| |
| |||||||
Log-Analyse und Auswertung: Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertrautWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
06.01.2015, 21:20
| #1 |
 |  Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Hallo, ich bin ganz neu hier und kenne mich mit Computern auch nicht wirklich gut aus. Ich hoffe, dass ich alles richtig mache, eure Schritte bei der Anleitung bei Virenbefall hab ich durchgeführt und füge die Ergebnisse gleich ein. Mein erstes Problem ist, dass ich mir leider irgendwo Lollipop eingefangen habe und ich es nicht mehr entfernen kann. Ich habe schon mehrfach Malwarebytes Anti Malware, AdwCleaner, Junkware Removal und auch den Kaspersky Scanner durchlaufen lassen, aber es ändert sich nichts. Die Lollipop-Einblendungen kommen nur bei Firefox vor, bei IE nicht, darum benutze ich momentan IE. Das zweite Problem ist, dass ich seit ca 2 Wochen Paypal nicht mehr öffnen kann, da ich bei Firefox die Meldung "Dieser Verbindung wird nicht vertraut" bekomme, ohne dass ich den Button habe "Ausnahme hinzufügen". Ich danke euch schon mal für eure Hilfe und schicke jetzt die Logdateien First Editor: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 06-01-2015 20:53:39
Running from C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\klwtblfs.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\huhvr1qd.default-1420477253032
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-11-30]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-10-03]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-06 20:53 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:58 - 2014-12-28 09:01 - 01707939 _____ (Thisisu) C:\Users\Bismillah\Desktop\JRT_NEW.exe
2015-01-05 18:00 - 2015-01-05 18:00 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-05 17:59 - 2015-01-05 17:59 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-05 17:59 - 2015-01-05 17:59 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-05 17:59 - 2015-01-05 17:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 20:54 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-06 20:49 - 2014-07-12 13:15 - 01162368 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-06 20:41 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-06 20:35 - 2014-01-09 12:31 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-06 20:26 - 2014-05-25 10:05 - 00000000 ___DO () C:\Users\Bismillah\OneDrive
2015-01-06 20:25 - 2014-06-26 11:18 - 00069800 _____ () C:\WINDOWS\PFRO.log
2015-01-06 20:25 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-06 20:25 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-06 20:25 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 20:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-06 20:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-06 20:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 16:07 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 23:51 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-05 17:59 - 2014-12-01 23:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-04 14:18 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-01 20:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 12:02 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2014-12-08 15:05 - 2014-12-06 20:18 - 00000275 _____ () C:\AdwCleanerDebug.txt
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
Some content of TEMP:
====================
C:\Users\Bismillah\AppData\Local\Temp\Browser7-win32-installer-06.exe
C:\Users\Bismillah\AppData\Local\Temp\Quarantine.exe
C:\Users\Bismillah\AppData\Local\Temp\sdan.exe
C:\Users\Bismillah\AppData\Local\Temp\sdapk.exe
C:\Users\Bismillah\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bismillah\AppData\Local\Temp\sqlite3.dll
C:\Users\Bismillah\AppData\Local\Temp\_isB3C6.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-05 20:47
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-01-2015
Ran by Bismillah at 2015-01-06 20:54:19
Running from C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Childsplay 1.6 (HKLM-x32\...\Childsplay_is1) (Version: 1.6 - )
Free YouTube to MP3 Converter version 3.12.46.923 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.923 - DVDVideoSoft Ltd.)
GCompris Uninstall (HKLM-x32\...\GCompris) (Version: - )
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.1.1.0 - Genesys Logic)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.4.11.0608 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.6418 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.6418 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.0822 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.0822 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
NVIDIA 3D Vision Treiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera Stable 20.0.1387.82 (HKLM-x32\...\Opera 20.0.1387.82) (Version: 20.0.1387.82 - Opera Software ASA)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 Create Module (HKLM-x32\...\{797A6AD2-06D5-484B-81FE-25895A56B1F2}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Power Control Switch (HKLM-x32\...\{816F9A97-9889-43DA-A394-7AA45DD68BA0}) (Version: 4.0.0.0704 - Lenovo)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6649 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36244 - TeamViewer)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Total Uninstall 6.4.1 (HKLM\...\Total Uninstall 6_is1) (Version: 6.4.1 - Gavrila Martau)
Tux Paint 0.9.21c (HKLM-x32\...\Tux Paint_is1) (Version: - New Breed Software)
Tux Paint Stamps 2009-06-28 (HKLM-x32\...\Tux Paint Stamps_is1) (Version: - New Breed Software)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
18-12-2014 09:35:58 Windows Update
25-12-2014 10:06:10 Geplanter Prüfpunkt
03-01-2015 14:14:49 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {024521B8-53D8-4BF6-BC27-3F610AEFD0FE} - System32\Tasks\OFFICE2010ACT => C:\ProgramData\Microsoft\Windows\OFFICEICON.vbs [2012-03-08] ()
Task: {51749448-9FB5-48C5-A211-B5F95D31BC00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {5A92D050-41E7-44FE-848A-06C6F542E870} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-15] (Microsoft Corporation)
Task: {75BCEC0D-FA05-49EA-956E-22B3324217CA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9E370534-C907-463A-A18D-18E6605A8D7E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-17] (Adobe Systems Incorporated)
Task: {AAC6FC5A-1A9A-4A05-9432-7B4641E9445F} - System32\Tasks\{266D9F78-9D2F-47B6-B081-8E1A5A3982FA} => pcalua.exe -a C:\Users\Bismillah\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=tugs
Task: {ADC646E5-1AEA-4F28-B04E-A74485B0AB1F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {C219AA82-2805-4BF3-950B-E05FC0FD94C7} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-10-26 07:19 - 2012-07-24 12:36 - 00028672 _____ () C:\Windows\SysWOW64\UMonit.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2009-12-04 15:59 - 2009-12-04 15:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 16:04 - 2009-12-04 16:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2012-10-26 07:18 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-05 17:59 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 01:42 - 2014-11-30 21:04 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:AD022376
AlternateDataStreams: C:\Users\Bismillah\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "jmesoft"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "UpdateStar Drivers"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "TomTomHOME.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-265324917-246502483-178326081-500 - Administrator - Disabled)
Bismillah (S-1-5-21-265324917-246502483-178326081-1001 - Administrator - Enabled) => C:\Users\Bismillah
Gast (S-1-5-21-265324917-246502483-178326081-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-265324917-246502483-178326081-1004 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 27%
Total physical RAM: 8147.33 MB
Available physical RAM: 5902.06 MB
Total Pagefile: 9427.33 MB
Available Pagefile: 6919.27 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:1835.98 GB) (Free:1738.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 12076AA1)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-06 20:59:33
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-3 ST2000DM001-9YN164 rev.CC62 1863,02GB
Running: Gmer-19357.exe; Driver: C:\Users\BISMIL~1\AppData\Local\Temp\uftdrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff8eaa11f6a 4 bytes [A1, EA, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff8eaa11f82 4 bytes [A1, EA, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff8f1cf2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff8f1cf2d14 8 bytes {JMP 0xffffffffffffffd8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff8f1cf2ee8 16 bytes {JMP 0xffffffffffffffb8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff8f1cf3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff8f1cf3878 8 bytes {JMP 0xffffffffffffffd3}
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff8f1cf425c 8 bytes {JMP 0xffffffffffffffbb}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff8f1cf4a2b 8 bytes {JMP 0xffffffffffffffde}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff8f1cf4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff8f1cf4cfc 8 bytes {JMP 0xffffffffffffffb1}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff8f1cf5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff8f1cf511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff8f1cf6693 8 bytes {JMP 0xffffffffffffffde}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff8f1cf6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff8f1cf6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff8f1cf740f 8 bytes {JMP 0xffffffffffffffe8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff8f1cf75c7 8 bytes {JMP 0xffffffffffffffe5}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff8f1cfa8b3 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff8f1cfa8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff8f1cfa9c4 8 bytes {JMP 0xffffffffffffffe1}
.text ... * 3
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff8f1cfad90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff8f1cfb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff8f1cfb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff8f1cfb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff8f1cfb648 8 bytes [10, 6A, F8, 7F, 00, 00, 00, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff8f1cfb88c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff8f1cfb98c 8 bytes [E0, 69, F8, 7F, 00, 00, 00, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff8f1cfbc38 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff8f1cfbe94 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff8f1d71740 8 bytes {JMP QWORD [RIP-0x75dba]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff8f1d718c0 8 bytes {JMP QWORD [RIP-0x75eda]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff8f1d718f0 8 bytes {JMP QWORD [RIP-0x762ae]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff8f1d71a10 8 bytes {JMP QWORD [RIP-0x7618a]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff8f1d71ac0 8 bytes {JMP QWORD [RIP-0x76403]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff8f1d72180 8 bytes {JMP QWORD [RIP-0x762f2]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff8f1d72480 8 bytes {JMP QWORD [RIP-0x7684e]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff8f1d72d00 8 bytes {JMP QWORD [RIP-0x771f6]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 381 000000007757137d 16 bytes {JMP 0xffffffffffffffd3}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 386 0000000077571512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077571551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetStackPointer + 23 0000000077571577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuResetToConsistentState + 516 0000000077571784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuThreadInit + 50 00000000775717c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000775717e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077571834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 0000000077571841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 0000000077571a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077572ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077572c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000077572c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [764:1820] fffff960009adb90
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\avengine.dll.a500c54fd49c0b4d0fb6e3c9244b51a0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f8f0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavbase.kdl.7aa539a1cbbfb4baa644b9866f4bcf4b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f850000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavemu.kdl.b6b6dd223ad2aad28374217a028b59b0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ecb0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kjim.kdl.104b20cc4ad0260caa6022d868ce31a7 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f600000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\mark.kdl.6c69ef8fd152138b474ef4e5105233c9 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f5a0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\qscan.kdl.b2ff916870cb69af1da84f4b229ebcec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f470000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\arkmon.kdl.aeeec152e3e81f218d27686fcaf9d774 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f440000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavsys.kdl.6320146b23a54cc3a482468b7b46e6a4 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f3c0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\uds.dll.00000000000690c0-01d00cd64521e47a-01d00fa1727a682f (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ec40000
Library c:\programdata\kaspersky lab\avp15.0.0\data\wlengine.dll (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f370000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\intctrl.kdl.0000000000090000-01d00cd643c8281f-01d00cdbf6056197 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ea30000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\vlns.kdl.75bc7021d19dabc13b3578597a15f843 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006b3d0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pbs.kdl.eefcc4c76375abb2b40e8e5c00c7eccf (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006b270000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavasyswatch.dll.000000000010ee00-01d00cd643ccece2-01d00cd8d7693354 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061af0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon.kdl.0000000000019800-01d00cd644894c11-01d010750096e0e8 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000616e0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon_drv.kdl.0000000000018600-01d00cd644b8fb86-01d01861bd7f73b8 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000616a0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pdm.kdl.0000000000069740-01d00cd64448ebc0-01cf757c6cdf4600 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061630000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\heurap.dll.0ce84b1af150e117a14d119f99292f28 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061550000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\bsshlp2.kdl.7b5ed3ca6d3d7225b866af3c09484fec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000614d0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\sys_critical_obj.dll.0000000000023800-01d00cd644e18420-01cf757be4f93c00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000613e0000
Process C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe (*** suspicious ***) @ C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe [15280] (Farbar Recovery Scan Tool/Farbar)(2015-01-06 19:53:33) 00007ff679f80000
Process C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe (*** suspicious ***) @ C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe [15548](2015-01-06 19:54:34) 0000000000400000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
06.01.2015, 21:47
| #2 |
| /// the machine /// TB-Ausbilder    | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Hi,
__________________AdwCLeaner updaten, scannen, Funde löschen. Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen FRST öffnen, Haken setzen bei Addition und scannen, poste bitte beide Logfiles.
__________________ |
|
06.01.2015, 22:27
| #3 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Hallo
__________________Danke für die schnelle Antwort. Hier die Logdateien: FRST: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 06-01-2015 22:25:50
Running from C:\Users\Bismillah\Downloads
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\klwtblfs.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\RunOnce: [ASYNCMAC] => rundll32.exe streamci,StreamingDeviceSetup {eeab7790-c514-11d1-b42b-00805fc1270e},asyncmac,{ad498944-762f-11d0-8dcb-00c04fc3358c},C:\WINDOWS\INF\netrasa.inf,Ndi-Mp-AsyncMac
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\zep0bc29.default-1420579432016
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U3 uftdrpow; \??\C:\Users\BISMIL~1\AppData\Local\Temp\uftdrpow.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 22:25 - 2015-01-06 22:25 - 02123776 _____ (Farbar) C:\Users\Bismillah\Downloads\FRST64.exe
2015-01-06 22:25 - 2015-01-06 22:25 - 00017913 _____ () C:\Users\Bismillah\Downloads\FRST.txt
2015-01-06 22:22 - 2015-01-06 22:22 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-06 22:14 - 2015-01-06 22:14 - 00267660 _____ () C:\Users\Bismillah\Desktop\bookmarks.html
2015-01-06 20:59 - 2015-01-06 20:59 - 00034132 _____ () C:\Users\Bismillah\Desktop\gmer.txt
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-06 22:25 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:58 - 2014-12-28 09:01 - 01707939 _____ (Thisisu) C:\Users\Bismillah\Desktop\JRT_NEW.exe
2015-01-05 18:00 - 2015-01-06 22:23 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 22:26 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-06 22:25 - 2014-01-09 12:31 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-06 22:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-06 22:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-06 21:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-06 21:21 - 2014-07-12 13:15 - 01194945 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-06 21:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-06 20:57 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:26 - 2014-05-25 10:05 - 00000000 ___DO () C:\Users\Bismillah\OneDrive
2015-01-06 20:25 - 2014-06-26 11:18 - 00069800 _____ () C:\WINDOWS\PFRO.log
2015-01-06 20:25 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-06 20:25 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-06 20:25 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 20:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 16:07 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 23:51 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-04 14:18 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-01 20:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 12:02 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2014-12-08 15:05 - 2014-12-06 20:18 - 00000275 _____ () C:\AdwCleanerDebug.txt
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
Some content of TEMP:
====================
C:\Users\Bismillah\AppData\Local\Temp\Browser7-win32-installer-06.exe
C:\Users\Bismillah\AppData\Local\Temp\Quarantine.exe
C:\Users\Bismillah\AppData\Local\Temp\sdan.exe
C:\Users\Bismillah\AppData\Local\Temp\sdapk.exe
C:\Users\Bismillah\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bismillah\AppData\Local\Temp\sqlite3.dll
C:\Users\Bismillah\AppData\Local\Temp\_isB3C6.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-06 22:03
==================== End Of Log ============================
--- --- --- --- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-01-2015
Ran by Bismillah at 2015-01-06 22:26:05
Running from C:\Users\Bismillah\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Childsplay 1.6 (HKLM-x32\...\Childsplay_is1) (Version: 1.6 - )
Free YouTube to MP3 Converter version 3.12.46.923 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.923 - DVDVideoSoft Ltd.)
GCompris Uninstall (HKLM-x32\...\GCompris) (Version: - )
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.1.1.0 - Genesys Logic)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.4.11.0608 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.6418 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.6418 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.0822 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.0822 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
NVIDIA 3D Vision Treiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera Stable 20.0.1387.82 (HKLM-x32\...\Opera 20.0.1387.82) (Version: 20.0.1387.82 - Opera Software ASA)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 Create Module (HKLM-x32\...\{797A6AD2-06D5-484B-81FE-25895A56B1F2}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Power Control Switch (HKLM-x32\...\{816F9A97-9889-43DA-A394-7AA45DD68BA0}) (Version: 4.0.0.0704 - Lenovo)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6649 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36244 - TeamViewer)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Total Uninstall 6.4.1 (HKLM\...\Total Uninstall 6_is1) (Version: 6.4.1 - Gavrila Martau)
Tux Paint 0.9.21c (HKLM-x32\...\Tux Paint_is1) (Version: - New Breed Software)
Tux Paint Stamps 2009-06-28 (HKLM-x32\...\Tux Paint Stamps_is1) (Version: - New Breed Software)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
18-12-2014 09:35:58 Windows Update
25-12-2014 10:06:10 Geplanter Prüfpunkt
03-01-2015 14:14:49 Geplanter Prüfpunkt
06-01-2015 22:15:59 Revo Uninstaller's restore point - Mozilla Firefox 34.0.5 (x86 de)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {024521B8-53D8-4BF6-BC27-3F610AEFD0FE} - System32\Tasks\OFFICE2010ACT => C:\ProgramData\Microsoft\Windows\OFFICEICON.vbs [2012-03-08] ()
Task: {51749448-9FB5-48C5-A211-B5F95D31BC00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {75BCEC0D-FA05-49EA-956E-22B3324217CA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9E370534-C907-463A-A18D-18E6605A8D7E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-17] (Adobe Systems Incorporated)
Task: {AAC6FC5A-1A9A-4A05-9432-7B4641E9445F} - System32\Tasks\{266D9F78-9D2F-47B6-B081-8E1A5A3982FA} => pcalua.exe -a C:\Users\Bismillah\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=tugs
Task: {ADC646E5-1AEA-4F28-B04E-A74485B0AB1F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {C219AA82-2805-4BF3-950B-E05FC0FD94C7} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {E9120C41-98E9-48C1-B9EA-43C269A5062B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-15] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-10-26 07:19 - 2012-07-24 12:36 - 00028672 _____ () C:\Windows\SysWOW64\UMonit.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2009-12-04 15:59 - 2009-12-04 15:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 16:04 - 2009-12-04 16:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2012-10-26 07:18 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-06 22:22 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:AD022376
AlternateDataStreams: C:\Users\Bismillah\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "jmesoft"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "UpdateStar Drivers"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "TomTomHOME.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-265324917-246502483-178326081-500 - Administrator - Disabled)
Bismillah (S-1-5-21-265324917-246502483-178326081-1001 - Administrator - Enabled) => C:\Users\Bismillah
Gast (S-1-5-21-265324917-246502483-178326081-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-265324917-246502483-178326081-1004 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
Description: Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek Semiconductor Corp.
Service: RTWlanE
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/06/2015 09:01:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/06/2015 09:01:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/06/2015 09:01:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: Bei der Aktivierung der App „windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel“ ist folgender Fehler aufgetreten: -2144927151. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (01/06/2015 10:03:58 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "LitModeCtrl" hat einen ungültigen aktuellen Status gemeldet: 32
Error: (01/06/2015 10:03:58 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "LitModeCtrl" hat einen ungültigen aktuellen Status gemeldet: 32
Error: (01/06/2015 09:00:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde mit folgendem Fehler beendet:
%%87
Error: (01/06/2015 09:00:48 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "RAS-Verbindungsverwaltung" wurde mit folgendem Fehler beendet:
%%87
Error: (01/06/2015 09:00:49 PM) (Source: RasMan) (EventID: 20063) (User: )
Description: Fehler beim Starten der RAS-Verbindungsverwaltung, da das Protokoll-Engine [C:\WINDOWS\system32\rascustom.dll] nicht initialisiert wurde. Falscher Parameter.
Error: (01/06/2015 09:00:48 PM) (Source: RasMan) (EventID: 20063) (User: )
Description: Fehler beim Starten der RAS-Verbindungsverwaltung, da das Protokoll-Engine [C:\WINDOWS\system32\rascustom.dll] nicht initialisiert wurde. Falscher Parameter.
Microsoft Office Sessions:
=========================
Error: (01/06/2015 09:01:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
Error: (01/06/2015 09:01:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
Error: (01/06/2015 09:01:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SAMAHUHAUM)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 36%
Total physical RAM: 8147.33 MB
Available physical RAM: 5204.2 MB
Total Pagefile: 9427.33 MB
Available Pagefile: 5294.95 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:1835.98 GB) (Free:1737.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 12076AA1)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
07.01.2015, 09:02
| #4 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.01.2015, 21:37
| #5 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertrautFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 06-01-2015 22:25:50
Running from C:\Users\Bismillah\Downloads
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\klwtblfs.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\RunOnce: [ASYNCMAC] => rundll32.exe streamci,StreamingDeviceSetup {eeab7790-c514-11d1-b42b-00805fc1270e},asyncmac,{ad498944-762f-11d0-8dcb-00c04fc3358c},C:\WINDOWS\INF\netrasa.inf,Ndi-Mp-AsyncMac
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\zep0bc29.default-1420579432016
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U3 uftdrpow; \??\C:\Users\BISMIL~1\AppData\Local\Temp\uftdrpow.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 22:25 - 2015-01-06 22:25 - 02123776 _____ (Farbar) C:\Users\Bismillah\Downloads\FRST64.exe
2015-01-06 22:25 - 2015-01-06 22:25 - 00017913 _____ () C:\Users\Bismillah\Downloads\FRST.txt
2015-01-06 22:22 - 2015-01-06 22:22 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-06 22:14 - 2015-01-06 22:14 - 00267660 _____ () C:\Users\Bismillah\Desktop\bookmarks.html
2015-01-06 20:59 - 2015-01-06 20:59 - 00034132 _____ () C:\Users\Bismillah\Desktop\gmer.txt
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-06 22:25 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:58 - 2014-12-28 09:01 - 01707939 _____ (Thisisu) C:\Users\Bismillah\Desktop\JRT_NEW.exe
2015-01-05 18:00 - 2015-01-06 22:23 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 22:26 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-06 22:25 - 2014-01-09 12:31 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-06 22:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-06 22:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-06 21:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-06 21:21 - 2014-07-12 13:15 - 01194945 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-06 21:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-06 20:57 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:26 - 2014-05-25 10:05 - 00000000 ___DO () C:\Users\Bismillah\OneDrive
2015-01-06 20:25 - 2014-06-26 11:18 - 00069800 _____ () C:\WINDOWS\PFRO.log
2015-01-06 20:25 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-06 20:25 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-06 20:25 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 20:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 16:07 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 23:51 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-04 14:18 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-01 20:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 12:02 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2014-12-08 15:05 - 2014-12-06 20:18 - 00000275 _____ () C:\AdwCleanerDebug.txt
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
Some content of TEMP:
====================
C:\Users\Bismillah\AppData\Local\Temp\Browser7-win32-installer-06.exe
C:\Users\Bismillah\AppData\Local\Temp\Quarantine.exe
C:\Users\Bismillah\AppData\Local\Temp\sdan.exe
C:\Users\Bismillah\AppData\Local\Temp\sdapk.exe
C:\Users\Bismillah\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bismillah\AppData\Local\Temp\sqlite3.dll
C:\Users\Bismillah\AppData\Local\Temp\_isB3C6.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-06 22:03
==================== End Of Log ============================
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=97645546e27ccd4998db1a0b17afabd4
# engine=21857
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-07 08:17:40
# local_time=2015-01-07 09:17:40 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1296 16777213 100 100 93125 24734542 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 3289496 10966179 0 0
# scanned=282244
# found=45
# cleaned=45
# scan_time=3521
sh=7E365F5F8841673A67DEB61EBCD4B689A488B677 ft=1 fh=ae054f85f50e59fb vn="Variante von Win64/Adware.Vitruvian.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files\TermTutor\IE\TermTutorClientIE.dll.vir"
sh=A2D473E09F7C019315030A2124DCED3B90CB4F87 ft=1 fh=37fc42c7c433ae0f vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\DaemonProcess.exe.vir"
sh=5454230820B9172472548B91677FA99352A16A35 ft=1 fh=83c1a584ac14f3e4 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\Mobogenie.exe.vir"
sh=04DF5DA720E5E531F57BD14454EAF99E750D8BED ft=1 fh=f3c242e732b4b342 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=C86F9E4C2947B866837F4CE9E2F5156D244FCA2E ft=1 fh=0833f1c10068505a vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\UpdateMoboGenie.exe.vir"
sh=47E1AAB49E4BBE6ED704F804A4B402ACA07D74FE ft=1 fh=d4dd8a748ee934d3 vn="MSIL/Tuguu.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NewPlayer\LTV.exe.vir"
sh=051EB9A575344A61C0704A3F3B97B3D9D5AAB9DD ft=1 fh=4270541d0b8ae704 vn="Variante von MSIL/NewPlayer.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NewPlayer\NewPlayer.exe.vir"
sh=D5E87304AADF85D025B7200727BB0E90172BD0B2 ft=1 fh=5689ca4a34ff65c5 vn="Variante von MSIL/NewPlayer.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\NewPlayer\references\VAFChecker.exe.vir"
sh=21CAB45134CBAB08DA9DEF13EECAC86B46F3E669 ft=1 fh=5fc65ef6698c7c41 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=1727DEA1E7C028D11876CFC42F3553C3C6718467 ft=1 fh=f9e5b6a85939375c vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=2FC3A5E92137A2B80A59D68B7C62C774C50FFE00 ft=1 fh=938e1c7bdaa228ad vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir"
sh=12EBF6FC8AD543662053CA101C2D5DA175137EB2 ft=1 fh=c71c00119e5c1a87 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir"
sh=8F0ABE23DDA3F9DC04497B1A4F455AF8CE9D45B8 ft=1 fh=787e176d56997de7 vn="Win64/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir"
sh=6796FD43F04FE933E9155F5DD9B5B928E8C1AC71 ft=1 fh=0691f007be75c371 vn="Variante von Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=147893B2EC59DC338295C9DB77760076F7817A79 ft=1 fh=f16cf01e720a3dcc vn="Win64/Thinknice.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir"
sh=E97CBDBD7CFED2C58464C1ABF186520022DE5666 ft=1 fh=7a2ea5ecc33ad0e3 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir"
sh=43B2963293CE3865C32132A4802B92531C16D256 ft=1 fh=e1d0248c77f0c9d9 vn="Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=9AE9A2C0B8241366357206097FD312B5671FCAE8 ft=1 fh=dc7a3c84863e13b7 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir"
sh=8242BD4EEE162B47CFB747901E137937FF409B7D ft=1 fh=7577f344c81db086 vn="Variante von Win32/AdWare.Vitruvian.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\TermTutor\IE\TermTutorClientIE.dll.vir"
sh=F48E3296587DA40FDCE135488EC1CFDAB4F77CEB ft=1 fh=218b94011b24785c vn="Variante von Win32/AdWare.Vitruvian.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\TermTutor\Service\ttsvc.exe.vir"
sh=B992ED7A1B4DF30F6AF8A911FBFDE92ED9F77519 ft=1 fh=5dac4dde3cd39976 vn="Variante von MSIL/DomaIQ.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Uninstaller\Uninstall.exe.vir"
sh=0F16B90840F7BD51C3E633864EEE11680F11D405 ft=1 fh=82f8c2d4ad018dfc vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\TrayDownloader.exe.vir"
sh=28B51176D6A6087C267C15AE8D32F98701F1E080 ft=1 fh=ee5922ade32ec373 vn="Variante von Win32/ELEX.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\winzipersvc.exe.vir"
sh=76902AE7C853A6062871189729BA015F6BA9D54A ft=1 fh=048f7ac0cd650347 vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
sh=559637F0567C7A95BD4881D7BAF0B284D640215A ft=1 fh=c2f893dd822f18f6 vn="Variante von Win32/ELEX.AE evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\WPM\wprotectmanager.exe.vir"
sh=A2D473E09F7C019315030A2124DCED3B90CB4F87 ft=1 fh=37fc42c7c433ae0f vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir"
sh=5454230820B9172472548B91677FA99352A16A35 ft=1 fh=83c1a584ac14f3e4 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir"
sh=04DF5DA720E5E531F57BD14454EAF99E750D8BED ft=1 fh=f3c242e732b4b342 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=C3B0658301DE753D7A848BDD8A0E0D9A15E0C6FC ft=1 fh=d5873b260f191ba5 vn="Variante von Win32/Verti.K evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Local\StormWatch\StormWatchApp.exe.vir"
sh=E84A7F0186D3663945B6528AC11D236369FE3BE5 ft=1 fh=42264a12eec40ade vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Roaming\OpenCandy\F10AA5678837483FB2BC2418BA0E7ACF\Installer.exe.vir"
sh=464FD963183897BB987030A2097E759ED613A79C ft=1 fh=d1e1cc77b7d23939 vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bismillah\AppData\Roaming\SupTab\SupTab.dll.vir"
sh=985AE5B998513B7D9C2749DF15CAE7C04C3BDC9E ft=1 fh=2f9831d32275f6eb vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\roboot64.exe.vir"
sh=F1942F3D0D5EDBF3C5B390C8D64B520F388D519F ft=1 fh=d34279516b4a8603 vn="JS/Superfish.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\AppData\Local\Temp\D367tmp\fastplayersetup.exe"
sh=6EA7EB018890F88F259C4D16ABC031AFB288C342 ft=1 fh=981b2ab4b7e56b89 vn="Win32/VOPackage.AY evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\AppData\Local\Temp\D368tmp\vopackage.exe"
sh=9246A3EFC3BA0FDC68695C3004846A38B72595BE ft=1 fh=6195b84ae43fa157 vn="Variante von Win32/Adware.SpeedingUpMyPC.T.gen Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\AppData\Local\Temp\D36Atmp\superoptimizersetup.exe"
sh=FB3F7E2BF56F5EA06763303CDAA0E962E975E063 ft=1 fh=c0dea5299389dc4e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\AppData\Local\Temp\DMR\dmr_72.exe"
sh=7C8E04004D7F1CC4D55183408224939EE1C1A8CA ft=1 fh=894bcba1f57eb12d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Desktop\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=1EFDC899D367CEE4E627DFFA108D3FA1DA78A7F4 ft=1 fh=a76b0707069790cd vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Documents\Eigene Dateien\scribus-1.3.3.13-win32-install.exe"
sh=26590FB2BCD90BDE7F3C89B7AE4B684B24F74CD2 ft=1 fh=f46f5e2b9517bece vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Documents\Humaida\softonic-Deutsch.exe"
sh=03EAF9B477C8FF0F7F07A6FC6EB581976395963A ft=1 fh=8f191ebfd30f6388 vn="Win32/Mobogenie.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Downloads\Mobogenie_Setup_2.2.5_21.exe"
sh=E2C028A886AA7352539DEE32CBB38770C529A76E ft=1 fh=d2aeb2930bcba9f7 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Downloads\PDFCreator-1_7_3_setup.exe"
sh=06D4F09ACA04DBBC5E672BE4E45251443B06463B ft=1 fh=d87d339fa45b1340 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bismillah\Downloads\Total Uninstall - CHIP-Installer.exe"
sh=8E11576A2D99F0900DF7B767B216F3813170EB97 ft=1 fh=103cd6974b4c4f5b vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"
Code:
ATTFilter Results of screen317's Security Check version 0.99.93
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Internet Security
Windows Defender
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 16.0.0.235
Adobe Reader XI
Mozilla Firefox (34.0.5)
````````Process Check: objlist.exe by Laurent````````
Kaspersky Lab Kaspersky Internet Security 15.0.0 avp.exe
Kaspersky Lab Kaspersky Internet Security 15.0.0 avpui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 07-01-2015 21:34:46
Running from C:\Users\Bismillah\Downloads
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\RunOnce: [Adobe Speed Launcher] => 1420646338
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\zep0bc29.default-1420579432016
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U3 uftdrpow; \??\C:\Users\BISMIL~1\AppData\Local\Temp\uftdrpow.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-07 21:33 - 2015-01-07 21:33 - 00852505 _____ () C:\Users\Bismillah\Desktop\SecurityCheck.exe
2015-01-07 20:16 - 2015-01-07 20:16 - 02347384 _____ (ESET) C:\Users\Bismillah\Downloads\esetsmartinstaller_deu.exe
2015-01-07 20:11 - 2015-01-07 20:11 - 00000000 ____D () C:\Users\Bismillah\Downloads\FRST-OlderVersion
2015-01-07 20:10 - 2015-01-07 20:10 - 00000982 _____ () C:\Users\Bismillah\Desktop\Fixlist.txt
2015-01-06 22:26 - 2015-01-06 22:26 - 00018558 _____ () C:\Users\Bismillah\Downloads\Addition.txt
2015-01-06 22:25 - 2015-01-07 21:34 - 00018368 _____ () C:\Users\Bismillah\Downloads\FRST.txt
2015-01-06 22:25 - 2015-01-07 20:11 - 02124288 _____ (Farbar) C:\Users\Bismillah\Downloads\FRST64.exe
2015-01-06 22:22 - 2015-01-06 22:22 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-06 22:14 - 2015-01-06 22:14 - 00267660 _____ () C:\Users\Bismillah\Desktop\bookmarks.html
2015-01-06 20:59 - 2015-01-06 20:59 - 00034132 _____ () C:\Users\Bismillah\Desktop\gmer.txt
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-07 21:34 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:00 - 2015-01-06 22:23 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-07 21:35 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-07 21:17 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2015-01-07 21:17 - 2014-01-09 12:54 - 00000000 ____D () C:\Users\Bismillah\Documents\Eigene Dateien
2015-01-07 21:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-07 21:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-07 20:57 - 2014-07-12 13:15 - 01446336 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-07 20:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-07 20:16 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-07 20:04 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-07 17:46 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-07 16:11 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-07 12:04 - 2014-02-11 11:50 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bücher
2015-01-07 11:13 - 2014-01-09 12:31 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-07 11:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-07 10:06 - 2014-05-25 10:05 - 00000000 __RDO () C:\Users\Bismillah\OneDrive
2015-01-06 22:36 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-06 21:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:25 - 2014-06-26 11:18 - 00069800 _____ () C:\WINDOWS\PFRO.log
2015-01-06 20:25 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-06 20:25 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 20:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-08 15:05 - 2014-12-06 20:18 - 00000275 _____ () C:\AdwCleanerDebug.txt
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
Some content of TEMP:
====================
C:\Users\Bismillah\AppData\Local\Temp\Browser7-win32-installer-06.exe
C:\Users\Bismillah\AppData\Local\Temp\Quarantine.exe
C:\Users\Bismillah\AppData\Local\Temp\sdan.exe
C:\Users\Bismillah\AppData\Local\Temp\sdapk.exe
C:\Users\Bismillah\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bismillah\AppData\Local\Temp\sqlite3.dll
C:\Users\Bismillah\AppData\Local\Temp\_isB3C6.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-06 22:03
==================== End Of Log ============================
|
|
08.01.2015, 07:54
| #6 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
C:\Users\Bismillah\AppData\Local\Temp\D367tmp\fastplayersetup.exe
C:\Users\Bismillah\AppData\Local\Temp\D368tmp\vopackage.exe
C:\Users\Bismillah\AppData\Local\Temp\D36Atmp\superoptimizersetup.exe
C:\Users\Bismillah\AppData\Local\Temp\DMR\dmr_72.exe
C:\Users\Bismillah\Desktop\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
C:\Users\Bismillah\Documents\Eigene Dateien\scribus-1.3.3.13-win32-install.exe
C:\Users\Bismillah\Documents\Humaida\softonic-Deutsch.exe
C:\Users\Bismillah\Downloads\Mobogenie_Setup_2.2.5_21.exe
C:\Users\Bismillah\Downloads\PDFCreator-1_7_3_setup.exe
C:\Users\Bismillah\Downloads\Total Uninstall - CHIP-Installer.exe
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte. Noch Probleme?
__________________ --> Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut |
|
08.01.2015, 10:58
| #7 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertrautCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015
Ran by Bismillah at 2015-01-08 10:46:55 Run:1
Running from C:\Users\Bismillah\Downloads
Loaded Profile: Bismillah (Available profiles: Bismillah)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
Emptytemp:
*****************
C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-265324917-246502483-178326081-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47591EA-696E-46C7-B38C-F63999D578C9}" => Key deleted successfully.
HKCR\CLSID\{C47591EA-696E-46C7-B38C-F63999D578C9} => Key not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => Key deleted successfully.
EmptyTemp: => Removed 1.6 GB temporary data.
The system needed a reboot.
==== End of Fixlog 10:47:35 ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 08-01-2015 10:57:23
Running from C:\Users\Bismillah\Downloads
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\jmesoft\Service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\zep0bc29.default-1420579432016
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-07 21:33 - 2015-01-07 21:33 - 00852505 _____ () C:\Users\Bismillah\Desktop\SecurityCheck.exe
2015-01-07 20:16 - 2015-01-07 20:16 - 02347384 _____ (ESET) C:\Users\Bismillah\Downloads\esetsmartinstaller_deu.exe
2015-01-07 20:11 - 2015-01-07 20:11 - 00000000 ____D () C:\Users\Bismillah\Downloads\FRST-OlderVersion
2015-01-06 22:26 - 2015-01-06 22:26 - 00018558 _____ () C:\Users\Bismillah\Downloads\Addition.txt
2015-01-06 22:25 - 2015-01-08 10:57 - 00016886 _____ () C:\Users\Bismillah\Downloads\FRST.txt
2015-01-06 22:25 - 2015-01-07 20:11 - 02124288 _____ (Farbar) C:\Users\Bismillah\Downloads\FRST64.exe
2015-01-06 22:22 - 2015-01-06 22:22 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-06 22:22 - 2015-01-06 22:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-06 22:14 - 2015-01-06 22:14 - 00267660 _____ () C:\Users\Bismillah\Desktop\bookmarks.html
2015-01-06 20:59 - 2015-01-06 20:59 - 00034132 _____ () C:\Users\Bismillah\Desktop\gmer.txt
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-08 10:57 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:00 - 2015-01-06 22:23 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-08 10:57 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-08 10:53 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-08 10:51 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-08 10:51 - 2014-06-25 19:55 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-08 10:51 - 2014-05-25 10:05 - 00000000 ___DO () C:\Users\Bismillah\OneDrive
2015-01-08 10:50 - 2014-06-26 11:18 - 00071578 _____ () C:\WINDOWS\PFRO.log
2015-01-08 10:50 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-08 10:50 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-08 10:50 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-08 10:49 - 2014-07-12 13:15 - 01536335 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-08 10:49 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-08 10:49 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-08 10:46 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2015-01-08 10:45 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-08 10:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-08 10:41 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-07 23:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-07 21:17 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2015-01-07 21:17 - 2014-01-09 12:54 - 00000000 ____D () C:\Users\Bismillah\Documents\Eigene Dateien
2015-01-07 17:46 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-07 12:04 - 2014-02-11 11:50 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bücher
2015-01-07 11:13 - 2014-01-09 12:31 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-06 21:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-06 22:03
==================== End Of Log ============================
--- --- --- Lollipop scheint weg zu sein und Paypal wird auch wieder ohne Probleme geöffnet |
|
08.01.2015, 11:33
| #8 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.01.2015, 12:59
| #9 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Ich finde Defogger nicht mehr auf dem PC wieder. Ich hatte es aber installiert und habe auch eine Disable und eine Reeanable TXT Datei auf dem Desktop |
|
08.01.2015, 16:57
| #10 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Dann lass einfach delfix laufen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.01.2015, 18:35
| #11 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Ok, danke für alles |
|
08.01.2015, 20:03
| #12 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.01.2015, 17:03
| #13 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Hallo, leider ist soeben Lollipop wieder aufgetaucht, aber erst seit ich die HP der Deutschen Bank über den sicheren Zahlungsverkehr bei Kaspersky geöffnet habe. Bis jetzt ist auch nur diese Seite betroffen, alles Andere lässt sich weiter auf Firefox ohne Lollipop-Werbung öffneb. |
|
15.01.2015, 18:12
| #14 |
| /// the machine /// TB-Ausbilder | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut und wenn du die Bank in FF ohne KAV öffnest?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.01.2015, 19:51
| #15 |
| | Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Dann kommt keine Lollipop Werbung |
|
| Themen zu Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut |
| adware, bonjour, browser, computer, converter, desktop, dvdvideosoft ltd., ebanking, entfernen, firefox, flash player, google, home, homepage, installmanager.exe, junkware, kaspersky, mozilla, problem, realtek, registry, scan, security, software, svchost.exe, system, updates, usb, windows |
Linear-Darstellung
