588bdcbbc17bbb04d04ce2ce3551af] Protection, 27/12/2014 8:15:18 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Starting, Protection, 27/12/2014 8:15:19 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Started, Protection, 27/12/2014 8:15:19 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 27/12/2014 8:17:23 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 27/12/2014 8:46:49 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 27/12/2014 9:08:03 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 27/12/2014 9:57:39 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 27/12/2014 10:53:10 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 27/12/2014 11:05:56 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 27/12/2014 11:56:24 pm, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 28/12/2014 Scan Time: 3:12:17 am Logfile: mbam scan 28120312.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2014.12.27.08 Rootkit Database: v2014.12.23.02 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Enabled OS: Windows XP Service Pack 3 CPU: x86 File System: NTFS User: user Scan Type: Threat Scan Result: Completed Objects Scanned: 319602 Time Elapsed: 42 min, 43 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 28/12/2014 12:59:53 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 1:43:12 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 2:00:50 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 2:42:44 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 3:04:29 am, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.27.6, 2014.12.27.8, Protection, 28/12/2014 3:04:32 am, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 28/12/2014 3:04:32 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 3:04:43 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 28/12/2014 3:08:06 am, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 28/12/2014 3:08:07 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 3:08:24 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Scan, 28/12/2014 3:55:03 am, SYSTEM, USER-5FB402D855, Manual, Start:28/12/2014 3:12:17 am, Duration:42 min 43 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections, Protection, 28/12/2014 3:55:04 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 3:55:15 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 28/12/2014 3:55:19 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 3:55:48 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 28/12/2014 5:04:56 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 5:53:05 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Protection, 28/12/2014 6:01:28 am, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Stopping, Protection, 28/12/2014 6:01:28 am, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Stopped, Protection, 28/12/2014 6:01:29 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 6:01:29 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Update, 28/12/2014 6:06:07 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 6:52:27 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Update, 28/12/2014 7:04:43 am, SYSTEM, USER-5FB402D855, Scheduler, Failed, Unable to access update server, Protection, 28/12/2014 7:43:09 am, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Starting, Protection, 28/12/2014 7:43:10 am, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Started, Protection, 28/12/2014 7:43:28 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 7:44:07 am, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Protection, 28/12/2014 1:11:25 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Starting, Protection, 28/12/2014 1:11:26 pm, SYSTEM, USER-5FB402D855, Protection, Malware Protection, Started, Protection, 28/12/2014 1:12:04 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 1:12:18 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 28/12/2014 2:09:22 pm, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.27.8, 2014.12.28.5, Protection, 28/12/2014 2:09:25 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 28/12/2014 2:09:26 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 2:09:33 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 28/12/2014 2:13:01 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 28/12/2014 2:13:01 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 2:13:18 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 28/12/2014 2:47:03 pm, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.28.5, 2014.12.28.6, Protection, 28/12/2014 2:47:04 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 28/12/2014 2:47:04 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 2:47:04 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 28/12/2014 2:47:27 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 28/12/2014 2:47:32 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 2:47:58 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, Update, 28/12/2014 4:51:16 pm, SYSTEM, USER-5FB402D855, Scheduler, Malware Database, 2014.12.28.6, 2014.12.28.7, Protection, 28/12/2014 4:51:21 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Starting, Protection, 28/12/2014 4:51:21 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopping, Protection, 28/12/2014 4:51:21 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Stopped, Protection, 28/12/2014 4:51:43 pm, SYSTEM, USER-5FB402D855, Protection, Refresh, Success, Protection, 28/12/2014 4:51:47 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Starting, Protection, 28/12/2014 4:52:08 pm, SYSTEM, USER-5FB402D855, Protection, Malicious Website Protection, Started, (end) |
|
28.12.2014, 18:21
| #5 |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Und hier die Logs lt. Forum-Hinweise: 1. Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 03:37 on 28/12/2014 (user)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
2. FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014 Ran by user (administrator) on USER-5FB402D855 on 28-12-2014 05:56:46 Running from C:\Documents and Settings\user\Desktop Loaded Profiles: user & (Available profiles: user) Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehSched.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Prolific Technology Inc.) C:\WINDOWS\system32\IoctlSvc.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (VIA Technologies, Inc.) C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe (Intel Corporation) C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe (Hewlett-Packard Company) C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (HP) C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe (cyberlink) C:\Program Files\CyberLink\Shared Files\brs.exe (APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe (Microsoft Corporation) C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1753192 2010-07-07] () HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [33673216 2009-08-28] (VIA Technologies, Inc.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2007-12-14] () HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-02-28] (Nero AG) HKLM\...\Run: [NBKeyScan] => C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-02-18] (Nero AG) HKLM\...\Run: [HP Component Manager] => C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [241664 2003-12-22] (Hewlett-Packard Company) HKLM\...\Run: [HPDJ Taskbar Utility] => C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [172032 2004-05-13] (HP) HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.) HKLM\...\Run: [UserFaultCheck] => %systemroot%\system32\dumprep 0 -u HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-19] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [83240 2008-03-20] (Cyberlink Corp.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2010-08-10] (Apple Inc.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [49152 2004-05-13] (Hewlett-Packard Company) HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [50176 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink) HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2039192 2014-11-21] (APN) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) Startup: C:\Documents and Settings\user\Start Menu\Programs\Startup\LimeWire On Startup.lnk ShortcutTarget: LimeWire On Startup.lnk -> C:\Program Files\LimeWire\LimeWire.exe (No File) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch URLSearchHook: HKU\S-1-5-21-839522115-1767777339-1801674531-1003 - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.) URLSearchHook: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.) SearchScopes: HKLM -> DefaultScope {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^HJ^xdm255^YY^gr&si=CKqt3J2M17UCFY3LtAodMWQAPA&ptb=AA0CE778-9899-4460-9100-8D3F5FCB90AE&ind=2013022713&n=77fc49f9&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKLM -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^HJ^xdm255^YY^gr&si=CKqt3J2M17UCFY3LtAodMWQAPA&ptb=AA0CE778-9899-4460-9100-8D3F5FCB90AE&ind=2013022713&n=77fc49f9&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) BHO: Βοηθός εισόδου του Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) Toolbar: HKU\.DEFAULT -> Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) Toolbar: HKU\S-1-5-21-839522115-1767777339-1801674531-1003 -> Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) Toolbar: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) FireFox: ======== FF ProfilePath: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default FF SearchEngineOrder.1: Ask Search FF SearchEngineOrder.3: Bing FF Homepage: hxxp://gr.msn.com/?pc=UP97&ocid=UP97DHP FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q= FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF SearchPlugin: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\searchplugins\ask-search.xml FF SearchPlugin: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\searchplugins\bingp.xml FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-02] FF Extension: Flash Video Downloader - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\artur.dubovoy@gmail.com.xpi [2013-12-30] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-02] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-08-27] Chrome: ======= CHR Profile: C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\User Data\Default CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\Documents and Settings\All Users\Application Data\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-11-26] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-19] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-10-30] (APN LLC.) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3273088 2013-09-16] (Skype Technologies S.A.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [98160 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG) S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) R1 HCW88AUD; C:\WINDOWS\System32\drivers\hcw88aud.sys [13440 2009-02-25] (Hauppauge Computer Works, Inc) S3 HCW88BDA; C:\WINDOWS\System32\drivers\hcw88bda.sys [130112 2005-03-15] (Hauppauge Computer Works, Inc) [File not signed] R3 HCW88TSE; C:\WINDOWS\System32\drivers\hcw88tse.sys [320512 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88TUNE; C:\WINDOWS\System32\drivers\hcw88tun.sys [75904 2009-02-25] (Hauppauge Computer Works, Inc.) R3 hcw88vid; C:\WINDOWS\System32\drivers\hcw88vid.sys [396032 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88XBAR; C:\WINDOWS\System32\drivers\HCW88BAR.sys [17792 2009-02-25] (Hauppauge Computer Works, Inc.) R1 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [54360 2014-11-21] (Malwarebytes Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-28] (Malwarebytes Corporation) S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation) R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-07-30] (Avira GmbH) R3 VIAHdAudAddService; C:\WINDOWS\System32\drivers\viahduaa.sys [1390976 2009-08-17] (VIA Technologies, Inc.) R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\CyberLink\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.) S3 CnxEtP; system32\DRIVERS\CnxEtP.sys [X] S3 CnxEtU; system32\DRIVERS\CnxEtU.sys [X] S3 CnxTgNP; system32\DRIVERS\CnxTgNP.sys [X] S4 IntelIde; No ImagePath U1 WS2IFSL; No ImagePath ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-28 05:56 - 2014-12-28 05:57 - 00021316 _____ () C:\Documents and Settings\user\Desktop\FRST.txt 2014-12-28 05:55 - 2014-12-28 05:56 - 00000000 ____D () C:\Documents and Settings\user\Desktop\frst 2014-12-28 04:52 - 2014-12-28 05:56 - 00000000 ____D () C:\FRST 2014-12-28 03:43 - 2014-12-28 03:43 - 00380416 _____ () C:\Documents and Settings\user\Desktop\Gmer-19357.exe 2014-12-28 03:37 - 2014-12-28 03:38 - 00000470 _____ () C:\Documents and Settings\user\Desktop\defogger_disable.log 2014-12-28 03:37 - 2014-12-28 03:37 - 00000000 _____ () C:\Documents and Settings\user\defogger_reenable 2014-12-28 03:20 - 2014-12-28 03:20 - 01114624 _____ (Farbar) C:\Documents and Settings\user\Desktop\FRST.exe 2014-12-28 03:06 - 2014-12-28 03:06 - 00050477 _____ () C:\Documents and Settings\user\Desktop\Defogger.exe 2014-12-27 15:32 - 2014-12-28 03:12 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-12-27 15:31 - 2014-12-27 15:31 - 00000786 _____ () C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes 2014-12-27 15:31 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-12-27 15:31 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-12-24 02:43 - 2014-12-24 02:44 - 20447072 _____ (Malwarebytes Corporation ) C:\Documents and Settings\user\Desktop\mbam-setup-2.0.4.1028.exe 2014-12-19 22:21 - 2014-12-19 22:21 - 00000867 _____ () C:\Documents and Settings\All Users\Desktop\Avira.lnk 2014-12-02 18:18 - 2014-12-02 18:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-11-30 20:55 - 2014-11-30 20:55 - 06327456 _____ () C:\Documents and Settings\user\Desktop\NEPAL.zip 2014-11-30 20:44 - 2014-11-30 20:44 - 06530162 _____ () C:\Documents and Settings\user\Desktop\Amazing trios!!.zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-28 05:57 - 2010-08-27 12:47 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Temp 2014-12-28 05:47 - 2010-08-27 09:26 - 00000420 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{90D0AD61-E914-4728-AD27-128A15D455DF}.job 2014-12-28 05:42 - 2013-08-02 15:07 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-12-28 05:11 - 2010-08-31 19:53 - 00001172 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-28 01:42 - 2010-08-27 12:46 - 00032542 _____ () C:\WINDOWS\SchedLgU.Txt 2014-12-27 22:41 - 2010-08-30 18:47 - 00000000 ____D () C:\WINDOWS\system32\NtmsData 2014-12-27 20:36 - 2010-08-27 12:39 - 01539989 _____ () C:\WINDOWS\WindowsUpdate.log 2014-12-27 20:33 - 2010-08-27 12:37 - 00000000 ____D () C:\WINDOWS\Registration 2014-12-27 20:14 - 2014-03-10 16:11 - 00000220 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job 2014-12-27 20:14 - 2010-08-31 19:53 - 00001168 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-27 20:14 - 2010-08-27 08:30 - 00000159 _____ () C:\WINDOWS\wiadebug.log 2014-12-27 20:14 - 2010-08-27 08:30 - 00000050 _____ () C:\WINDOWS\wiaservc.log 2014-12-27 20:13 - 2014-08-12 21:38 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat 2014-12-27 20:13 - 2010-08-27 12:47 - 00000278 ___SH () C:\Documents and Settings\user\ntuser.ini 2014-12-27 20:13 - 2010-08-27 12:46 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-12-27 20:13 - 2010-08-27 09:00 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$ 2014-12-27 20:13 - 2008-04-14 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl 2014-12-26 23:29 - 2013-05-11 20:41 - 00000000 ____D () C:\Documents and Settings\user\Application Data\vlc 2014-12-26 21:41 - 2010-09-04 21:07 - 00010752 _____ () C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-26 12:12 - 2010-08-27 11:38 - 00000000 ____D () C:\Program Files\mIRC 2014-12-25 20:05 - 2013-01-09 01:22 - 00000000 ____D () C:\Documents and Settings\user\Application Data\Skype 2014-12-24 00:55 - 2010-08-27 10:44 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Application Data\Adobe 2014-12-24 00:40 - 2013-01-08 11:03 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2014-12-24 00:40 - 2013-01-08 11:03 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2014-12-20 13:15 - 2014-08-12 16:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Package Cache 2014-12-19 22:58 - 2014-08-13 21:50 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-1767777339-1801674531-1003-0.dat 2014-12-19 22:21 - 2013-07-30 20:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Avira 2014-12-19 22:21 - 2013-07-30 20:46 - 00000000 ____D () C:\Program Files\Avira 2014-12-16 16:47 - 2010-09-04 21:14 - 00000000 ____D () C:\Elisa 2014-12-12 17:08 - 2013-07-15 21:24 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-12-12 16:40 - 2010-08-27 09:04 - 109818608 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-12-08 16:13 - 2014-03-10 16:11 - 00000214 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job 2014-12-03 16:01 - 2012-04-29 20:34 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service Some content of TEMP: ==================== C:\Documents and Settings\user\Local Settings\Temp\AskSLib.dll C:\Documents and Settings\user\Local Settings\Temp\avgnt.exe C:\Documents and Settings\user\Local Settings\Temp\FP_PL_MSI_INSTALLER.exe C:\Documents and Settings\user\Local Settings\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Documents and Settings\user\Local Settings\Temp\jna1018598015756517205.dll C:\Documents and Settings\user\Local Settings\Temp\jna1019156608849962005.dll C:\Documents and Settings\user\Local Settings\Temp\jna1054110368952186899.dll C:\Documents and Settings\user\Local Settings\Temp\jna1067656315426218944.dll C:\Documents and Settings\user\Local Settings\Temp\jna1074789301277825918.dll C:\Documents and Settings\user\Local Settings\Temp\jna1081746311212836624.dll C:\Documents and Settings\user\Local Settings\Temp\jna1085241225771631150.dll C:\Documents and Settings\user\Local Settings\Temp\jna1107631061849140393.dll C:\Documents and Settings\user\Local Settings\Temp\jna1132777933544359363.dll C:\Documents and Settings\user\Local Settings\Temp\jna1149132479392222430.dll C:\Documents and Settings\user\Local Settings\Temp\jna1184038736793383872.dll C:\Documents and Settings\user\Local Settings\Temp\jna1193744711882131025.dll C:\Documents and Settings\user\Local Settings\Temp\jna1220531633692794109.dll C:\Documents and Settings\user\Local Settings\Temp\jna1229072288502559632.dll C:\Documents and Settings\user\Local Settings\Temp\jna1236202753501263945.dll C:\Documents and Settings\user\Local Settings\Temp\jna126152781404492998.dll C:\Documents and Settings\user\Local Settings\Temp\jna1280191904381962345.dll C:\Documents and Settings\user\Local Settings\Temp\jna1284656166111928170.dll C:\Documents and Settings\user\Local Settings\Temp\jna1308161931894679320.dll C:\Documents and Settings\user\Local Settings\Temp\jna133578918412492434.dll C:\Documents and Settings\user\Local Settings\Temp\jna1337226056211675754.dll C:\Documents and Settings\user\Local Settings\Temp\jna1369560066256035343.dll C:\Documents and Settings\user\Local Settings\Temp\jna1393884169469642400.dll C:\Documents and Settings\user\Local Settings\Temp\jna1418747701985211673.dll C:\Documents and Settings\user\Local Settings\Temp\jna1444777884360715256.dll C:\Documents and Settings\user\Local Settings\Temp\jna1517541937029653037.dll C:\Documents and Settings\user\Local Settings\Temp\jna1540303513799354731.dll C:\Documents and Settings\user\Local Settings\Temp\jna1611519507412110217.dll C:\Documents and Settings\user\Local Settings\Temp\jna1639391784354750258.dll C:\Documents and Settings\user\Local Settings\Temp\jna1675627985163147573.dll C:\Documents and Settings\user\Local Settings\Temp\jna169709768717358539.dll C:\Documents and Settings\user\Local Settings\Temp\jna1715779431587509288.dll C:\Documents and Settings\user\Local Settings\Temp\jna1730384816159863759.dll C:\Documents and Settings\user\Local Settings\Temp\jna1744218832305402417.dll C:\Documents and Settings\user\Local Settings\Temp\jna1751116195363891925.dll C:\Documents and Settings\user\Local Settings\Temp\jna1789092105250444061.dll C:\Documents and Settings\user\Local Settings\Temp\jna1797292522667293163.dll C:\Documents and Settings\user\Local Settings\Temp\jna1815614376812357592.dll C:\Documents and Settings\user\Local Settings\Temp\jna1822686926912377935.dll C:\Documents and Settings\user\Local Settings\Temp\jna1972306607941477295.dll C:\Documents and Settings\user\Local Settings\Temp\jna1984256418168064458.dll C:\Documents and Settings\user\Local Settings\Temp\jna2002662704849368866.dll C:\Documents and Settings\user\Local Settings\Temp\jna203381527250695756.dll C:\Documents and Settings\user\Local Settings\Temp\jna2042590348285222112.dll C:\Documents and Settings\user\Local Settings\Temp\jna2072501436139906586.dll C:\Documents and Settings\user\Local Settings\Temp\jna2073352256553628305.dll C:\Documents and Settings\user\Local Settings\Temp\jna2090242278405103265.dll C:\Documents and Settings\user\Local Settings\Temp\jna2120954895055279539.dll C:\Documents and Settings\user\Local Settings\Temp\jna2134047914639972357.dll C:\Documents and Settings\user\Local Settings\Temp\jna2161475918190671326.dll C:\Documents and Settings\user\Local Settings\Temp\jna2180449572811309566.dll C:\Documents and Settings\user\Local Settings\Temp\jna2197209624331834766.dll C:\Documents and Settings\user\Local Settings\Temp\jna2241776212974358577.dll C:\Documents and Settings\user\Local Settings\Temp\jna2258918687212730184.dll C:\Documents and Settings\user\Local Settings\Temp\jna2317655284881032826.dll C:\Documents and Settings\user\Local Settings\Temp\jna2324038120798990619.dll C:\Documents and Settings\user\Local Settings\Temp\jna2325293898466760432.dll C:\Documents and Settings\user\Local Settings\Temp\jna2356440427927346156.dll C:\Documents and Settings\user\Local Settings\Temp\jna2401493564276087368.dll C:\Documents and Settings\user\Local Settings\Temp\jna2408284850274814480.dll C:\Documents and Settings\user\Local Settings\Temp\jna2417470465718446495.dll C:\Documents and Settings\user\Local Settings\Temp\jna2431306990304875028.dll C:\Documents and Settings\user\Local Settings\Temp\jna2438573080368501501.dll C:\Documents and Settings\user\Local Settings\Temp\jna2468994317373308670.dll C:\Documents and Settings\user\Local Settings\Temp\jna2510797972305783154.dll C:\Documents and Settings\user\Local Settings\Temp\jna2526428202785894503.dll C:\Documents and Settings\user\Local Settings\Temp\jna2531174951687849080.dll C:\Documents and Settings\user\Local Settings\Temp\jna2537629139431156557.dll C:\Documents and Settings\user\Local Settings\Temp\jna2549697697975506070.dll C:\Documents and Settings\user\Local Settings\Temp\jna2553239998189248436.dll C:\Documents and Settings\user\Local Settings\Temp\jna2610329174568126352.dll C:\Documents and Settings\user\Local Settings\Temp\jna2643501701220925712.dll C:\Documents and Settings\user\Local Settings\Temp\jna2665806793900493381.dll C:\Documents and Settings\user\Local Settings\Temp\jna2671090831640889780.dll C:\Documents and Settings\user\Local Settings\Temp\jna2672573864828637070.dll C:\Documents and Settings\user\Local Settings\Temp\jna2677991476389820493.dll C:\Documents and Settings\user\Local Settings\Temp\jna2716347491626106225.dll C:\Documents and Settings\user\Local Settings\Temp\jna2778809308732692822.dll C:\Documents and Settings\user\Local Settings\Temp\jna2785656242025221440.dll C:\Documents and Settings\user\Local Settings\Temp\jna2804563190211985067.dll C:\Documents and Settings\user\Local Settings\Temp\jna2823320657576971215.dll C:\Documents and Settings\user\Local Settings\Temp\jna2848460491140165974.dll C:\Documents and Settings\user\Local Settings\Temp\jna2853581214008511404.dll C:\Documents and Settings\user\Local Settings\Temp\jna2863614330856168785.dll C:\Documents and Settings\user\Local Settings\Temp\jna2896806166500624938.dll C:\Documents and Settings\user\Local Settings\Temp\jna2935629469160808732.dll C:\Documents and Settings\user\Local Settings\Temp\jna2935910744714884685.dll C:\Documents and Settings\user\Local Settings\Temp\jna2938680722119432335.dll C:\Documents and Settings\user\Local Settings\Temp\jna2948385541071328901.dll C:\Documents and Settings\user\Local Settings\Temp\jna2948904020783179955.dll C:\Documents and Settings\user\Local Settings\Temp\jna2951015438225508860.dll C:\Documents and Settings\user\Local Settings\Temp\jna2952041183228126770.dll C:\Documents and Settings\user\Local Settings\Temp\jna2979293993195265904.dll C:\Documents and Settings\user\Local Settings\Temp\jna2987519701878615257.dll C:\Documents and Settings\user\Local Settings\Temp\jna2997344453824288143.dll C:\Documents and Settings\user\Local Settings\Temp\jna3074337682031488550.dll C:\Documents and Settings\user\Local Settings\Temp\jna3131426548755520480.dll C:\Documents and Settings\user\Local Settings\Temp\jna314731271359842448.dll C:\Documents and Settings\user\Local Settings\Temp\jna3163127267345879473.dll C:\Documents and Settings\user\Local Settings\Temp\jna3177841279123458001.dll C:\Documents and Settings\user\Local Settings\Temp\jna3198897814520727195.dll C:\Documents and Settings\user\Local Settings\Temp\jna3212779905479567606.dll C:\Documents and Settings\user\Local Settings\Temp\jna3273413069225016127.dll C:\Documents and Settings\user\Local Settings\Temp\jna3278016703310944723.dll C:\Documents and Settings\user\Local Settings\Temp\jna329148333221796710.dll C:\Documents and Settings\user\Local Settings\Temp\jna3303700773143483736.dll C:\Documents and Settings\user\Local Settings\Temp\jna3307809320940879715.dll C:\Documents and Settings\user\Local Settings\Temp\jna3331626593232041794.dll C:\Documents and Settings\user\Local Settings\Temp\jna3382324260858610891.dll C:\Documents and Settings\user\Local Settings\Temp\jna3392705855773168342.dll C:\Documents and Settings\user\Local Settings\Temp\jna3396144410969323866.dll C:\Documents and Settings\user\Local Settings\Temp\jna3456536715906960934.dll C:\Documents and Settings\user\Local Settings\Temp\jna349828137638025738.dll C:\Documents and Settings\user\Local Settings\Temp\jna3499866922208238457.dll C:\Documents and Settings\user\Local Settings\Temp\jna3523080323519466647.dll C:\Documents and Settings\user\Local Settings\Temp\jna3528945545227612937.dll C:\Documents and Settings\user\Local Settings\Temp\jna3551305921992481997.dll C:\Documents and Settings\user\Local Settings\Temp\jna3585632061149734576.dll C:\Documents and Settings\user\Local Settings\Temp\jna3609856636681224334.dll C:\Documents and Settings\user\Local Settings\Temp\jna3655498301709608776.dll C:\Documents and Settings\user\Local Settings\Temp\jna3660087081848179225.dll C:\Documents and Settings\user\Local Settings\Temp\jna3660435336236199121.dll C:\Documents and Settings\user\Local Settings\Temp\jna3707390231397866371.dll C:\Documents and Settings\user\Local Settings\Temp\jna3711077207973683194.dll C:\Documents and Settings\user\Local Settings\Temp\jna3713099472909612642.dll C:\Documents and Settings\user\Local Settings\Temp\jna3747756473912637953.dll C:\Documents and Settings\user\Local Settings\Temp\jna3750181669823915426.dll C:\Documents and Settings\user\Local Settings\Temp\jna37869361387751369.dll C:\Documents and Settings\user\Local Settings\Temp\jna3809528806403848271.dll C:\Documents and Settings\user\Local Settings\Temp\jna3836509597209835700.dll C:\Documents and Settings\user\Local Settings\Temp\jna3836518715881748004.dll C:\Documents and Settings\user\Local Settings\Temp\jna3844561797107778000.dll C:\Documents and Settings\user\Local Settings\Temp\jna3857819896739337356.dll C:\Documents and Settings\user\Local Settings\Temp\jna39043044323028572.dll C:\Documents and Settings\user\Local Settings\Temp\jna3933908438493490657.dll C:\Documents and Settings\user\Local Settings\Temp\jna3986368091867013238.dll C:\Documents and Settings\user\Local Settings\Temp\jna4011993072673566569.dll C:\Documents and Settings\user\Local Settings\Temp\jna403114248904668463.dll C:\Documents and Settings\user\Local Settings\Temp\jna4042751870571551911.dll C:\Documents and Settings\user\Local Settings\Temp\jna4076664719589094115.dll C:\Documents and Settings\user\Local Settings\Temp\jna4086962424508402867.dll C:\Documents and Settings\user\Local Settings\Temp\jna4120044222611268377.dll C:\Documents and Settings\user\Local Settings\Temp\jna4161271955212154201.dll C:\Documents and Settings\user\Local Settings\Temp\jna4213751770516968831.dll C:\Documents and Settings\user\Local Settings\Temp\jna4268290379421726837.dll C:\Documents and Settings\user\Local Settings\Temp\jna4322527619909711641.dll C:\Documents and Settings\user\Local Settings\Temp\jna4327946022298906460.dll C:\Documents and Settings\user\Local Settings\Temp\jna4347638784097314125.dll C:\Documents and Settings\user\Local Settings\Temp\jna4359088697938435048.dll C:\Documents and Settings\user\Local Settings\Temp\jna4363678128700239388.dll C:\Documents and Settings\user\Local Settings\Temp\jna4397190105520348367.dll C:\Documents and Settings\user\Local Settings\Temp\jna4409320824918926503.dll C:\Documents and Settings\user\Local Settings\Temp\jna4413114712628800138.dll C:\Documents and Settings\user\Local Settings\Temp\jna4452450835475051903.dll C:\Documents and Settings\user\Local Settings\Temp\jna4481936472293530415.dll C:\Documents and Settings\user\Local Settings\Temp\jna4484352908627684135.dll C:\Documents and Settings\user\Local Settings\Temp\jna450516667769625196.dll C:\Documents and Settings\user\Local Settings\Temp\jna4505928242870435151.dll C:\Documents and Settings\user\Local Settings\Temp\jna458170190016486559.dll C:\Documents and Settings\user\Local Settings\Temp\jna4588504756141861561.dll C:\Documents and Settings\user\Local Settings\Temp\jna4615595866151186404.dll C:\Documents and Settings\user\Local Settings\Temp\jna4621283134062675742.dll C:\Documents and Settings\user\Local Settings\Temp\jna4625636822808415993.dll C:\Documents and Settings\user\Local Settings\Temp\jna464936808446921173.dll C:\Documents and Settings\user\Local Settings\Temp\jna4658757192781739202.dll C:\Documents and Settings\user\Local Settings\Temp\jna4681216277032393585.dll C:\Documents and Settings\user\Local Settings\Temp\jna4725944415076312878.dll C:\Documents and Settings\user\Local Settings\Temp\jna4735346304496903550.dll C:\Documents and Settings\user\Local Settings\Temp\jna4783972280713172918.dll C:\Documents and Settings\user\Local Settings\Temp\jna4808282709978649012.dll C:\Documents and Settings\user\Local Settings\Temp\jna4868837277559267726.dll C:\Documents and Settings\user\Local Settings\Temp\jna4893379235346844885.dll C:\Documents and Settings\user\Local Settings\Temp\jna492786102239780989.dll C:\Documents and Settings\user\Local Settings\Temp\jna4931258022462438791.dll C:\Documents and Settings\user\Local Settings\Temp\jna4951088438785087436.dll C:\Documents and Settings\user\Local Settings\Temp\jna497334957490004861.dll C:\Documents and Settings\user\Local Settings\Temp\jna4977783129420362789.dll C:\Documents and Settings\user\Local Settings\Temp\jna5016189682098898348.dll C:\Documents and Settings\user\Local Settings\Temp\jna5026201552872620077.dll C:\Documents and Settings\user\Local Settings\Temp\jna5050783069736820932.dll C:\Documents and Settings\user\Local Settings\Temp\jna5070414805079639790.dll C:\Documents and Settings\user\Local Settings\Temp\jna5086752863340952363.dll C:\Documents and Settings\user\Local Settings\Temp\jna5102478288466407921.dll C:\Documents and Settings\user\Local Settings\Temp\jna5110094690952460746.dll C:\Documents and Settings\user\Local Settings\Temp\jna5118802127639441239.dll C:\Documents and Settings\user\Local Settings\Temp\jna5135780865162372031.dll C:\Documents and Settings\user\Local Settings\Temp\jna5152424139196856901.dll C:\Documents and Settings\user\Local Settings\Temp\jna5167922714277825994.dll C:\Documents and Settings\user\Local Settings\Temp\jna5179463013190179264.dll C:\Documents and Settings\user\Local Settings\Temp\jna5187413021875545207.dll C:\Documents and Settings\user\Local Settings\Temp\jna5199154843169873702.dll C:\Documents and Settings\user\Local Settings\Temp\jna5212004167335519817.dll C:\Documents and Settings\user\Local Settings\Temp\jna5226900549136343580.dll C:\Documents and Settings\user\Local Settings\Temp\jna5288618086272893822.dll C:\Documents and Settings\user\Local Settings\Temp\jna5295724846575892226.dll C:\Documents and Settings\user\Local Settings\Temp\jna5313590584977128851.dll C:\Documents and Settings\user\Local Settings\Temp\jna5338685326022610357.dll C:\Documents and Settings\user\Local Settings\Temp\jna5348281482192462809.dll C:\Documents and Settings\user\Local Settings\Temp\jna5437228285826747597.dll C:\Documents and Settings\user\Local Settings\Temp\jna5441668363744964761.dll C:\Documents and Settings\user\Local Settings\Temp\jna5442931064562415457.dll C:\Documents and Settings\user\Local Settings\Temp\jna5453615035749625373.dll C:\Documents and Settings\user\Local Settings\Temp\jna5479792257399697182.dll C:\Documents and Settings\user\Local Settings\Temp\jna5514393635530006342.dll C:\Documents and Settings\user\Local Settings\Temp\jna5556684011066978614.dll C:\Documents and Settings\user\Local Settings\Temp\jna5571302248576248792.dll C:\Documents and Settings\user\Local Settings\Temp\jna5601709862442486030.dll C:\Documents and Settings\user\Local Settings\Temp\jna5617999974297540203.dll C:\Documents and Settings\user\Local Settings\Temp\jna5645847927121015380.dll C:\Documents and Settings\user\Local Settings\Temp\jna5662191693915760220.dll C:\Documents and Settings\user\Local Settings\Temp\jna5735629066741275475.dll C:\Documents and Settings\user\Local Settings\Temp\jna5735951814368734174.dll C:\Documents and Settings\user\Local Settings\Temp\jna5738955908373529939.dll C:\Documents and Settings\user\Local Settings\Temp\jna5746630390486006112.dll C:\Documents and Settings\user\Local Settings\Temp\jna5751292647717833892.dll C:\Documents and Settings\user\Local Settings\Temp\jna5782033122077194123.dll C:\Documents and Settings\user\Local Settings\Temp\jna58771696955796851.dll C:\Documents and Settings\user\Local Settings\Temp\jna5882360804795711114.dll C:\Documents and Settings\user\Local Settings\Temp\jna5895823086973337054.dll C:\Documents and Settings\user\Local Settings\Temp\jna5898172041828532686.dll C:\Documents and Settings\user\Local Settings\Temp\jna5917661061566645713.dll C:\Documents and Settings\user\Local Settings\Temp\jna5939164987772081099.dll C:\Documents and Settings\user\Local Settings\Temp\jna5942346895230436985.dll C:\Documents and Settings\user\Local Settings\Temp\jna5978090800038978698.dll C:\Documents and Settings\user\Local Settings\Temp\jna5984237446200876939.dll C:\Documents and Settings\user\Local Settings\Temp\jna5984571024137360869.dll C:\Documents and Settings\user\Local Settings\Temp\jna6018992629466786060.dll C:\Documents and Settings\user\Local Settings\Temp\jna6021137173606701324.dll C:\Documents and Settings\user\Local Settings\Temp\jna6031582424780841010.dll C:\Documents and Settings\user\Local Settings\Temp\jna6037394220108831128.dll C:\Documents and Settings\user\Local Settings\Temp\jna6053925816741569690.dll C:\Documents and Settings\user\Local Settings\Temp\jna607153311164507718.dll C:\Documents and Settings\user\Local Settings\Temp\jna6073471605377104753.dll C:\Documents and Settings\user\Local Settings\Temp\jna6102726985401172006.dll C:\Documents and Settings\user\Local Settings\Temp\jna6121107711227918422.dll C:\Documents and Settings\user\Local Settings\Temp\jna6122221602080766228.dll C:\Documents and Settings\user\Local Settings\Temp\jna6137699825653109324.dll C:\Documents and Settings\user\Local Settings\Temp\jna6151882956665694423.dll C:\Documents and Settings\user\Local Settings\Temp\jna6166871141894475754.dll C:\Documents and Settings\user\Local Settings\Temp\jna6188832592971619022.dll C:\Documents and Settings\user\Local Settings\Temp\jna6207756225145170267.dll C:\Documents and Settings\user\Local Settings\Temp\jna6216325537112491213.dll C:\Documents and Settings\user\Local Settings\Temp\jna6234142849939878596.dll C:\Documents and Settings\user\Local Settings\Temp\jna6234207446022351187.dll C:\Documents and Settings\user\Local Settings\Temp\jna627092023557020781.dll C:\Documents and Settings\user\Local Settings\Temp\jna6304847506294584339.dll C:\Documents and Settings\user\Local Settings\Temp\jna6336637726659727187.dll C:\Documents and Settings\user\Local Settings\Temp\jna635431580268211911.dll C:\Documents and Settings\user\Local Settings\Temp\jna641172776757714775.dll C:\Documents and Settings\user\Local Settings\Temp\jna6429870233450247244.dll C:\Documents and Settings\user\Local Settings\Temp\jna6471759876057156642.dll C:\Documents and Settings\user\Local Settings\Temp\jna6500740486551083267.dll C:\Documents and Settings\user\Local Settings\Temp\jna6503337683193744404.dll C:\Documents and Settings\user\Local Settings\Temp\jna6537244881114901406.dll C:\Documents and Settings\user\Local Settings\Temp\jna655440923660778085.dll C:\Documents and Settings\user\Local Settings\Temp\jna6581397165984955826.dll C:\Documents and Settings\user\Local Settings\Temp\jna6619270896259834498.dll C:\Documents and Settings\user\Local Settings\Temp\jna6739562869867049632.dll C:\Documents and Settings\user\Local Settings\Temp\jna6832081544939687443.dll C:\Documents and Settings\user\Local Settings\Temp\jna6853313634174324167.dll C:\Documents and Settings\user\Local Settings\Temp\jna6854636478094351398.dll C:\Documents and Settings\user\Local Settings\Temp\jna6864415916724401665.dll C:\Documents and Settings\user\Local Settings\Temp\jna6881216830643303253.dll C:\Documents and Settings\user\Local Settings\Temp\jna6884919143898607334.dll C:\Documents and Settings\user\Local Settings\Temp\jna6899827399941328847.dll C:\Documents and Settings\user\Local Settings\Temp\jna6905650954109264239.dll C:\Documents and Settings\user\Local Settings\Temp\jna690701066709392696.dll C:\Documents and Settings\user\Local Settings\Temp\jna6909222806309844250.dll C:\Documents and Settings\user\Local Settings\Temp\jna6926036812653025497.dll C:\Documents and Settings\user\Local Settings\Temp\jna6956363519599934534.dll C:\Documents and Settings\user\Local Settings\Temp\jna6963346923115776238.dll C:\Documents and Settings\user\Local Settings\Temp\jna6974461004191306991.dll C:\Documents and Settings\user\Local Settings\Temp\jna6986493353713015245.dll C:\Documents and Settings\user\Local Settings\Temp\jna6999306419612917029.dll C:\Documents and Settings\user\Local Settings\Temp\jna7007283777040729121.dll C:\Documents and Settings\user\Local Settings\Temp\jna7067201146071673665.dll C:\Documents and Settings\user\Local Settings\Temp\jna7078829668835475130.dll C:\Documents and Settings\user\Local Settings\Temp\jna7141196306262373071.dll C:\Documents and Settings\user\Local Settings\Temp\jna7173801117990883589.dll C:\Documents and Settings\user\Local Settings\Temp\jna7178052471610329516.dll C:\Documents and Settings\user\Local Settings\Temp\jna7179237294683828031.dll C:\Documents and Settings\user\Local Settings\Temp\jna7191385143508596693.dll C:\Documents and Settings\user\Local Settings\Temp\jna7246434935486376031.dll C:\Documents and Settings\user\Local Settings\Temp\jna7301046657013180092.dll C:\Documents and Settings\user\Local Settings\Temp\jna7345824473915811993.dll C:\Documents and Settings\user\Local Settings\Temp\jna7359675178835277244.dll C:\Documents and Settings\user\Local Settings\Temp\jna7365359343344320038.dll C:\Documents and Settings\user\Local Settings\Temp\jna7449395670240632610.dll C:\Documents and Settings\user\Local Settings\Temp\jna7458149348901962341.dll C:\Documents and Settings\user\Local Settings\Temp\jna746116815188311229.dll C:\Documents and Settings\user\Local Settings\Temp\jna7461191146241957046.dll C:\Documents and Settings\user\Local Settings\Temp\jna750393558100589524.dll C:\Documents and Settings\user\Local Settings\Temp\jna7505977606784092002.dll C:\Documents and Settings\user\Local Settings\Temp\jna75113703775485150.dll C:\Documents and Settings\user\Local Settings\Temp\jna7515600735873828092.dll C:\Documents and Settings\user\Local Settings\Temp\jna7527711998531979247.dll C:\Documents and Settings\user\Local Settings\Temp\jna7573439017569364455.dll C:\Documents and Settings\user\Local Settings\Temp\jna7606709887933729566.dll C:\Documents and Settings\user\Local Settings\Temp\jna7609737070148464717.dll C:\Documents and Settings\user\Local Settings\Temp\jna7612055138807099449.dll C:\Documents and Settings\user\Local Settings\Temp\jna7615647265940769712.dll C:\Documents and Settings\user\Local Settings\Temp\jna7620550833432017223.dll C:\Documents and Settings\user\Local Settings\Temp\jna7635046434712532639.dll C:\Documents and Settings\user\Local Settings\Temp\jna7643613117673602880.dll C:\Documents and Settings\user\Local Settings\Temp\jna7671460033632863064.dll C:\Documents and Settings\user\Local Settings\Temp\jna7673002653420707097.dll C:\Documents and Settings\user\Local Settings\Temp\jna7717689111685676426.dll C:\Documents and Settings\user\Local Settings\Temp\jna7755815470438702146.dll C:\Documents and Settings\user\Local Settings\Temp\jna7761347370455340278.dll C:\Documents and Settings\user\Local Settings\Temp\jna779518035144085237.dll C:\Documents and Settings\user\Local Settings\Temp\jna7806179024221259460.dll C:\Documents and Settings\user\Local Settings\Temp\jna7833849234968593110.dll C:\Documents and Settings\user\Local Settings\Temp\jna7844115555546310166.dll C:\Documents and Settings\user\Local Settings\Temp\jna7844624207795146008.dll C:\Documents and Settings\user\Local Settings\Temp\jna7847338516257281235.dll C:\Documents and Settings\user\Local Settings\Temp\jna7874332113827978318.dll C:\Documents and Settings\user\Local Settings\Temp\jna7878888926157499058.dll C:\Documents and Settings\user\Local Settings\Temp\jna7885294086610254022.dll C:\Documents and Settings\user\Local Settings\Temp\jna7912868075504998362.dll C:\Documents and Settings\user\Local Settings\Temp\jna7925507564681747022.dll C:\Documents and Settings\user\Local Settings\Temp\jna7960032031067164853.dll C:\Documents and Settings\user\Local Settings\Temp\jna7960771191235520894.dll C:\Documents and Settings\user\Local Settings\Temp\jna7962031491268628463.dll C:\Documents and Settings\user\Local Settings\Temp\jna8033056941256111619.dll C:\Documents and Settings\user\Local Settings\Temp\jna8041796971858570336.dll C:\Documents and Settings\user\Local Settings\Temp\jna8142383074049100824.dll C:\Documents and Settings\user\Local Settings\Temp\jna8173924713800641716.dll C:\Documents and Settings\user\Local Settings\Temp\jna8203759671198421220.dll C:\Documents and Settings\user\Local Settings\Temp\jna820564342267085729.dll C:\Documents and Settings\user\Local Settings\Temp\jna8215558476302563748.dll C:\Documents and Settings\user\Local Settings\Temp\jna8224161029397539029.dll C:\Documents and Settings\user\Local Settings\Temp\jna8228656707707341950.dll C:\Documents and Settings\user\Local Settings\Temp\jna8238913793672062528.dll C:\Documents and Settings\user\Local Settings\Temp\jna8250506484151937595.dll C:\Documents and Settings\user\Local Settings\Temp\jna8271928315078152128.dll C:\Documents and Settings\user\Local Settings\Temp\jna8336402187322708279.dll C:\Documents and Settings\user\Local Settings\Temp\jna8350905528807307069.dll C:\Documents and Settings\user\Local Settings\Temp\jna8458738120056772296.dll C:\Documents and Settings\user\Local Settings\Temp\jna8464501407457616462.dll C:\Documents and Settings\user\Local Settings\Temp\jna8467794687138604522.dll C:\Documents and Settings\user\Local Settings\Temp\jna8507435170752937294.dll C:\Documents and Settings\user\Local Settings\Temp\jna8511595794634019676.dll C:\Documents and Settings\user\Local Settings\Temp\jna8513854111061034314.dll C:\Documents and Settings\user\Local Settings\Temp\jna8524000586145385668.dll C:\Documents and Settings\user\Local Settings\Temp\jna8528009325211469364.dll C:\Documents and Settings\user\Local Settings\Temp\jna858680324265691834.dll C:\Documents and Settings\user\Local Settings\Temp\jna8623573446532450925.dll C:\Documents and Settings\user\Local Settings\Temp\jna8626589946285469632.dll C:\Documents and Settings\user\Local Settings\Temp\jna8627882903747333442.dll C:\Documents and Settings\user\Local Settings\Temp\jna8634572126872240923.dll C:\Documents and Settings\user\Local Settings\Temp\jna8651027696539938542.dll C:\Documents and Settings\user\Local Settings\Temp\jna8661328166141511986.dll C:\Documents and Settings\user\Local Settings\Temp\jna8677281074442806730.dll C:\Documents and Settings\user\Local Settings\Temp\jna8697037130856864172.dll C:\Documents and Settings\user\Local Settings\Temp\jna8713599686653423424.dll C:\Documents and Settings\user\Local Settings\Temp\jna8773306208068487765.dll C:\Documents and Settings\user\Local Settings\Temp\jna8775838629588889199.dll C:\Documents and Settings\user\Local Settings\Temp\jna8793895531891196713.dll C:\Documents and Settings\user\Local Settings\Temp\jna8832700899725285546.dll C:\Documents and Settings\user\Local Settings\Temp\jna8834164520709206145.dll C:\Documents and Settings\user\Local Settings\Temp\jna8893583522744168486.dll C:\Documents and Settings\user\Local Settings\Temp\jna8920717668835001196.dll C:\Documents and Settings\user\Local Settings\Temp\jna8922996735695137857.dll C:\Documents and Settings\user\Local Settings\Temp\jna8925035034141530543.dll C:\Documents and Settings\user\Local Settings\Temp\jna8989798954901397500.dll C:\Documents and Settings\user\Local Settings\Temp\jna9013172993544940612.dll C:\Documents and Settings\user\Local Settings\Temp\jna9082971493695842019.dll C:\Documents and Settings\user\Local Settings\Temp\jna9105056893988260352.dll C:\Documents and Settings\user\Local Settings\Temp\jna9105423081813887943.dll C:\Documents and Settings\user\Local Settings\Temp\jna9109932500237241983.dll C:\Documents and Settings\user\Local Settings\Temp\jna9133423311985180344.dll C:\Documents and Settings\user\Local Settings\Temp\jna9138259813788147939.dll C:\Documents and Settings\user\Local Settings\Temp\jna9143329078123818684.dll C:\Documents and Settings\user\Local Settings\Temp\jna9166690480305088222.dll C:\Documents and Settings\user\Local Settings\Temp\jna91817564020394771.dll C:\Documents and Settings\user\Local Settings\Temp\jre-6u22-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u23-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u34-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u35-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u37-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-6u39-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u21-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u45-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u51-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u55-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u65-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\jre-7u67-windows-i586-iftw.exe C:\Documents and Settings\user\Local Settings\Temp\LimeWireWin.exe C:\Documents and Settings\user\Local Settings\Temp\LiveUpdate.exe C:\Documents and Settings\user\Local Settings\Temp\NOSEventMessages.dll C:\Documents and Settings\user\Local Settings\Temp\pdf24-creator-update.exe C:\Documents and Settings\user\Local Settings\Temp\SkypeSetup.exe C:\Documents and Settings\user\Local Settings\Temp\YSPCUNLR.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ --- --- --- "Addition" Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-12-2014
Ran by user at 2014-12-28 05:57:49
Running from C:\Documents and Settings\user\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM\...\uTorrent) (Version: 3.3.0.29625 - BitTorrent Inc.)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3946 - APN, LLC)
CameraHelperMsi (Version: 13.51.815.0 - Logitech) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 2.35 - Piriform)
CDex - Open Source Digital Audio CD Extractor (HKLM\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel WinDVD 2010 (HKLM\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.298 - Corel Inc.)
CyberLink PowerDVD 8 (HKLM\...\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2217 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{307BD415-B3E6-4E60-962A-FEF793237322}) (Version: 8.00.0000 - CyberLink Corp.)
DVD Shrink 3.2 (HKLM\...\DVD Shrink_is1) (Version: - DVD Shrink)
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Folder Marker Pro v 3.0 (HKLM\...\Folder Marker_is1) (Version: 3.0 - ArcticLine Software)
Free YouTube Downloader 3.5.134 (HKLM\...\{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1) (Version: - HOW Inc.)
GNU Solfege 3.20.7 (HKLM\...\GNU Solfege_is1) (Version: - )
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{E654D1E3-B18B-4953-BFBC-F16227323E05}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Help (HKLM\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
HP Deskjet 3740 (HKLM\...\{F901CA6D-A074-42D3-A11D-33AAE6FFD0C1}) (Version: 1.00.0000 - Hewlett-Packard)
HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.3781 - HP Photo Creations Powered by RocketLife)
HP Software Update (HKLM\...\{B81023A5-71ED-46EB-BE3B-9F974D1155F1}) (Version: 3.0.1.25 - Hewlett-Packard)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
K-Lite Mega Codec Pack 4.7.0 (HKLM\...\KLiteCodecPack_is1) (Version: 4.7.0 - )
Logitech Webcam Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
Malwarebytes Anti-Malware έκδοση 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 1.0 Hotfix (KB2572066) (HKLM\...\KB2572066) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Hotfix (KB2604042) (HKLM\...\KB2604042) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Hotfix (KB2656378) (HKLM\...\KB2656378) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Hotfix (KB953295) (HKLM\...\KB953295) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Hotfix (KB979904) (HKLM\...\KB979904) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Security Update (KB2698035) (HKLM\...\KB2698035) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Security Update (KB2742607) (HKLM\...\KB2742607) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Security Update (KB2833951) (HKLM\...\KB2833951) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.0 Security Update (KB2904878) (HKLM\...\KB2904878) (Version: - Microsoft Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Base Smart Card Cryptographic Service Provider Package (HKLM\...\KB909520) (Version: - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110408-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0 (x86 el) (HKLM\...\Mozilla Firefox 34.0 (x86 el)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSN (HKLM\...\MSNINST) (Version: - )
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 (HKLM\...\{D6D5CB84-0E6E-4E69-B300-C690B6911032}) (Version: 8.3.24 - Nero AG)
Nokia Connectivity Cable Driver (HKLM\...\{AF88496B-4BBA-4922-97E9-2582D3A28358}) (Version: 7.1.48.0 - Nokia)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (HKLM\...\NVIDIA nView Desktop Manager) (Version: 6.14.10.13527 - NVIDIA Corporation)
PC Connectivity Solution (HKLM\...\{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}) (Version: 11.5.13.0 - Nokia)
PDF24 Creator 5.4.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Platform (Version: 1.34 - VIA Technologies, Inc.) Hidden
PowerDVD (Version: 8.00.0000 - CyberLink Corp.) Hidden
QuickTime (HKLM\...\{EB900AF8-CC61-4E15-871B-98D1EA3E8025}) (Version: 7.67.75.0 - Apple Inc.)
REALTEK GbE & FE Ethernet PCI-E NIC Driver (HKLM\...\{C9BED750-1211-4480-B1A5-718A3BE15525}) (Version: 1.23.0000 - Realtek)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 3.0.1.3 - Realtek Semiconductor Corp.)
Security Task Manager 1.8f (HKLM\...\Security Task Manager) (Version: 1.8f - Neuber Software)
Segoe UI (Version: 14.0.4327.805 - Microsoft Corp) Hidden
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.12.13601 - Skype Technologies S.A.)
Skype™ 6.21 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Subtitles 1.3 (HKLM\...\{A35065BD-3077-435B-ABE5-80ADC6282046}_is1) (Version: 1.3 - Subtitles.com.br)
VIA Διαχειριστής Συσκευών Πλατφόρμας (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
Video Download Converter version 1.0.0.0 (HKLM\...\VDC_is1) (Version: 1.0.0.0 - ) <==== ATTENTION
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows 7 Upgrade Advisor (HKLM\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Management Framework Core (HKLM\...\KB968930) (Version: - Microsoft Corporation)
Windows Media Format Runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Search 4.0 (HKLM\...\KB940157) (Version: 04.00.6001.503 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
Βοηθός εισόδου του Windows Live (HKLM\...\{1A08F24B-CA66-4BA9-9933-A9D20A66E8D8}) (Version: 5.000.818.5 - Microsoft Corporation)
Εργαλείο αποστολής του Windows Live (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-839522115-1767777339-1801674531-1003_Classes\CLSID\{93a3111f-4f74-4ed8-895e-d9708497629e}\InprocServer32 -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll No File
CustomCLSID: HKU\S-1-5-21-839522115-1767777339-1801674531-1003_Classes\CLSID\{97090E2F-3062-4459-855B-014F0D3CDBB1}\InprocServer32 -> C:\Program Files\Windows Desktop Search\deskbar.dll (Microsoft Corporation)
==================== Restore Points =========================
29-09-2014 17:54:51 System Checkpoint
02-10-2014 18:30:15 System Checkpoint
04-10-2014 08:39:45 System Checkpoint
05-10-2014 10:44:48 System Checkpoint
05-10-2014 18:58:22 Installed Windows 7 Upgrade Advisor
06-10-2014 19:08:55 System Checkpoint
08-10-2014 08:58:18 System Checkpoint
11-10-2014 16:39:53 System Checkpoint
14-10-2014 20:23:18 System Checkpoint
15-10-2014 21:41:36 Software Distribution Service 3.0
19-10-2014 14:01:25 System Checkpoint
20-10-2014 21:36:28 System Checkpoint
22-10-2014 19:37:04 System Checkpoint
23-10-2014 21:49:44 System Checkpoint
25-10-2014 23:36:44 System Checkpoint
27-10-2014 00:10:31 System Checkpoint
28-10-2014 01:08:31 System Checkpoint
29-10-2014 02:05:20 System Checkpoint
30-10-2014 22:13:48 System Checkpoint
31-10-2014 23:06:49 System Checkpoint
01-11-2014 23:33:33 System Checkpoint
03-11-2014 00:12:22 System Checkpoint
04-11-2014 01:09:15 System Checkpoint
05-11-2014 17:13:34 System Checkpoint
06-11-2014 21:12:40 System Checkpoint
08-11-2014 14:54:24 System Checkpoint
09-11-2014 15:59:55 System Checkpoint
10-11-2014 16:02:59 System Checkpoint
13-11-2014 20:59:04 System Checkpoint
14-11-2014 22:23:22 Software Distribution Service 3.0
15-11-2014 22:34:58 System Checkpoint
17-11-2014 17:01:23 System Checkpoint
18-11-2014 17:49:34 System Checkpoint
19-11-2014 19:39:07 System Checkpoint
20-11-2014 20:06:44 System Checkpoint
21-11-2014 20:38:36 System Checkpoint
22-11-2014 21:02:11 System Checkpoint
23-11-2014 21:58:23 System Checkpoint
25-11-2014 16:16:39 System Checkpoint
26-11-2014 17:13:48 System Checkpoint
27-11-2014 17:16:49 System Checkpoint
28-11-2014 20:09:02 System Checkpoint
29-11-2014 21:07:20 System Checkpoint
30-11-2014 21:39:09 System Checkpoint
01-12-2014 21:44:55 System Checkpoint
02-12-2014 22:20:12 System Checkpoint
04-12-2014 16:14:30 System Checkpoint
05-12-2014 16:15:11 System Checkpoint
06-12-2014 16:34:58 System Checkpoint
07-12-2014 18:26:19 System Checkpoint
08-12-2014 18:28:58 System Checkpoint
10-12-2014 20:52:35 System Checkpoint
11-12-2014 21:23:48 System Checkpoint
12-12-2014 16:37:48 Software Distribution Service 3.0
14-12-2014 16:00:00 System Checkpoint
15-12-2014 16:41:59 System Checkpoint
16-12-2014 17:55:42 System Checkpoint
20-12-2014 14:12:32 System Checkpoint
21-12-2014 14:18:03 System Checkpoint
24-12-2014 00:16:42 System Checkpoint
25-12-2014 20:31:33 System Checkpoint
26-12-2014 21:12:46 System Checkpoint
27-12-2014 21:29:47 System Checkpoint
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2008-04-14 14:00 - 2008-04-14 14:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\User_Feed_Synchronization-{90D0AD61-E914-4728-AD27-128A15D455DF}.job => C:\WINDOWS\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2010-08-27 00:55 - 2004-11-02 15:57 - 00121344 _____ () C:\Program Files\WinRAR\rarext.dll
2010-08-27 01:07 - 2010-07-07 22:52 - 00555624 _____ () C:\Program Files\NVIDIA Corporation\nView\nvshell.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2008-04-14 14:00 - 2008-04-14 14:00 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
2008-04-14 14:00 - 2008-04-14 14:00 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-839522115-1767777339-1801674531-500 - Administrator - Enabled)
ASPNET (S-1-5-21-839522115-1767777339-1801674531-1004 - Limited - Enabled)
Guest (S-1-5-21-839522115-1767777339-1801674531-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-839522115-1767777339-1801674531-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-839522115-1767777339-1801674531-1002 - Limited - Disabled)
user (S-1-5-21-839522115-1767777339-1801674531-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\user
==================== Faulty Device Manager Devices =============
Name: Hauppauge WinTV 88x DVB-T Hybrid Tuner/Demod
Description: Hauppauge WinTV 88x DVB-T Hybrid Tuner/Demod
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: Hauppauge
Service: HCW88BDA
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (12/28/2014 05:55:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application FRST.exe, version 27.12.2014.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (12/27/2014 03:18:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x01faa2a2.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/25/2014 09:38:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x006bf707.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/25/2014 09:37:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Error: (12/24/2014 00:55:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x01f67290.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/16/2014 07:36:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x01f25fc6.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/10/2014 06:19:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x01e64402.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/06/2014 11:32:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x01f69535.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
Error: (12/05/2014 09:16:51 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)
Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.
Error: (11/28/2014 07:46:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application NMIndexStoreSvr.exe, version 3.3.3.0, faulting module unknown, version 0.0.0.0, fault address 0x006aa360.
Processing media-specific event for [NMIndexStoreSvr.exe!ws!]
System errors:
=============
Error: (12/27/2014 08:15:32 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Timeout (30000 milliseconds) waiting for a transaction response from the MBAMService service.
Error: (12/27/2014 01:47:38 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 192.168.1.2 for the Network Card with network address 485B39C1FC1B has been
denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
Error: (12/25/2014 08:13:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IMAPI CD-Burning COM Service service failed to start due to the following error:
%%1053
Error: (12/25/2014 08:13:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
Error: (12/25/2014 08:05:46 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 192.168.1.2 for the Network Card with network address 485B39C1FC1B has been
denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
Error: (12/23/2014 11:58:41 PM) (Source: W32Time) (EventID: 29) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.
Error: (12/23/2014 11:58:41 PM) (Source: W32Time) (EventID: 17) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)
Error: (12/23/2014 11:58:24 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 192.168.1.2 for the Network Card with network address 485B39C1FC1B has been
denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
Error: (12/23/2014 11:41:13 PM) (Source: Windows Update Agent) (EventID: 16) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.
Error: (12/21/2014 10:53:52 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 192.168.1.2 for the Network Card with network address 485B39C1FC1B has been
denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
Microsoft Office Sessions:
=========================
Error: (12/28/2014 05:55:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST.exe27.12.2014.0hungapp0.0.0.000000000
Error: (12/27/2014 03:18:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.001faa2a2
Error: (12/25/2014 09:38:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.0006bf707
Error: (12/25/2014 09:37:48 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe8.0.6001.18702hungapp0.0.0.000000000
Error: (12/24/2014 00:55:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.001f67290
Error: (12/16/2014 07:36:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.001f25fc6
Error: (12/10/2014 06:19:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.001e64402
Error: (12/06/2014 11:32:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.001f69535
Error: (12/05/2014 09:16:51 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)
Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)
Error: (11/28/2014 07:46:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: nmindexstoresvr.exe3.3.3.0unknown0.0.0.0006aa360
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Percentage of memory in use: 63%
Total physical RAM: 988.98 MB
Available physical RAM: 362.4 MB
Total Pagefile: 2434.1 MB
Available Pagefile: 1300.53 MB
Total Virtual: 2047.88 MB
Available Virtual: 1932.68 MB
==================== Drives ================================
Drive c: (Hard disk) (Fixed) (Total:232.88 GB) (Free:162.52 GB) NTFS ==>[Drive with boot components (Windows XP)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 232.9 GB) (Disk ID: 8E6E5993)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-28 07:40:03
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 ST3250820AS rev.3.AAC 232,88GB
Running: Gmer-19357.exe; Driver: C:\DOCUME~1\user\LOCALS~1\Temp\kfaiqfod.sys
---- System - GMER 2.1 ----
SSDT F7BA326C ZwClose
SSDT F7BA3226 ZwCreateKey
SSDT F7BA3276 ZwCreateSection
SSDT F7BA321C ZwCreateThread
SSDT F7BA322B ZwDeleteKey
SSDT F7BA3235 ZwDeleteValueKey
SSDT F7BA3267 ZwDuplicateObject
SSDT F7BA323A ZwLoadKey
SSDT F7BA3208 ZwOpenProcess
SSDT F7BA320D ZwOpenThread
SSDT F7BA328F ZwQueryValueKey
SSDT F7BA3244 ZwReplaceKey
SSDT F7BA3280 ZwRequestWaitReplyPort
SSDT F7BA323F ZwRestoreKey
SSDT F7BA327B ZwSetContextThread
SSDT F7BA3285 ZwSetSecurityObject
SSDT F7BA3230 ZwSetValueKey
SSDT F7BA328A ZwSystemDebugControl
SSDT F7BA3217 ZwTerminateProcess
Code \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation) KeInsertQueueApc
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeInsertQueueApc 804FC4EA 5 Bytes JMP F769F008 \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys (Malwarebytes Chameleon Protection Driver/Malwarebytes Corporation)
? khjisng.sys The system cannot find the file specified. !
C:\Program Files\CyberLink\PowerDVD8\000.fcl entry point in "" section [0xA7EC641C]
.clc C:\Program Files\CyberLink\PowerDVD8\000.fcl unknown last code section [0xA7EC7000, 0x1000, 0xE0000020]
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\SearchIndexer.exe[264] kernel32.dll!WriteFile 7C8112FF 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\512823176\Groups@\x9f\3Ό\3\xac\3\x384\3µ\3Β\3 0
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\512823176\Groups@\x2018\3\xb3\3\xb1\3ΐ\3\xb7\3Ό\3\xad\3\xbd\3\xb1\3 1
---- EOF - GMER 2.1 ----
Mein Rechner ist wirklich sehr langsam! |
|
29.12.2014, 08:29
| #6 |
| /// the machine /// TB-Ausbilder | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! XP? UNd du bist noch Online mit der Kiste?? Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ --> PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! |
|
30.12.2014, 02:38
| #7 |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Klar, ist ein sehr gutes und stabiles Betriebssystem. Den Schritt mit dem Revo-Uninstaller habe ich ohne Zwischenfälle ausgeführt. Hier das Ergebnis des Combofix-Suchlaufs: Code:
ATTFilter ComboFix 14-12-25.01 - user 29/12/2014 22:18:04.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1253.30.1033.18.989.258 [GMT 2:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\user\LOCALS~1\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\documents and settings\All Users\Application Data\A3F86172C0.sys
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{307BD415-B3E6-4E60-962A-FEF793237322}\PostBuild.exe
c:\documents and settings\user\Local Settings\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
((((((((((((((((((((((((( Files Created from 2014-11-28 to 2014-12-29 )))))))))))))))))))))))))))))))
.
.
2014-12-29 19:01 . 2014-12-29 19:01 -------- d-----w- c:\program files\VS Revo Group
2014-12-28 16:42 . 2014-12-28 16:42 -------- d-----w- c:\program files\7-Zip
2014-12-28 02:52 . 2014-12-28 03:58 -------- d-----w- C:\FRST
2014-12-27 13:32 . 2014-12-29 20:09 114904 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-12-27 13:31 . 2014-11-21 04:14 54360 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-12-27 13:31 . 2014-11-21 04:14 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-12-27 13:31 . 2014-12-27 13:31 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-12-27 13:31 . 2014-12-27 13:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-23 22:40 . 2013-01-08 09:03 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-12-23 22:40 . 2013-01-08 09:03 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-10-14 18:19 . 2013-07-30 18:47 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-10-14 18:19 . 2013-07-30 18:47 98160 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
.
.
.
.
[7] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys
[7] 2008-04-14 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[7] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys
[7] 2008-04-14 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
.
[7] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[7] 2008-04-14 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
.
[7] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
[7] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
[7] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219\SP3QFE\browser.dll
[7] 2008-04-14 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2705219$\browser.dll
.
[7] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[7] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe
.
[7] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[7] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll
.
[7] 2008-04-14 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[7] 2008-04-14 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll
.
[7] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[7] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll
.
[7] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[7] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[7] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[7] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll
.
[7] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[7] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[7] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[7] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe
.
[7] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[7] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe
.
[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
.
[7] 2012-06-02 . 2E0B0A051FFAA86E358465BB0880D453 . 53784 . . [7.6.7600.256] . . c:\windows\system32\wuauclt.exe
[7] 2012-06-02 . 2E0B0A051FFAA86E358465BB0880D453 . 53784 . . [7.6.7600.256] . . c:\windows\system32\dllcache\wuauclt.exe
.
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[7] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[7] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[7] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[7] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[7] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
[7] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[7] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll
.
[7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[7] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[7] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[7] 2008-04-14 12:00 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll
.
[7] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[7] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll
.
[7] 2014-03-12 . 4A45B692D2BAA74124DF57472D5EA2F1 . 993280 . . [5.1.2600.6532] . . c:\windows\system32\kernel32.dll
[7] 2014-03-12 . 4A45B692D2BAA74124DF57472D5EA2F1 . 993280 . . [5.1.2600.6532] . . c:\windows\system32\dllcache\kernel32.dll
[7] 2012-10-03 . 6FE42512AB1B89F32A7407F261B1D2D0 . 990208 . . [5.1.2600.6293] . . c:\windows\$NtUninstallKB2922229$\kernel32.dll
[7] 2012-10-03 . 6CBFEEB384F04681AF75F495AA48DD32 . 991744 . . [5.1.2600.6293] . . c:\windows\$hf_mig$\KB2758857\SP3QFE\kernel32.dll
[7] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB2758857$\kernel32.dll
[7] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[7] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
.
[7] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[7] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll
.
[7] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[7] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
.
[7] 2014-04-30 . 3DB2624CCB1663BF6D62311B2B9E7B55 . 6022144 . . [8.00.6001.23588] . . c:\windows\system32\mshtml.dll
[7] 2014-04-30 . 3DB2624CCB1663BF6D62311B2B9E7B55 . 6022144 . . [8.00.6001.23588] . . c:\windows\system32\dllcache\mshtml.dll
[7] 2014-03-06 . 0964EFC80BD54FDF37397A09FDAE8395 . 6021632 . . [8.00.6001.23580] . . c:\windows\ie8updates\KB2964358-IE8\mshtml.dll
[7] 2014-02-24 . 427C63C2075ABF62FAA897BBD3DE44F4 . 6022144 . . [8.00.6001.23569] . . c:\windows\ie8updates\KB2936068-IE8\mshtml.dll
[7] 2014-02-05 . 516E371CC348141277A73EB9D3C25951 . 6021120 . . [8.00.6001.23562] . . c:\windows\ie8updates\KB2925418-IE8\mshtml.dll
.
[7] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[7] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll
[7] 2008-04-14 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[7] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
.
[7] 2008-06-20 . 832E4DD8964AB7ACC880B2837CB1ED20 . 245248 . . [5.1.2600.5625] . . c:\windows\$NtUninstallKB2509553$\mswsock.dll
[7] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[7] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[7] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[7] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[7] 2008-04-14 . B4138E99236F0F57D4CF49BAE98A0746 . 245248 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll
.
[7] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[7] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll
.
[7] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[7] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll
.
[7] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[7] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll
.
[7] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[7] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll
.
[7] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[7] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe
.
[7] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[7] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll
.
[7] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[7] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll
.
[7] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[7] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe
.
[7] 2014-03-06 . 8AF91E4B4C1F5338EBE1548117304296 . 920064 . . [8.00.6001.23580] . . c:\windows\system32\wininet.dll
[7] 2014-03-06 . 8AF91E4B4C1F5338EBE1548117304296 . 920064 . . [8.00.6001.23580] . . c:\windows\system32\dllcache\wininet.dll
[7] 2014-02-24 . C29C1990C6CA8D7B098318F5887C3BDC . 920064 . . [8.00.6001.23569] . . c:\windows\ie8updates\KB2936068-IE8\wininet.dll
[7] 2014-02-05 . E09551776D365BCA891BBFFB31EE4B4C . 920064 . . [8.00.6001.23562] . . c:\windows\ie8updates\KB2925418-IE8\wininet.dll
[7] 2013-10-29 . FBF173582874C30EC5FAF8F8A67D873E . 920064 . . [8.00.6001.23543] . . c:\windows\ie8updates\KB2909921-IE8\wininet.dll
[7] 2013-10-13 . C5ACAB147F9697F40ECEBB4BC0247EBF . 920064 . . [8.00.6001.23536] . . c:\windows\ie8updates\KB2898785-IE8\wininet.dll
[7] 2013-09-23 . D73F1BE00684E675571015B3A5880F5B . 920064 . . [8.00.6001.23532] . . c:\windows\ie8updates\KB2888505-IE8\wininet.dll
[7] 2013-08-08 . F1BD516A4446B737BAEFB9FBAA92F01A . 920064 . . [8.00.6001.23520] . . c:\windows\ie8updates\KB2879017-IE8\wininet.dll
[7] 2013-07-26 . D46E195D0C76D430D73576CDAC763F78 . 920064 . . [8.00.6001.23515] . . c:\windows\ie8updates\KB2870699-IE8\wininet.dll
[7] 2013-06-07 . C087CC88D7CD554409CBB5EBC29E8E38 . 920064 . . [8.00.6001.23507] . . c:\windows\ie8updates\KB2862772-IE8\wininet.dll
[7] 2013-05-07 . CE5BA470204A3176E60721C4B63B8DF3 . 920064 . . [8.00.6001.23499] . . c:\windows\ie8updates\KB2846071-IE8\wininet.dll
[7] 2013-04-16 . 5C4AAC5A91422C95522ECC6C26FB93C8 . 920064 . . [8.00.6001.23486] . . c:\windows\ie8updates\KB2838727-IE8\wininet.dll
[7] 2013-03-02 . DA5B96A293B006572209E5EAC9F3A045 . 916480 . . [8.00.6001.19412] . . c:\windows\ie8updates\KB2829530-IE8\wininet.dll
[7] 2013-03-02 . 43EADBA9F3CD2A5F01B189BD95FCDE95 . 920064 . . [8.00.6001.23480] . . c:\windows\$hf_mig$\KB2817183-IE8\SP3QFE\wininet.dll
[7] 2013-02-05 . 5AACF4B4DEE1972B7952E8A747122232 . 916480 . . [8.00.6001.19401] . . c:\windows\ie8updates\KB2817183-IE8\wininet.dll
[7] 2013-02-05 . BE30BEF4C13065D09772F9895FCB9D22 . 920064 . . [8.00.6001.23469] . . c:\windows\$hf_mig$\KB2809289-IE8\SP3QFE\wininet.dll
[7] 2012-12-26 . D175F91A4C98B8848818C9B5089F88A2 . 916480 . . [8.00.6001.19394] . . c:\windows\ie8updates\KB2809289-IE8\wininet.dll
[7] 2012-12-26 . B8BEF9519A1B124DEAF94081F6C5A767 . 920064 . . [8.00.6001.23462] . . c:\windows\$hf_mig$\KB2792100-IE8\SP3QFE\wininet.dll
[7] 2012-11-01 . 9AD88EA663124336E88EB031F917CE20 . 916992 . . [8.00.6001.19389] . . c:\windows\ie8updates\KB2792100-IE8\wininet.dll
[7] 2012-11-01 . ACC92628CFFF9BB6F8886329888014A8 . 920064 . . [8.00.6001.23458] . . c:\windows\$hf_mig$\KB2761465-IE8\SP3QFE\wininet.dll
[7] 2012-08-28 . FF1C14BCA1A797CE45DD359FA2C9EDA8 . 916992 . . [8.00.6001.19328] . . c:\windows\ie8updates\KB2761465-IE8\wininet.dll
[7] 2012-08-28 . DCEA3B3193B7181CF818ECC4EAB30A66 . 920064 . . [8.00.6001.23415] . . c:\windows\$hf_mig$\KB2744842-IE8\SP3QFE\wininet.dll
[7] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\ie8updates\KB2744842-IE8\wininet.dll
[7] 2012-07-02 . EFB2241DE3AA6480521A16D0CB67B0EC . 920064 . . [8.00.6001.23385] . . c:\windows\$hf_mig$\KB2722913-IE8\SP3QFE\wininet.dll
[7] 2012-05-16 . 6B1774334E2975AA60596E54F5EA1430 . 916992 . . [8.00.6001.19272] . . c:\windows\ie8updates\KB2722913-IE8\wininet.dll
[7] 2012-05-16 . 553AD35768CD27959391DD5AA82CEF6F . 920064 . . [8.00.6001.23359] . . c:\windows\$hf_mig$\KB2699988-IE8\SP3QFE\wininet.dll
[7] 2012-03-01 . 009E7B4C284F080608D7286484015EE5 . 916992 . . [8.00.6001.19222] . . c:\windows\ie8updates\KB2699988-IE8\wininet.dll
[7] 2012-03-01 . 4EC67FAB39F37626AD6D9895FC094ABF . 919552 . . [8.00.6001.23318] . . c:\windows\$hf_mig$\KB2675157-IE8\SP3QFE\wininet.dll
[7] 2011-12-17 . F362D50FBDC6E34918DF41BDE1770E5C . 916992 . . [8.00.6001.19190] . . c:\windows\ie8updates\KB2675157-IE8\wininet.dll
[7] 2011-12-17 . 84A48E9818E8440DDBFD8EEC37C8A937 . 919552 . . [8.00.6001.23286] . . c:\windows\$hf_mig$\KB2647516-IE8\SP3QFE\wininet.dll
[7] 2011-11-04 . 552263502EA8C24D301A0C43FF90B3ED . 916992 . . [8.00.6001.19165] . . c:\windows\ie8updates\KB2647516-IE8\wininet.dll
[7] 2011-11-04 . 4E4716CAF514717814D07113AD0425B6 . 919552 . . [8.00.6001.23261] . . c:\windows\$hf_mig$\KB2618444-IE8\SP3QFE\wininet.dll
[7] 2011-08-22 . 1A377838B4B468E37C3EEB5BAA24F925 . 916480 . . [8.00.6001.19131] . . c:\windows\ie8updates\KB2618444-IE8\wininet.dll
[7] 2011-08-22 . 19630AEBBFAEB06984CAB91848270AAF . 919552 . . [8.00.6001.23227] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\wininet.dll
[7] 2011-06-23 . AF4EDDC6C0446FCE5681B5DED52B8F0E . 916480 . . [8.00.6001.19098] . . c:\windows\ie8updates\KB2586448-IE8\wininet.dll
.
[7] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[7] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll
.
[7] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[7] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll
.
[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[7] 2013-08-05 . 59B408E5B8489B0B36A0D783D150EDCC . 1289728 . . [5.1.2600.6435] . . c:\windows\system32\ole32.dll
[7] 2013-08-05 . 59B408E5B8489B0B36A0D783D150EDCC . 1289728 . . [5.1.2600.6435] . . c:\windows\system32\dllcache\ole32.dll
[7] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\$NtUninstallKB2876217$\ole32.dll
[7] 2011-11-01 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$hf_mig$\KB2624667\SP3QFE\ole32.dll
[7] 2010-07-16 . 7A6A7900B5E322763430BA6FD9A31224 . 1288192 . . [5.1.2600.6010] . . c:\windows\$NtUninstallKB2624667$\ole32.dll
[7] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[7] 2008-04-14 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll
.
[7] 2013-07-10 . 1D845821F5ADB076831DE4C2818F858B . 406016 . . [1.0420.2600.6421] . . c:\windows\system32\usp10.dll
[7] 2013-07-10 . 1D845821F5ADB076831DE4C2818F858B . 406016 . . [1.0420.2600.6421] . . c:\windows\system32\dllcache\usp10.dll
[7] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\$NtUninstallKB2850869$\usp10.dll
[7] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[7] 2008-04-14 . 7D7D8501F3CB45D0408CDEFA08CDAEFF . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll
.
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ReinstallBackups\0012\DriverFiles\i386\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ReinstallBackups\0013\DriverFiles\i386\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ReinstallBackups\0014\DriverFiles\i386\ksuser.dll
[7] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ReinstallBackups\0015\DriverFiles\i386\ksuser.dll
.
[7] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[7] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe
.
[7] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[7] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[7] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
[7] 2008-04-14 . 1926899BF9FFE2602B63074971700412 . 135168 . . [6.00.2900.5512] . . c:\windows\$NtUninstallKB971029$\shsvcs.dll
.
[7] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll
[7] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msimg32.dll
.
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[7] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[7] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
.
[7] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[7] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll
.
[7] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[7] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[7] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[7] 2009-02-09 . 911DDF2E16761643A47225F654D811E5 . 714752 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB2393802$\ntdll.dll
[7] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[7] 2008-04-14 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntdll.dll
.
[7] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\msctfime.ime
[7] 2009-02-27 . 3F790874A85819E94574F3E7AF9C5806 . 177152 . . [5.1.2600.5768] . . c:\windows\system32\dllcache\msctfime.ime
[7] 2009-02-27 . 30B7D847BA9075AA8E1122FB6AF3D1B5 . 177152 . . [5.1.2600.5768] . . c:\windows\$hf_mig$\KB961503\SP3QFE\msctfime.ime
[7] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB961503$\msctfime.ime
.
[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll
.
[7] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[7] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll
.
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[7] 2008-04-14 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
.
[7] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[7] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll
.
[7] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[7] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll
.
[7] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[7] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll
.
[7] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[7] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll
.
[7] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll
[7] 2008-04-14 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\appmgmts.dll
.
[7] 2008-04-14 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[7] 2008-04-13 19:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys
[7] 2008-04-13 19:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
.
[7] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys
[7] 2008-04-14 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[7] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[7] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[7] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
[7] 2008-04-14 12:00 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll
.
[7] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[7] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll
.
[7] 2008-04-14 12:00 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[7] 2004-08-10 22:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[7] 2004-08-10 22:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\MsPMSNSv.dll
[7] 2004-08-10 22:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\dllcache\mspmsnsv.dll
.
[7] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2013-07-04 . 05F3DB567EAE368AE3BBD7E973490646 . 2028544 . . [5.1.2600.6419] . . c:\windows\system32\ntkrnlpa.exe
[7] 2013-07-04 . 4C47B37CF351FFEB1227CED0FF4751D5 . 2070144 . . [5.1.2600.6419] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2013-05-03 . 70F7DF7268C6AB388319A03375DAC4E5 . 2028544 . . [5.1.2600.6387] . . c:\windows\$NtUninstallKB2859537$\ntkrnlpa.exe
[7] 2013-03-07 . 9EBEDA306E5EABDABCFF8B695FCD4CD6 . 2070016 . . [5.1.2600.6368] . . c:\windows\$hf_mig$\KB2813170\SP3QFE\ntkrnlpa.exe
[7] 2013-03-07 . 9ED39805DF38061BB031D0F2B20DFB77 . 2028544 . . [5.1.2600.6368] . . c:\windows\$NtUninstallKB2839229$\ntkrnlpa.exe
[7] 2013-01-07 . 1251D608DFCE4B6801AD27A59B74985C . 2069760 . . [5.1.2600.6335] . . c:\windows\$hf_mig$\KB2799494\SP3QFE\ntkrnlpa.exe
[7] 2013-01-07 . 2C9091C3350E369BBB2464AABE2FD7CA . 2027520 . . [5.1.2600.6335] . . c:\windows\$NtUninstallKB2813170$\ntkrnlpa.exe
[7] 2012-08-21 . B326D5E256D2F32B23E64F49DEBCE31B . 2069632 . . [5.1.2600.6284] . . c:\windows\$hf_mig$\KB2724197\SP3QFE\ntkrnlpa.exe
[7] 2012-08-21 . 61027EE2D9859A2B41D588D92F256CFB . 2027520 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2799494$\ntkrnlpa.exe
[7] 2012-05-04 . 8E99A0CE02C1BEDA6C0935A4DDE9CEAA . 2069120 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntkrnlpa.exe
[7] 2012-05-04 . 87763BB6C95901818050E52C378C9E15 . 2026496 . . [5.1.2600.6223] . . c:\windows\$NtUninstallKB2724197$\ntkrnlpa.exe
[7] 2012-04-11 . 063A0F8A90D8E2B802E5243FE9AABCF3 . 2069120 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntkrnlpa.exe
[7] 2012-04-11 . 61CCE48F7BD00E0E4D5CDE206F2DDC1B . 2026496 . . [5.1.2600.6206] . . c:\windows\$NtUninstallKB2707511$\ntkrnlpa.exe
[7] 2011-10-25 . DB19FFF0C805664CB95062C027B11FE9 . 2069376 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntkrnlpa.exe
[7] 2011-10-25 . 36CAC3C8C4C10F4E21BFEABBFE7ACFFC . 2027008 . . [5.1.2600.6165] . . c:\windows\$NtUninstallKB2676562$\ntkrnlpa.exe
[7] 2010-12-09 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
[7] 2010-12-09 . 9ED77E2307F6EC6F174C063C15AA3B8C . 2027008 . . [5.1.2600.6055] . . c:\windows\$NtUninstallKB2633171$\ntkrnlpa.exe
[7] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[7] 2010-04-27 . 49E936E1398D1A536E84CD5D068F0F09 . 2024448 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntkrnlpa.exe
[7] 2009-02-06 . 65D4220799E6FC2CB079070A6393CC0E . 2023936 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
[7] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-04-14 . 7F653A89F6E89E3AE0D49830EECE35D4 . 2023936 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
.
[7] 2008-04-14 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[7] 2008-04-14 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll
.
[7] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[7] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll
.
[7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[7] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll
.
[7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[7] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll
.
[7] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[7] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll
.
[7] 2008-04-14 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[7] 2008-04-14 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll
.
[7] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[7] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
.
[7] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[7] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll
.
[7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\ie8\iexplore.exe
.
.
[7] 2013-07-04 . AFEE19399CF992A098309F7FDF87880A . 2149888 . . [5.1.2600.6419] . . c:\windows\system32\ntoskrnl.exe
[7] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2013-07-04 . A4A50A53FFBFEC545CDA85E98AF2106B . 2193536 . . [5.1.2600.6419] . . c:\windows\system32\dllcache\ntoskrnl.exe
[7] 2013-05-03 . 0F1ECE75329996EBDCF2774F9E46623D . 2149888 . . [5.1.2600.6387] . . c:\windows\$NtUninstallKB2859537$\ntoskrnl.exe
[7] 2013-03-07 . 8C39722F8C291F1BBCCE80EE23065897 . 2149888 . . [5.1.2600.6368] . . c:\windows\$NtUninstallKB2839229$\ntoskrnl.exe
[7] 2013-03-07 . 9FC16E5EBFE88F3C844FFE2E6CB7F1E8 . 2193536 . . [5.1.2600.6368] . . c:\windows\$hf_mig$\KB2813170\SP3QFE\ntoskrnl.exe
[7] 2013-01-07 . AE2FEE63789F5DF6B19DD9A39E26D03E . 2193152 . . [5.1.2600.6335] . . c:\windows\$hf_mig$\KB2799494\SP3QFE\ntoskrnl.exe
[7] 2013-01-07 . DD5A89274B47499CCFF7ADCA3A3C560E . 2148864 . . [5.1.2600.6335] . . c:\windows\$NtUninstallKB2813170$\ntoskrnl.exe
[7] 2012-08-21 . ECA5980E1A78DBF9CB7F49F76791C0D1 . 2193024 . . [5.1.2600.6284] . . c:\windows\$hf_mig$\KB2724197\SP3QFE\ntoskrnl.exe
[7] 2012-08-21 . B9A14D5875CE262774388BD43BA56FF3 . 2148864 . . [5.1.2600.6284] . . c:\windows\$NtUninstallKB2799494$\ntoskrnl.exe
[7] 2012-05-04 . 099A0F80A563EBE935F4A9750F96C219 . 2192640 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntoskrnl.exe
[7] 2012-05-04 . AC4B3C4A6DC31867034C66663B9B8A38 . 2148352 . . [5.1.2600.6223] . . c:\windows\$NtUninstallKB2724197$\ntoskrnl.exe
[7] 2012-04-11 . 8D061BB825BC606C2B1C6F7452D1BAAA . 2192640 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntoskrnl.exe
[7] 2012-04-11 . A144D60B35E6DD14CCB9649B5E0D1092 . 2148352 . . [5.1.2600.6206] . . c:\windows\$NtUninstallKB2707511$\ntoskrnl.exe
[7] 2011-10-25 . 3B663B9B193D7E1DE39A466020F1FD91 . 2148864 . . [5.1.2600.6165] . . c:\windows\$NtUninstallKB2676562$\ntoskrnl.exe
[7] 2011-10-25 . F512C662874D7545E5BD8005E6800A44 . 2192768 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntoskrnl.exe
[7] 2010-12-09 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
[7] 2010-12-09 . 60E16152D847D7A7B7D3DA4C4B8E2120 . 2148864 . . [5.1.2600.6055] . . c:\windows\$NtUninstallKB2633171$\ntoskrnl.exe
[7] 2010-04-27 . 466A3E1239F4A9428797730E81A7A865 . 2146304 . . [5.1.2600.5973] . . c:\windows\$NtUninstallKB2393802$\ntoskrnl.exe
[7] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[7] 2009-02-07 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2009-02-06 . 0CBA44D0938D57F334C0862424148B70 . 2145280 . . [5.1.2600.5755] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
[7] 2008-04-14 . 40F8880122A030A7E9E1FEDEA833B33D . 2145280 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
.
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[7] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[7] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
[7] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll
.
[7] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[7] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll
.
[7] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[7] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll
.
[7] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[7] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll
.
[7] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[7] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wshtcpip.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{D8278076-BC68-4484-9233-6E7F1628B56C}"= "c:\program files\AskPartnerNetwork\Toolbar\searchhook.dll" [2014-10-30 74648]
.
[HKEY_CLASSES_ROOT\clsid\{d8278076-bc68-4484-9233-6e7f1628b56c}]
[HKEY_CLASSES_ROOT\TypeLib\{7C4EE486-5EA5-4683-8C23-BF520933BB5E}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-10-30 16:56 12184 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-10-30 12184]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-10-30 12184]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-10-01 22065760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-08-28 33673216]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-25 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-25 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-25 136192]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-05-13 172032]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-12 204136]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-12-19 702768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2013-03-20 162856]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-05-13 49152]
"ehTray"="c:\windows\ehome\ehtray.exe" [2008-04-14 50176]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-07 75048]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-11-21 2039192]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-11-20 126200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [30/7/2013 8:47 μμ 37352]
R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [27/8/2010 1:03 πμ 13440]
R1 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [27/12/2014 3:31 μμ 54360]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [7/10/2008 7:31 μμ 61424]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [30/7/2013 8:47 μμ 431920]
R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [30/7/2013 8:47 μμ 992560]
R2 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [30/10/2014 6:56 μμ 166296]
R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [20/11/2014 2:13 μμ 166192]
R2 MBAMScheduler;MBAMScheduler;c:\program files\ Malwarebytes Anti-Malware \mbamscheduler.exe [27/12/2014 3:31 μμ 1871160]
R2 MBAMService;MBAMService;c:\program files\ Malwarebytes Anti-Malware \mbamservice.exe [27/12/2014 3:31 μμ 969016]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17/4/2007 7:09 μμ 11032]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [27/8/2010 1:03 πμ 320512]
R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [27/8/2010 1:03 πμ 75904]
R3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [27/8/2010 1:03 πμ 396032]
R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [27/8/2010 1:03 πμ 17792]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/12/2014 3:31 μμ 23256]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [27/12/2014 3:32 μμ 114904]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [27/8/2010 1:13 πμ 1390976]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\HCW88bda.sys [27/8/2010 1:03 πμ 130112]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2014-12-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-08 22:40]
.
2014-12-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-31 05:59]
.
2014-12-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-31 05:59]
.
2014-12-29 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Logon.job
- c:\windows\system32\xp_eos.exe [2014-03-09 01:59]
.
2014-12-08 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
- c:\windows\system32\xp_eos.exe [2014-03-09 01:59]
.
2014-12-29 c:\windows\Tasks\User_Feed_Synchronization-{90D0AD61-E914-4728-AD27-128A15D455DF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: Ε&ξαγωγή στο Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\
FF - prefs.js: browser.startup.homepage - hxxp://gr.msn.com/?pc=UP97&ocid=UP97DHP
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF - ExtSQL: !HIDDEN! 2010-08-27 10:43; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2013-02-27 20:17; 4zffxtbr@VideoDownloadConverter_4z.com; c:\program files\VideoDownloadConverter_4z\bar\1.bin
.
- - - - ORPHANS REMOVED - - - -
.
c:\documents and settings\user\Start Menu\Programs\Startup\LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe -startup
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-12-29 23:00
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b9,e0,dc,80,f8,86,45,4f,8f,b1,f2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b9,e0,dc,80,f8,86,45,4f,8f,b1,f2,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(744)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(4132)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Windows Desktop Search\WindowsSearch.exe
c:\program files\ Malwarebytes Anti-Malware \mbam.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\SearchProtocolHost.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2014-12-29 23:30:27 - machine was rebooted
ComboFix-quarantined-files.txt 2014-12-29 21:30
.
Pre-Run: 173.968.887.808 bytes free
Post-Run: 181.885.206.528 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 2622498CA60F47DFE6C0F8B2EBA782F1
8F558EB6672622401DA993E1E865C861
|
|
30.12.2014, 19:01
| #8 | |
| /// the machine /// TB-Ausbilder | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Zitat:
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.12.2014, 20:55
| #9 | |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Zitat:
Hier die neuen Logs: MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 31/12/2014 Suchlauf-Zeit: 3:09:26 pm Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.30.08 Rootkit Datenbank: v2014.12.30.01 Lizenz: Testversion Malware Schutz: Aktiviert Bosartiger Webseiten Schutz: Aktiviert Selbstschutz: Aktiviert Betriebssystem: Windows XP Service Pack 3 CPU: x86 Dateisystem: NTFS Benutzer: user Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 310538 Verstrichene Zeit: 37 Min, 26 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schadliche Elemente erkannt) Module: 0 (Keine schadliche Elemente erkannt) Registrierungsschlussel: 0 (Keine schadliche Elemente erkannt) Registrierungswerte: 0 (Keine schadliche Elemente erkannt) Registrierungsdaten: 0 (Keine schadliche Elemente erkannt) Ordner: 0 (Keine schadliche Elemente erkannt) Dateien: 0 (Keine schadliche Elemente erkannt) Physische Sektoren: 0 (Keine schadliche Elemente erkannt) (end) AdwCleaner Code:
ATTFilter # AdwCleaner v4.106 - Report created 31/12/2014 at 11:59:40
# Updated 21/12/2014 by Xplode
# Database : 2014-12-21.4 [Local]
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : user - USER-5FB402D855
# Running from : C:\Documents and Settings\user\Desktop\AdwCleaner_4.106.exe
# Option : Clean
***** [ Services ] *****
Service Deleted : APNMCP
Service Deleted : Skype C2C Service
***** [ Files / Folders ] *****
Folder Deleted : C:\Documents and Settings\All Users\Application Data\apn
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AskPartnerNetwork
Folder Deleted : C:\Documents and Settings\All Users\Application Data\SecTaskMan
Folder Deleted : C:\Program Files\AskPartnerNetwork
Folder Deleted : C:\Program Files\driver-soft
Folder Deleted : C:\DOCUME~1\user\LOCALS~1\Temp\apn
Folder Deleted : C:\Documents and Settings\user\Local Settings\Application Data\AskPartnerNetwork
Folder Deleted : C:\Documents and Settings\user\Local Settings\Application Data\iac
Folder Deleted : C:\Documents and Settings\user\My Documents\drivergenius
File Deleted : C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\searchplugins\ask-search.xml
File Deleted : C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\searchplugins\bingp.xml
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.apn.native_messaging_host_aaaaacalgebmfelllfiaoknifldpngjh
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BC153A3C-0BB7-4EED-83AE-28E6E398F56E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{38122A36-83B2-46B8-B39A-EC72A4614A07}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{41564952-412D-5637-00A7-7A786E7484D7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{38122A36-83B2-46B8-B39A-EC72A4614A07}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D9083CE-8758-4704-BA57-3C891D7452BD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{41564952-412D-5637-00A7-7A786E7484D7}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D8278076-BC68-4484-9233-6E7F1628B56C}]
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}
Key Deleted : HKCU\Software\AskPartnerNetwork
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\AskPartnerNetwork
Key Deleted : HKLM\SOFTWARE\Driver-Soft
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\VideoDownloadConverter_4zbar Uninstall
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.6001.18702
-\\ Mozilla Firefox v34.0 (x86 el)
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [5048 octets] - [31/12/2014 11:53:43]
AdwCleaner[S0].txt - [4819 octets] - [31/12/2014 11:59:40]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4879 octets] ##########
JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Microsoft Windows XP x86
Ran by user on Wed 31/12/2014 at 16:13:33,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files\free youtube downloader"
~~~ FireFox
Emptied folder: C:\Documents and Settings\user\Application Data\mozilla\firefox\profiles\r4602zj1.default\minidumps [31 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 31/12/2014 at 16:18:11,79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Lieber Schrauber, ich wünsche Dir einen guten Rutsch ins neue Jahr!!!  |
|
31.12.2014, 22:27
| #10 | |
| /// the machine /// TB-Ausbilder | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Zitat:
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.01.2015, 05:20
| #11 | |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Zitat:
Hier die neuen Ergebnisse: (Um es gleich vorwegzunehmen: ESET hat mir 7 Funde gemeldet.) FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014 Ran by user (administrator) on USER-5FB402D855 on 01-01-2015 04:55:59 Running from C:\Documents and Settings\user\Desktop Loaded Profiles: user & (Available profiles: user) Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehSched.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (VIA Technologies, Inc.) C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe (Hewlett-Packard Company) C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (HP) C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe (Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Microsoft Corporation) C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Prolific Technology Inc.) C:\WINDOWS\system32\IoctlSvc.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1753192 2010-07-07] () HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [33673216 2009-08-28] (VIA Technologies, Inc.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2007-12-14] () HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-02-28] (Nero AG) HKLM\...\Run: [NBKeyScan] => C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-02-18] (Nero AG) HKLM\...\Run: [HP Component Manager] => C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [241664 2003-12-22] (Hewlett-Packard Company) HKLM\...\Run: [HPDJ Taskbar Utility] => C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [172032 2004-05-13] (HP) HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-19] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [83240 2008-03-20] (Cyberlink Corp.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2010-08-10] (Apple Inc.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [49152 2004-05-13] (Hewlett-Packard Company) HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [50176 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = BHO: Βοηθός εισόδου του Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) Toolbar: HKU\.DEFAULT -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default FF SearchEngineOrder.1: Ask Search FF SearchEngineOrder.3: Bing FF Homepage: hxxp://gr.msn.com/?pc=UP97&ocid=UP97DHP FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q= FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-02] FF Extension: Flash Video Downloader - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\artur.dubovoy@gmail.com.xpi [2013-12-30] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-02] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-08-27] Chrome: ======= CHR Profile: C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\User Data\Default CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-19] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [98160 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG) S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) R1 HCW88AUD; C:\WINDOWS\System32\drivers\hcw88aud.sys [13440 2009-02-25] (Hauppauge Computer Works, Inc) S3 HCW88BDA; C:\WINDOWS\System32\drivers\hcw88bda.sys [130112 2005-03-15] (Hauppauge Computer Works, Inc) [File not signed] R3 HCW88TSE; C:\WINDOWS\System32\drivers\hcw88tse.sys [320512 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88TUNE; C:\WINDOWS\System32\drivers\hcw88tun.sys [75904 2009-02-25] (Hauppauge Computer Works, Inc.) R3 hcw88vid; C:\WINDOWS\System32\drivers\hcw88vid.sys [396032 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88XBAR; C:\WINDOWS\System32\drivers\HCW88BAR.sys [17792 2009-02-25] (Hauppauge Computer Works, Inc.) R1 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [54360 2014-11-21] (Malwarebytes Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-01] (Malwarebytes Corporation) S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation) R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-07-30] (Avira GmbH) R3 VIAHdAudAddService; C:\WINDOWS\System32\drivers\viahduaa.sys [1390976 2009-08-17] (VIA Technologies, Inc.) R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\CyberLink\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 CnxEtP; system32\DRIVERS\CnxEtP.sys [X] S3 CnxEtU; system32\DRIVERS\CnxEtU.sys [X] S3 CnxTgNP; system32\DRIVERS\CnxTgNP.sys [X] S4 IntelIde; No ImagePath ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-31 16:18 - 2014-12-31 16:18 - 00000814 _____ () C:\Documents and Settings\user\Desktop\JRT.txt 2014-12-31 16:13 - 2014-12-31 16:13 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-12-31 12:33 - 2014-12-31 12:33 - 00004959 _____ () C:\Documents and Settings\user\Desktop\AdwCleaner.txt 2014-12-31 11:53 - 2014-12-31 12:02 - 00000000 ____D () C:\AdwCleaner 2014-12-31 11:52 - 2014-12-31 11:52 - 00001201 _____ () C:\Documents and Settings\user\Desktop\mbam.txt 2014-12-30 23:52 - 2014-12-30 23:52 - 01707939 _____ (Thisisu) C:\Documents and Settings\user\Desktop\JRT.exe 2014-12-30 23:26 - 2014-12-30 23:47 - 02173952 _____ () C:\Documents and Settings\user\Desktop\AdwCleaner_4.106.exe 2014-12-30 17:37 - 2014-12-30 17:39 - 00000000 ____D () C:\Documents and Settings\user\Application Data\mIRC 2014-12-30 03:14 - 2014-12-30 03:14 - 00053714 _____ () C:\Documents and Settings\user\Desktop\Combofix.txt 2014-12-29 23:30 - 2014-12-29 23:30 - 00053714 _____ () C:\ComboFix.txt 2014-12-29 23:30 - 2014-12-29 23:30 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp 2014-12-29 23:30 - 2014-12-29 23:30 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp 2014-12-29 22:08 - 2014-12-29 22:08 - 00000000 _RSHD () C:\cmdcons 2014-12-29 22:08 - 2014-04-17 15:43 - 00000209 _____ () C:\Boot.bak 2014-12-29 22:08 - 2004-08-03 23:00 - 00260272 __RSH () C:\cmldr 2014-12-29 21:13 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe 2014-12-29 21:13 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe 2014-12-29 21:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe 2014-12-29 21:10 - 2014-12-29 23:30 - 00000000 ____D () C:\Qoobox 2014-12-29 21:10 - 2014-12-29 23:12 - 00000000 ____D () C:\WINDOWS\erdnt 2014-12-29 21:01 - 2014-12-29 21:01 - 00000926 _____ () C:\Documents and Settings\user\Desktop\Revo Uninstaller.lnk 2014-12-29 21:01 - 2014-12-29 21:01 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-12-29 19:01 - 2014-12-29 19:01 - 05603624 ____R (Swearware) C:\Documents and Settings\user\Desktop\ComboFix.exe 2014-12-29 18:58 - 2014-12-29 18:59 - 02623656 _____ (VS Revo Group Ltd.) C:\Documents and Settings\user\Desktop\revosetup95.exe 2014-12-28 18:47 - 2014-12-28 18:48 - 00060837 _____ () C:\Documents and Settings\user\Desktop\logfiles.zip 2014-12-28 18:42 - 2014-12-28 18:42 - 00000000 ____D () C:\Program Files\7-Zip 2014-12-28 18:42 - 2014-12-28 18:42 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip 2014-12-28 18:40 - 2014-12-28 18:40 - 01180834 _____ () C:\Documents and Settings\user\Desktop\7z935.exe 2014-12-28 17:31 - 2014-12-28 17:56 - 00052570 _____ () C:\Documents and Settings\user\Desktop\Avira scan 28120256.txt 2014-12-28 17:31 - 2014-12-28 17:54 - 00082638 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27122032.txt 2014-12-28 17:30 - 2014-12-28 17:52 - 00054796 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27121958.txt 2014-12-28 17:30 - 2014-12-28 17:51 - 00053684 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27121821.txt 2014-12-28 17:29 - 2014-12-28 17:50 - 00064958 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27120153.txt 2014-12-28 17:28 - 2014-12-28 17:49 - 00052908 _____ () C:\Documents and Settings\user\Desktop\Avira scan 23122355.txt 2014-12-28 17:16 - 2014-12-28 17:38 - 00006003 _____ () C:\Documents and Settings\user\Desktop\mbam prot 28120000.txt 2014-12-28 17:15 - 2014-12-28 17:37 - 00006565 _____ () C:\Documents and Settings\user\Desktop\mbam prot 27121533.txt 2014-12-28 17:14 - 2014-12-28 17:35 - 00001070 _____ () C:\Documents and Settings\user\Desktop\mbam scan 28120312.txt 2014-12-28 17:13 - 2014-12-28 17:35 - 00001068 _____ () C:\Documents and Settings\user\Desktop\mbam scan 27121942.txt 2014-12-28 07:40 - 2014-12-28 07:40 - 00005553 _____ () C:\Documents and Settings\user\Desktop\Gmer.txt 2014-12-28 05:57 - 2014-12-28 05:58 - 00026972 _____ () C:\Documents and Settings\user\Desktop\Addition.txt 2014-12-28 05:56 - 2015-01-01 04:57 - 00019342 _____ () C:\Documents and Settings\user\Desktop\FRST.txt 2014-12-28 05:55 - 2014-12-28 05:56 - 00000000 ____D () C:\Documents and Settings\user\Desktop\frst 2014-12-28 04:52 - 2015-01-01 04:56 - 00000000 ____D () C:\FRST 2014-12-28 03:43 - 2014-12-28 03:43 - 00380416 _____ () C:\Documents and Settings\user\Desktop\Gmer-19357.exe 2014-12-28 03:37 - 2014-12-28 03:38 - 00000470 _____ () C:\Documents and Settings\user\Desktop\defogger_disable.log 2014-12-28 03:37 - 2014-12-28 03:37 - 00000000 _____ () C:\Documents and Settings\user\defogger_reenable 2014-12-28 03:20 - 2014-12-28 03:20 - 01114624 _____ (Farbar) C:\Documents and Settings\user\Desktop\FRST.exe 2014-12-28 03:06 - 2014-12-28 03:06 - 00050477 _____ () C:\Documents and Settings\user\Desktop\Defogger.exe 2014-12-27 15:32 - 2015-01-01 03:01 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-12-27 15:31 - 2014-12-27 15:31 - 00000786 _____ () C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes 2014-12-27 15:31 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-12-27 15:31 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-12-24 02:43 - 2014-12-24 02:44 - 20447072 _____ (Malwarebytes Corporation ) C:\Documents and Settings\user\Desktop\mbam-setup-2.0.4.1028.exe 2014-12-19 22:21 - 2014-12-19 22:21 - 00000867 _____ () C:\Documents and Settings\All Users\Desktop\Avira.lnk 2014-12-02 18:18 - 2014-12-02 18:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-01 04:57 - 2010-08-27 12:47 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Temp 2015-01-01 04:42 - 2013-08-02 15:07 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-01-01 04:11 - 2010-08-31 19:53 - 00001172 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-01 03:00 - 2010-08-27 12:39 - 01619100 _____ () C:\WINDOWS\WindowsUpdate.log 2014-12-31 20:25 - 2010-08-27 09:26 - 00000420 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{90D0AD61-E914-4728-AD27-128A15D455DF}.job 2014-12-31 15:22 - 2010-08-27 12:46 - 00032440 _____ () C:\WINDOWS\SchedLgU.Txt 2014-12-31 14:25 - 2010-08-27 11:38 - 00000000 ____D () C:\Program Files\mIRC 2014-12-31 12:25 - 2013-01-09 01:22 - 00000000 ____D () C:\Documents and Settings\user\Application Data\Skype 2014-12-31 12:24 - 2010-08-27 08:30 - 00000159 _____ () C:\WINDOWS\wiadebug.log 2014-12-31 12:24 - 2010-08-27 08:30 - 00000000 _____ () C:\WINDOWS\wiaservc.log 2014-12-31 12:23 - 2014-03-10 16:11 - 00000220 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job 2014-12-31 12:23 - 2010-08-31 19:53 - 00001168 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-31 12:23 - 2010-08-27 12:46 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-12-31 12:21 - 2010-08-27 12:47 - 00000278 ___SH () C:\Documents and Settings\user\ntuser.ini 2014-12-31 04:24 - 2010-08-27 12:43 - 00000000 __SHD () C:\Documents and Settings\NetworkService 2014-12-30 05:31 - 2014-08-12 21:38 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat 2014-12-29 22:48 - 2008-04-14 14:00 - 00000227 _____ () C:\WINDOWS\system.ini 2014-12-29 22:08 - 2010-08-27 08:25 - 00000325 __RSH () C:\boot.ini 2014-12-29 18:19 - 2008-04-14 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl 2014-12-27 22:41 - 2010-08-30 18:47 - 00000000 ____D () C:\WINDOWS\system32\NtmsData 2014-12-27 20:33 - 2010-08-27 12:37 - 00000000 ____D () C:\WINDOWS\Registration 2014-12-27 20:13 - 2010-08-27 09:00 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$ 2014-12-26 23:29 - 2013-05-11 20:41 - 00000000 ____D () C:\Documents and Settings\user\Application Data\vlc 2014-12-26 21:41 - 2010-09-04 21:07 - 00010752 _____ () C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-24 00:55 - 2010-08-27 10:44 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Application Data\Adobe 2014-12-24 00:40 - 2013-01-08 11:03 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2014-12-24 00:40 - 2013-01-08 11:03 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2014-12-20 13:15 - 2014-08-12 16:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Package Cache 2014-12-19 22:58 - 2014-08-13 21:50 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-1767777339-1801674531-1003-0.dat 2014-12-19 22:21 - 2013-07-30 20:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Avira 2014-12-19 22:21 - 2013-07-30 20:46 - 00000000 ____D () C:\Program Files\Avira 2014-12-16 16:47 - 2010-09-04 21:14 - 00000000 ____D () C:\Elisa 2014-12-12 17:08 - 2013-07-15 21:24 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-12-12 16:40 - 2010-08-27 09:04 - 109818608 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-12-08 16:13 - 2014-03-10 16:11 - 00000214 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job 2014-12-03 16:01 - 2012-04-29 20:34 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service Some content of TEMP: ==================== C:\Documents and Settings\user\Local Settings\Temp\avgnt.exe C:\Documents and Settings\user\Local Settings\Temp\Quarantine.exe C:\Documents and Settings\user\Local Settings\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- ESET Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3a5bfbfa14772d44a9cdcbface214967
# engine=21782
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-02 03:06:01
# local_time=2015-01-02 05:06:01 (+0200, GTB Standard Time)
# lang=1031
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 18569 164670779 0 0
# scanned=149960
# found=7
# cleaned=0
# scan_time=18096
sh=AB82204973460EB709CE11A8C2F812B4630650F8 ft=1 fh=2101b8f5b625322d vn="Win32/DownWare.L evtl. unerwunschte Anwendung" ac=I fn="C:\bestmp4tomp3convertersetup.exe"
sh=AF6555924424F41ECA422BF491DAC0EE5520A8BC ft=1 fh=6e96d8d0bb7841f7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwunschte Anwendung" ac=I fn="C:\emule049c.exe"
sh=A6C007A1B3ADF6B691CBA35C1B5E06CAB772AB35 ft=1 fh=aed2bdfc0ee55c76 vn="Win32/Toolbar.Conduit evtl. unerwunschte Anwendung" ac=I fn="C:\zafwSetupWeb_110_000_020.exe"
sh=14A5B7B33B8A42CBF4BAA9AFE4559C1AEE79DD20 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwunschte Anwendung" ac=I fn="C:\Documents and Settings\user\Desktop\Backup\windows xp\Documents and Settings\Ελίζα\Start Menu\eBay.lnk"
sh=FD4DD9605A03F619D09B650452E8C81618578B3A ft=1 fh=4c256b24a244bc05 vn="Win32/Toolbar.AskSBar evtl. unerwunschte Anwendung" ac=I fn="C:\Documents and Settings\user\Desktop\Backup\windows xp\Nero 7 Premium Reloaded - 7.10.1.0\Nero-7.10.1.0_eng_update.exe"
sh=218C6B94ED39806A9DBE93DE5F5BC6443312356A ft=1 fh=8511264f200fb55e vn="Win32/InstallMonetizer.AF evtl. unerwunschte Anwendung" ac=I fn="C:\Documents and Settings\user\My Documents\Downloads\Subtitles13.exe"
sh=9D54BAF23397E5F1444BC6471052AD234B76FBD3 ft=1 fh=2ab58862c927227b vn="Win32/Toolbar.MyWebSearch.AA evtl. unerwunschte Anwendung" ac=I fn="C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165840.dll"
Code:
ATTFilter Results of screen317's Security Check version 0.99.93 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` CCleaner Java 7 Update 55 Java version 32-bit out of Date! Adobe Flash Player 16.0.0.235 Adobe Reader XI Mozilla Firefox (34.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 10% ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-12-2014 Ran by user (administrator) on USER-5FB402D855 on 02-01-2015 05:52:08 Running from C:\Documents and Settings\user\Desktop Loaded Profiles: user & (Available profiles: user) Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (VIA Technologies, Inc.) C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe (Hewlett-Packard Company) C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (HP) C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe (Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehSched.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe (cyberlink) C:\Program Files\CyberLink\Shared Files\brs.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Prolific Technology Inc.) C:\WINDOWS\system32\IoctlSvc.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [1753192 2010-07-07] () HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe [33673216 2009-08-28] (VIA Technologies, Inc.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2007-12-14] () HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-02-28] (Nero AG) HKLM\...\Run: [NBKeyScan] => C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-02-18] (Nero AG) HKLM\...\Run: [HP Component Manager] => C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [241664 2003-12-22] (Hewlett-Packard Company) HKLM\...\Run: [HPDJ Taskbar Utility] => C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [172032 2004-05-13] (HP) HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-19] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [83240 2008-03-20] (Cyberlink Corp.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2010-08-10] (Apple Inc.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [49152 2004-05-13] (Hewlett-Packard Company) HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [50176 2008-04-14] (Microsoft Corporation) HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG) HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-839522115-1767777339-1801674531-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = SearchScopes: HKU\S-1-5-21-839522115-1767777339-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = BHO: Βοηθός εισόδου του Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) Toolbar: HKU\.DEFAULT -> No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default FF SearchEngineOrder.1: Ask Search FF SearchEngineOrder.3: Bing FF Homepage: hxxp://gr.msn.com/?pc=UP97&ocid=UP97DHP FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q= FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-02] FF Extension: Flash Video Downloader - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\r4602zj1.default\Extensions\artur.dubovoy@gmail.com.xpi [2013-12-30] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-12-02] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-12-02] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-12-02] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-08-27] Chrome: ======= CHR Profile: C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\User Data\Default CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992560 2014-12-19] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [98160 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG) S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) R1 HCW88AUD; C:\WINDOWS\System32\drivers\hcw88aud.sys [13440 2009-02-25] (Hauppauge Computer Works, Inc) S3 HCW88BDA; C:\WINDOWS\System32\drivers\hcw88bda.sys [130112 2005-03-15] (Hauppauge Computer Works, Inc) [File not signed] R3 HCW88TSE; C:\WINDOWS\System32\drivers\hcw88tse.sys [320512 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88TUNE; C:\WINDOWS\System32\drivers\hcw88tun.sys [75904 2009-02-25] (Hauppauge Computer Works, Inc.) R3 hcw88vid; C:\WINDOWS\System32\drivers\hcw88vid.sys [396032 2009-02-25] (Hauppauge Computer Works, Inc) R3 HCW88XBAR; C:\WINDOWS\System32\drivers\HCW88BAR.sys [17792 2009-02-25] (Hauppauge Computer Works, Inc.) R1 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [54360 2014-11-21] (Malwarebytes Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-02] (Malwarebytes Corporation) S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation) R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-07-30] (Avira GmbH) R3 VIAHdAudAddService; C:\WINDOWS\System32\drivers\viahduaa.sys [1390976 2009-08-17] (VIA Technologies, Inc.) R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\CyberLink\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 CnxEtP; system32\DRIVERS\CnxEtP.sys [X] S3 CnxEtU; system32\DRIVERS\CnxEtU.sys [X] S3 CnxTgNP; system32\DRIVERS\CnxTgNP.sys [X] S4 IntelIde; No ImagePath ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-02 05:52 - 2015-01-02 05:53 - 00017983 _____ () C:\Documents and Settings\user\Desktop\FRST.txt 2015-01-02 05:45 - 2015-01-02 05:45 - 00002141 _____ () C:\Documents and Settings\user\Desktop\ESET.txt 2015-01-02 05:42 - 2015-01-02 05:42 - 00000857 _____ () C:\Documents and Settings\user\Desktop\esetwas.txt 2015-01-01 23:56 - 2015-01-01 23:56 - 00000000 ____D () C:\Program Files\ESET 2015-01-01 05:19 - 2015-01-01 05:19 - 00852505 _____ () C:\Documents and Settings\user\Desktop\SecurityCheck.exe 2015-01-01 05:17 - 2015-01-01 05:17 - 02347384 _____ (ESET) C:\Documents and Settings\user\Desktop\esetsmartinstaller_deu.exe 2014-12-31 16:18 - 2014-12-31 16:18 - 00000814 _____ () C:\Documents and Settings\user\Desktop\JRT.txt 2014-12-31 16:13 - 2014-12-31 16:13 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-12-31 12:33 - 2014-12-31 12:33 - 00004959 _____ () C:\Documents and Settings\user\Desktop\AdwCleaner.txt 2014-12-31 11:53 - 2014-12-31 12:02 - 00000000 ____D () C:\AdwCleaner 2014-12-31 11:52 - 2014-12-31 11:52 - 00001201 _____ () C:\Documents and Settings\user\Desktop\mbam.txt 2014-12-30 23:52 - 2014-12-30 23:52 - 01707939 _____ (Thisisu) C:\Documents and Settings\user\Desktop\JRT.exe 2014-12-30 23:26 - 2014-12-30 23:47 - 02173952 _____ () C:\Documents and Settings\user\Desktop\AdwCleaner_4.106.exe 2014-12-30 17:37 - 2014-12-30 17:39 - 00000000 ____D () C:\Documents and Settings\user\Application Data\mIRC 2014-12-30 03:14 - 2014-12-30 03:14 - 00053714 _____ () C:\Documents and Settings\user\Desktop\Combofix.txt 2014-12-29 23:30 - 2014-12-29 23:30 - 00053714 _____ () C:\ComboFix.txt 2014-12-29 23:30 - 2014-12-29 23:30 - 00000000 ____D () C:\Documents and Settings\NetworkService\Local Settings\temp 2014-12-29 23:30 - 2014-12-29 23:30 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\temp 2014-12-29 22:08 - 2014-12-29 22:08 - 00000000 _RSHD () C:\cmdcons 2014-12-29 22:08 - 2014-04-17 15:43 - 00000209 _____ () C:\Boot.bak 2014-12-29 22:08 - 2004-08-03 23:00 - 00260272 __RSH () C:\cmldr 2014-12-29 21:13 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe 2014-12-29 21:13 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe 2014-12-29 21:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe 2014-12-29 21:13 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe 2014-12-29 21:10 - 2014-12-29 23:30 - 00000000 ____D () C:\Qoobox 2014-12-29 21:10 - 2014-12-29 23:12 - 00000000 ____D () C:\WINDOWS\erdnt 2014-12-29 21:01 - 2014-12-29 21:01 - 00000926 _____ () C:\Documents and Settings\user\Desktop\Revo Uninstaller.lnk 2014-12-29 21:01 - 2014-12-29 21:01 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-12-29 19:01 - 2014-12-29 19:01 - 05603624 ____R (Swearware) C:\Documents and Settings\user\Desktop\ComboFix.exe 2014-12-29 18:58 - 2014-12-29 18:59 - 02623656 _____ (VS Revo Group Ltd.) C:\Documents and Settings\user\Desktop\revosetup95.exe 2014-12-28 18:47 - 2014-12-28 18:48 - 00060837 _____ () C:\Documents and Settings\user\Desktop\logfiles.zip 2014-12-28 18:42 - 2014-12-28 18:42 - 00000000 ____D () C:\Program Files\7-Zip 2014-12-28 18:42 - 2014-12-28 18:42 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip 2014-12-28 18:40 - 2014-12-28 18:40 - 01180834 _____ () C:\Documents and Settings\user\Desktop\7z935.exe 2014-12-28 17:31 - 2014-12-28 17:56 - 00052570 _____ () C:\Documents and Settings\user\Desktop\Avira scan 28120256.txt 2014-12-28 17:31 - 2014-12-28 17:54 - 00082638 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27122032.txt 2014-12-28 17:30 - 2014-12-28 17:52 - 00054796 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27121958.txt 2014-12-28 17:30 - 2014-12-28 17:51 - 00053684 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27121821.txt 2014-12-28 17:29 - 2014-12-28 17:50 - 00064958 _____ () C:\Documents and Settings\user\Desktop\Avira scan 27120153.txt 2014-12-28 17:28 - 2014-12-28 17:49 - 00052908 _____ () C:\Documents and Settings\user\Desktop\Avira scan 23122355.txt 2014-12-28 17:16 - 2014-12-28 17:38 - 00006003 _____ () C:\Documents and Settings\user\Desktop\mbam prot 28120000.txt 2014-12-28 17:15 - 2014-12-28 17:37 - 00006565 _____ () C:\Documents and Settings\user\Desktop\mbam prot 27121533.txt 2014-12-28 17:14 - 2014-12-28 17:35 - 00001070 _____ () C:\Documents and Settings\user\Desktop\mbam scan 28120312.txt 2014-12-28 17:13 - 2014-12-28 17:35 - 00001068 _____ () C:\Documents and Settings\user\Desktop\mbam scan 27121942.txt 2014-12-28 07:40 - 2014-12-28 07:40 - 00005553 _____ () C:\Documents and Settings\user\Desktop\Gmer.txt 2014-12-28 05:57 - 2014-12-28 05:58 - 00026972 _____ () C:\Documents and Settings\user\Desktop\Addition.txt 2014-12-28 05:56 - 2015-01-01 04:58 - 00030976 _____ () C:\Documents and Settings\user\Desktop\FRST aelter.txt 2014-12-28 05:55 - 2014-12-28 05:56 - 00000000 ____D () C:\Documents and Settings\user\Desktop\frst 2014-12-28 04:52 - 2015-01-02 05:52 - 00000000 ____D () C:\FRST 2014-12-28 03:43 - 2014-12-28 03:43 - 00380416 _____ () C:\Documents and Settings\user\Desktop\Gmer-19357.exe 2014-12-28 03:37 - 2014-12-28 03:38 - 00000470 _____ () C:\Documents and Settings\user\Desktop\defogger_disable.log 2014-12-28 03:37 - 2014-12-28 03:37 - 00000000 _____ () C:\Documents and Settings\user\defogger_reenable 2014-12-28 03:20 - 2014-12-28 03:20 - 01114624 _____ (Farbar) C:\Documents and Settings\user\Desktop\FRST.exe 2014-12-28 03:06 - 2014-12-28 03:06 - 00050477 _____ () C:\Documents and Settings\user\Desktop\Defogger.exe 2014-12-27 15:32 - 2015-01-02 02:48 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-12-27 15:31 - 2014-12-27 15:31 - 00000786 _____ () C:\Documents and Settings\All Users\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-27 15:31 - 2014-12-27 15:31 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes 2014-12-27 15:31 - 2014-11-21 06:14 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-12-27 15:31 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-12-24 02:43 - 2014-12-24 02:44 - 20447072 _____ (Malwarebytes Corporation ) C:\Documents and Settings\user\Desktop\mbam-setup-2.0.4.1028.exe 2014-12-19 22:21 - 2014-12-19 22:21 - 00000867 _____ () C:\Documents and Settings\All Users\Desktop\Avira.lnk ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-02 05:53 - 2010-08-27 12:47 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Temp 2015-01-02 05:42 - 2013-08-02 15:07 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-01-02 05:11 - 2010-08-31 19:53 - 00001172 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-02 04:37 - 2010-08-27 09:26 - 00000420 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{90D0AD61-E914-4728-AD27-128A15D455DF}.job 2015-01-02 03:00 - 2010-08-27 12:39 - 01644815 _____ () C:\WINDOWS\WindowsUpdate.log 2015-01-02 00:47 - 2010-08-27 12:46 - 00032322 _____ () C:\WINDOWS\SchedLgU.Txt 2015-01-01 21:25 - 2013-01-09 01:22 - 00000000 ____D () C:\Documents and Settings\user\Application Data\Skype 2015-01-01 21:24 - 2010-08-27 08:30 - 00000159 _____ () C:\WINDOWS\wiadebug.log 2015-01-01 21:24 - 2010-08-27 08:30 - 00000048 _____ () C:\WINDOWS\wiaservc.log 2015-01-01 21:23 - 2014-03-10 16:11 - 00000220 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job 2015-01-01 21:23 - 2010-08-31 19:53 - 00001168 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-01 21:23 - 2010-08-27 12:46 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-01 18:19 - 2014-08-12 21:38 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat 2015-01-01 18:18 - 2010-08-27 12:47 - 00000278 ___SH () C:\Documents and Settings\user\ntuser.ini 2015-01-01 13:21 - 2010-08-27 11:38 - 00000000 ____D () C:\Program Files\mIRC 2014-12-31 04:24 - 2010-08-27 12:43 - 00000000 __SHD () C:\Documents and Settings\NetworkService 2014-12-29 22:48 - 2008-04-14 14:00 - 00000227 _____ () C:\WINDOWS\system.ini 2014-12-29 22:08 - 2010-08-27 08:25 - 00000325 __RSH () C:\boot.ini 2014-12-29 18:19 - 2008-04-14 14:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl 2014-12-27 22:41 - 2010-08-30 18:47 - 00000000 ____D () C:\WINDOWS\system32\NtmsData 2014-12-27 20:33 - 2010-08-27 12:37 - 00000000 ____D () C:\WINDOWS\Registration 2014-12-27 20:13 - 2010-08-27 09:00 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$ 2014-12-26 23:29 - 2013-05-11 20:41 - 00000000 ____D () C:\Documents and Settings\user\Application Data\vlc 2014-12-26 21:41 - 2010-09-04 21:07 - 00010752 _____ () C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-12-24 00:55 - 2010-08-27 10:44 - 00000000 ____D () C:\Documents and Settings\user\Local Settings\Application Data\Adobe 2014-12-24 00:40 - 2013-01-08 11:03 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2014-12-24 00:40 - 2013-01-08 11:03 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2014-12-20 13:15 - 2014-08-12 16:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Package Cache 2014-12-19 22:58 - 2014-08-13 21:50 - 00270890 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-839522115-1767777339-1801674531-1003-0.dat 2014-12-19 22:21 - 2013-07-30 20:47 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Avira 2014-12-19 22:21 - 2013-07-30 20:46 - 00000000 ____D () C:\Program Files\Avira 2014-12-16 16:47 - 2010-09-04 21:14 - 00000000 ____D () C:\Elisa 2014-12-12 17:08 - 2013-07-15 21:24 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-12-12 16:40 - 2010-08-27 09:04 - 109818608 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-12-08 16:13 - 2014-03-10 16:11 - 00000214 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job 2014-12-03 16:01 - 2012-04-29 20:34 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service Some content of TEMP: ==================== C:\Documents and Settings\user\Local Settings\Temp\avgnt.exe C:\Documents and Settings\user\Local Settings\Temp\Quarantine.exe C:\Documents and Settings\user\Local Settings\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- Das Problem (Rechner sehr langsam) besteht weiterhin. Außer ESET hat mir aber kein anderes Programm mehr irgendwelche Funde gemeldet. Ich weiß allerdings nicht, was in den Logs steht... Und last but not least: Lieber Schrauber, ich wünsche Dir ein gutes neues Jahr!  |
|
02.01.2015, 13:48
| #12 |
| /// the machine /// TB-Ausbilder | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\bestmp4tomp3convertersetup.exe
C:\emule049c.exe
C:\zafwSetupWeb_110_000_020.exe
C:\Documents and Settings\user\Desktop\Backup\windows xp\Documents and Settings\Ελίζα\Start Menu\eBay.lnk
C:\Documents and Settings\user\Desktop\Backup\windows xp\Nero 7 Premium Reloaded - 7.10.1.0\Nero-7.10.1.0_eng_update.exe
C:\Documents and Settings\user\My Documents\Downloads\Subtitles13.exe
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165840.dll
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Ich finde den Autostart für nen XP Rechner echt überladen. Wieviel RAM hat die Kiste?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.01.2015, 16:56
| #13 | |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! OK, habe die Anweisungen befolgt, wollte aber kurz was fragen, bevor ich FRST starte: Die folgenden Dateien aus der Liste sind Installer od. Updates von bekannten (sicheren?) Programmen, die auf meinem PC installiert sind od. waren: C:\bestmp4tomp3convertersetup.exe (Installer von einem Converter, den ich mal im Internet heruntergeladen habe) C:\emule049c.exe (Emule-Tauschbörse) C:\zafwSetupWeb_110_000_020.exe (Installer von Zone Alarm Firewall) C:\Documents and Settings\user\Desktop\Backup\windows xp\Nero 7 Premium Reloaded - 7.10.1.0\Nero-7.10.1.0_eng_update.exe (Update von Nero ?) Soll ich all' diese Programme unbedingt in der Fixlist belassen? Oder könnte ich z.B. den Nero-Updater rausnehmen? Denn ich nehme an, dass sie gelöscht werden... Zitat:
 Mein Bruder meinte vor 1 Jahr, der Rechner hat 1 GB, und riet mir, noch 2 GB dazuzupacken. (Das müsste ich wohl in einem Fachgeschäft machen lassen, denn ich habe noch nie sowas gemacht. Oder ist es besonders einfach?) Allerdings lief der PC damals noch wie eine 1! Prozessor ist ein Asus Dualcore 2,20 GHz, die Festplatte hat 250 GB (davon bisher nur 80 GB belegt). Geändert von Justelene_dk (02.01.2015 um 17:06 Uhr) |
|
02.01.2015, 18:13
| #14 | |
| /// the machine /// TB-Ausbilder | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde!Zitat:
1 GB RAM ist definitiv zu wenig. Du kannst bis zu 3 GB machen, wenn dein Board das mit macht. Man müsste das Datenblatt des Mainboards checken um zu sehen, wieviel RAM und was für ein RAM rein gehört. Das dazustecken kannste selbst machen. Hast du den CCleaner drauf? Wenn nicht installieren, damit mal die Temps reinigen, aber nicht die Registry! Ccleaner hat auch ne schöne Funktion für den Autostart. Im AUtostart muss nix sein wie dein AV Programm und hardware-relevante Software.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.01.2015, 18:21
| #15 |
| | PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! Nach einer Woche im Bett mit Grippe und Fieber melde ich mich wieder zurück! Hier der FRST-Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-12-2014
Ran by user at 2015-01-07 05:06:45 Run:1
Running from C:\Documents and Settings\user\Desktop
Loaded Profiles: user & (Available profiles: user)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Documents and Settings\user\Desktop\Backup\windows xp\Documents and Settings\Ελίζα\Start Menu\eBay.lnk
C:\Documents and Settings\user\My Documents\Downloads\Subtitles13.exe
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165840.dll
Emptytemp:
*****************
C:\Documents and Settings\user\Desktop\Backup\windows xp\Documents and Settings\Ελίζα\Start Menu\eBay.lnk => Moved successfully.
C:\Documents and Settings\user\My Documents\Downloads\Subtitles13.exe => Moved successfully.
C:\System Volume Information\_restore{4512F723-8680-4631-8F52-BB88D7011474}\RP1159\A0165840.dll => Moved successfully.
EmptyTemp: => Removed 239.3 MB temporary data.
The system needed a reboot.
==== End of Fixlog 05:07:30 ====
Ich muss sagen, nach dem FRST-Fixlauf ist der Rechner wesentlich schneller geworden!! Allerdings dauert das Hochfahren noch relativ lange (obwohl auch hier eine kleine Besserung eingetreten ist)... Vielen Dank für Deine Tipps!  Das Datenblatt des Motherboards habe ich wahrscheinlich nicht mehr. Am Montag werde ich aber den Rechner zu einem Elektronikladen bringen und mir dann den passenden Speichertyp geben lassen. Hoffe, ich kriege das mit dem Einbauen alleine hin... Ja, ich will 3 GB drauf machen. Das müsste das Board packen oder nicht? Ich dachte immer, 4 GB wären auf jeden Fall möglich... Den CCleaner habe ich mir auf deinen Rat hin runtergeladen und damit den Autostart etwas bereinigt. Ich muss aber zugeben, dass das Hochfahren immer noch ein bisschen lang dauert. Hast du eine Idee? Hier der CC-Log: Code:
ATTFilter Yes HKCU:Run ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
No HKCU:Run IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
No HKCU:Run Skype "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
Yes HKLM:Run NvMediaCenter RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Yes HKLM:Run NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Yes HKLM:Run HDAudDeck C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
Yes HKLM:Run IgfxTray C:\WINDOWS\system32\igfxtray.exe
Yes HKLM:Run HotKeysCmds C:\WINDOWS\system32\hkcmd.exe
Yes HKLM:Run Persistence C:\WINDOWS\system32\igfxpers.exe
Yes HKLM:Run HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Yes HKLM:Run HPDJ Taskbar Utility C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
Yes HKLM:Run avgnt "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
Yes HKLM:Run SunJavaUpdateSched "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Yes HKLM:Run ehTray C:\WINDOWS\ehome\ehtray.exe
Yes HKLM:Run BDRegion C:\Program Files\Cyberlink\Shared Files\brs.exe
Yes HKLM:Run Adobe ARM "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Yes HKLM:Run Avira Systray C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
No HKLM:Run HP Software Update "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
No HKLM:Run LWS C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
No HKLM:Run NBKeyScan "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
No HKLM:Run NeroFilterCheck C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
No HKLM:Run nwiz C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
No HKLM:Run PDFPrint C:\Program Files\PDF24\pdf24.exe
No HKLM:Run PDVD8LanguageShortcut "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
No HKLM:Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
No HKLM:Run RemoteControl8 "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
Yes Startup Common Windows Search.lnk C:\Program Files\Windows Desktop Search\WindowsSearch.exe
Und soll ich noch die "Services" aufräumen? Wie mache ich das? Über MSConfig? |
|
| Themen zu PC ungewöhnlich langsam, mehrere Viren-/Trojanerfunde! |
| angriff, antimalware, arbeitsspeicher, bruder, computer, diverse, ebenfalls, elene, freund, installiert, langsam, langsamkeit, malwarebytes, meldungen, neue, neuen, nichts, probleme, quarantäne, rechner, schutz, spätere, trojaner, updates, verschieben, virenschutz |
dann auf 
und dann auf 
. 
Linear-Darstellung
