| |
| |||||||
Log-Analyse und Auswertung: Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertrautWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
06.01.2015, 21:20
| #1 |
 |  Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut Hallo, ich bin ganz neu hier und kenne mich mit Computern auch nicht wirklich gut aus. Ich hoffe, dass ich alles richtig mache, eure Schritte bei der Anleitung bei Virenbefall hab ich durchgeführt und füge die Ergebnisse gleich ein. Mein erstes Problem ist, dass ich mir leider irgendwo Lollipop eingefangen habe und ich es nicht mehr entfernen kann. Ich habe schon mehrfach Malwarebytes Anti Malware, AdwCleaner, Junkware Removal und auch den Kaspersky Scanner durchlaufen lassen, aber es ändert sich nichts. Die Lollipop-Einblendungen kommen nur bei Firefox vor, bei IE nicht, darum benutze ich momentan IE. Das zweite Problem ist, dass ich seit ca 2 Wochen Paypal nicht mehr öffnen kann, da ich bei Firefox die Meldung "Dieser Verbindung wird nicht vertraut" bekomme, ohne dass ich den Button habe "Ausnahme hinzufügen". Ich danke euch schon mal für eure Hilfe und schicke jetzt die Logdateien First Editor: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015
Ran by Bismillah (administrator) on SAMAHUHAUM on 06-01-2015 20:53:39
Running from C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V
Loaded Profile: Bismillah (Available profiles: Bismillah)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\SysWOW64\UMonit.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Lenovo) C:\Windows\jmesoft\hotkey.exe
(CyberLink) C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe
(Lenovo) C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\klwtblfs.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12497552 2012-05-28] (Realtek Semiconductor)
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit.exe [28672 2012-07-24] ()
HKLM-x32\...\Run: [jmekey] => C:\WINDOWS\jmesoft\hotkey.exe [118784 2011-06-08] (Lenovo)
HKLM-x32\...\Run: [jmesoft] => C:\Windows\jmesoft\ServiceLoader.exe [28672 2011-03-15] ()
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720 2009-12-04] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [ModeSwitch] => C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe [751104 2012-03-31] (Lenovo)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Run: [UpdateStar Drivers] => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:60642;https=127.0.0.1:60642
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-265324917-246502483-178326081-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-265324917-246502483-178326081-1001 -> {C47591EA-696E-46C7-B38C-F63999D578C9} URL =
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Bismillah\AppData\Roaming\Mozilla\Firefox\Profiles\huhvr1qd.default-1420477253032
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Extension: Widget context - C:\Users\Bismillah\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-31]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-11-30]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-11-30]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-265324917-246502483-178326081-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-10-03]
Chrome:
=======
CHR Profile: C:\Users\Bismillah\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 JME Keyboard; C:\Windows\jmesoft\Service.exe [32768 2011-03-15] () [File not signed]
R2 LenovoCOMSvc; C:\Program Files\Lenovo\Power Control Switch\LenovoCOMSvc.exe [37888 2011-11-04] (Lenovo) [File not signed]
R3 LitModeCtrl; C:\Program Files\Lenovo\Power Control Switch\LitModeCtrl.exe [141824 2012-04-06] (Lenovo) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738344 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [60928 2012-07-06] (GenesysLogic)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-11-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-11-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 20:49 - 2015-01-06 20:49 - 00000480 _____ () C:\Users\Bismillah\Desktop\defogger_disable.log
2015-01-06 20:49 - 2015-01-06 20:49 - 00000000 _____ () C:\Users\Bismillah\defogger_reenable
2015-01-06 19:35 - 2015-01-06 20:53 - 00000000 ____D () C:\FRST
2015-01-06 19:31 - 2015-01-06 19:31 - 00001287 _____ () C:\Users\Bismillah\Desktop\Revo Uninstaller.lnk
2015-01-06 19:31 - 2015-01-06 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-06 19:27 - 2015-01-06 19:27 - 00003018 _____ () C:\Users\Bismillah\Desktop\Rkill.txt
2015-01-06 19:26 - 2015-01-06 19:27 - 00000000 ____D () C:\Users\Bismillah\Downloads\rKill
2015-01-06 19:22 - 2015-01-06 19:22 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\NVIDIA
2015-01-05 20:28 - 2015-01-05 20:28 - 02173952 _____ () C:\Users\Bismillah\Downloads\adwcleaner_4.106.exe
2015-01-05 18:58 - 2014-12-28 09:01 - 01707939 _____ (Thisisu) C:\Users\Bismillah\Desktop\JRT_NEW.exe
2015-01-05 18:00 - 2015-01-05 18:00 - 00000000 ____D () C:\Users\Bismillah\Desktop\Alte Firefox-Daten
2015-01-05 17:59 - 2015-01-05 17:59 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-05 17:59 - 2015-01-05 17:59 - 00001166 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-05 17:59 - 2015-01-05 17:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-02 16:34 - 2015-01-02 16:34 - 00000214 _____ () C:\Users\Bismillah\Desktop\Kinder im Islam www.kinderimislam.de.URL
2014-12-16 14:21 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-16 14:20 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 13:22 - 2014-12-11 13:22 - 00001062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-11 13:22 - 2014-12-11 13:22 - 00001050 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-11 13:21 - 2014-12-11 13:21 - 07694560 _____ (TeamViewer GmbH) C:\Users\Bismillah\Desktop\TeamViewer_Setup_de-iet.exe
2014-12-11 09:46 - 2014-12-11 09:46 - 00001806 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-11 09:46 - 2014-12-11 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iTunes
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files\iPod
2014-12-11 09:45 - 2014-12-11 09:45 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-11 09:45 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2014-12-11 09:36 - 2014-12-11 09:39 - 122418480 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunes64Setup.exe
2014-12-11 09:10 - 2014-12-11 09:15 - 109829936 _____ (Apple Inc.) C:\Users\Bismillah\Desktop\iTunesSetup.exe
2014-12-10 23:33 - 2014-12-10 23:33 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 10:28 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 10:28 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 10:28 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 10:14 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 10:14 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 10:14 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 10:14 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 10:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 10:14 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 10:14 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 10:14 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 10:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 10:14 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 10:14 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 10:14 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 10:14 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 10:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 10:14 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 10:14 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 10:14 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 10:14 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 10:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 10:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 10:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 10:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 10:14 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 10:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 10:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 10:12 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 10:12 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 10:12 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 10:12 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 10:12 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 10:12 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 10:12 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 10:12 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-06 20:54 - 2014-01-09 12:26 - 00000214 _____ () C:\Users\Bismillah\Documents\pms.xml
2015-01-06 20:49 - 2014-07-12 13:15 - 01162368 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-06 20:49 - 2014-05-25 09:42 - 00000000 ____D () C:\Users\Bismillah
2015-01-06 20:42 - 2014-01-09 17:32 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-06 20:41 - 2014-11-30 20:45 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-06 20:35 - 2014-01-09 12:31 - 00003592 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-265324917-246502483-178326081-1001
2015-01-06 20:26 - 2014-05-25 10:05 - 00000000 ___DO () C:\Users\Bismillah\OneDrive
2015-01-06 20:25 - 2014-06-26 11:18 - 00069800 _____ () C:\WINDOWS\PFRO.log
2015-01-06 20:25 - 2014-01-22 19:18 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-06 20:25 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-06 20:25 - 2012-10-26 07:21 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-06 20:24 - 2014-05-25 08:20 - 00000000 ____D () C:\AdwCleaner
2015-01-06 20:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-06 20:04 - 2014-01-22 19:18 - 00001140 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-06 20:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-06 19:44 - 2014-12-06 20:31 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-06 19:35 - 2014-05-29 11:44 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\CrashDumps
2015-01-06 16:07 - 2014-06-21 11:38 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{16CC5692-2C35-4C25-8F61-F0ADDFAB3CAB}
2015-01-06 11:40 - 2014-01-09 12:53 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bewerbung
2015-01-05 23:51 - 2014-01-09 14:31 - 00000008 _____ () C:\Users\Bismillah\Documents\lmscfg
2015-01-05 18:27 - 2014-11-12 23:55 - 00775374 _____ () C:\WINDOWS\system32\perfh00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00421222 _____ () C:\WINDOWS\system32\perfh001.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00148558 _____ () C:\WINDOWS\system32\perfc00C.dat
2015-01-05 18:27 - 2014-11-12 23:55 - 00064428 _____ () C:\WINDOWS\system32\perfc001.dat
2015-01-05 18:27 - 2014-03-18 11:03 - 03183132 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 18:27 - 2014-03-18 10:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-05 18:27 - 2014-03-18 10:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-05 17:59 - 2014-12-01 23:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-04 14:18 - 2014-11-19 13:31 - 00000000 ____D () C:\Users\Bismillah\Desktop\USUUL
2015-01-01 20:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-29 12:33 - 2014-01-09 13:11 - 00000000 ____D () C:\Users\Bismillah\Desktop\Hijama
2014-12-27 12:32 - 2014-02-18 09:54 - 00000000 ____D () C:\Users\Bismillah\.schoolsplay.rc
2014-12-18 17:31 - 2014-01-22 11:33 - 00000000 ____D () C:\Users\Bismillah\Desktop\Bilder
2014-12-18 09:36 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-17 10:02 - 2014-08-31 15:23 - 00000000 ____D () C:\Users\Bismillah\AppData\Local\Adobe
2014-12-17 09:58 - 2014-01-09 17:32 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-15 20:05 - 2013-08-22 15:44 - 00510128 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-12-15 09:47 - 2014-11-02 11:24 - 00000000 ____D () C:\Users\Bismillah\Desktop\neue Klamotten
2014-12-15 09:27 - 2014-01-10 11:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-15 09:25 - 2014-01-10 11:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-12 13:51 - 2014-09-26 11:27 - 00000000 ____D () C:\Users\Bismillah\Desktop\XSTICK
2014-12-12 13:51 - 2014-01-09 13:20 - 00000000 ____D () C:\Users\Bismillah\Desktop\ISLAM
2014-12-12 12:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-11 20:44 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-11 19:46 - 2014-10-10 08:25 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\Apple Computer
2014-12-11 13:22 - 2014-08-25 15:59 - 00000000 ____D () C:\Users\Bismillah\AppData\Roaming\TeamViewer
2014-12-11 09:45 - 2014-10-10 08:24 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-12-10 23:33 - 2014-07-10 12:40 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\ar-SA
2014-12-10 23:33 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:49 - 2014-01-10 11:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-10 10:56 - 2014-01-20 16:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 10:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-09 12:02 - 2014-01-09 13:13 - 00000000 ____D () C:\Users\Bismillah\Documents\Humaida
2014-12-08 15:05 - 2014-12-06 20:18 - 00000275 _____ () C:\AdwCleanerDebug.txt
Files to move or delete:
====================
C:\Users\Bismillah\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
C:\Users\Bismillah\Childsplay-1.6_win32.exe
C:\Users\Bismillah\gcompris-13.11.exe
C:\Users\Bismillah\install_flashplayer12x32au_ltr5x64d_awc_aih.exe
C:\Users\Bismillah\Opera_20.0.1387.82_Setup.exe
C:\Users\Bismillah\Silverlight_x64.exe
C:\Users\Bismillah\SkypeSetup.exe
C:\Users\Bismillah\tuxpaint-0.9.21c-win32-installer.exe
C:\Users\Bismillah\tuxpaint-stamps-2009-06-28-win32-installer.exe
Some content of TEMP:
====================
C:\Users\Bismillah\AppData\Local\Temp\Browser7-win32-installer-06.exe
C:\Users\Bismillah\AppData\Local\Temp\Quarantine.exe
C:\Users\Bismillah\AppData\Local\Temp\sdan.exe
C:\Users\Bismillah\AppData\Local\Temp\sdapk.exe
C:\Users\Bismillah\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bismillah\AppData\Local\Temp\sqlite3.dll
C:\Users\Bismillah\AppData\Local\Temp\_isB3C6.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-05 20:47
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-01-2015
Ran by Bismillah at 2015-01-06 20:54:19
Running from C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Childsplay 1.6 (HKLM-x32\...\Childsplay_is1) (Version: 1.6 - )
Free YouTube to MP3 Converter version 3.12.46.923 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.923 - DVDVideoSoft Ltd.)
GCompris Uninstall (HKLM-x32\...\GCompris) (Version: - )
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.1.1.0 - Genesys Logic)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Lenovo Blacksilk USB Keyboard Driver (HKLM-x32\...\{B266E062-D6C5-485B-B426-51B152B041A6}) (Version: V1.4.11.0608 - Lenovo)
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: - CEWE COLOR AG u Co. OHG)
Lenovo Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.6418 - CyberLink Corp.)
Lenovo Power2Go (x32 Version: 6.0.6418 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4126.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
Lenovo Rescue System (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 4.0.0.0822 - CyberLink Corp.)
Lenovo Rescue System (Version: 4.0.0.0822 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
NVIDIA 3D Vision Treiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera Stable 20.0.1387.82 (HKLM-x32\...\Opera 20.0.1387.82) (Version: 20.0.1387.82 - Opera Software ASA)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 Create Module (HKLM-x32\...\{797A6AD2-06D5-484B-81FE-25895A56B1F2}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Power Control Switch (HKLM-x32\...\{816F9A97-9889-43DA-A394-7AA45DD68BA0}) (Version: 4.0.0.0704 - Lenovo)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6649 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.0187 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36244 - TeamViewer)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Total Uninstall 6.4.1 (HKLM\...\Total Uninstall 6_is1) (Version: 6.4.1 - Gavrila Martau)
Tux Paint 0.9.21c (HKLM-x32\...\Tux Paint_is1) (Version: - New Breed Software)
Tux Paint Stamps 2009-06-28 (HKLM-x32\...\Tux Paint Stamps_is1) (Version: - New Breed Software)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
18-12-2014 09:35:58 Windows Update
25-12-2014 10:06:10 Geplanter Prüfpunkt
03-01-2015 14:14:49 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {024521B8-53D8-4BF6-BC27-3F610AEFD0FE} - System32\Tasks\OFFICE2010ACT => C:\ProgramData\Microsoft\Windows\OFFICEICON.vbs [2012-03-08] ()
Task: {51749448-9FB5-48C5-A211-B5F95D31BC00} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {5A92D050-41E7-44FE-848A-06C6F542E870} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-15] (Microsoft Corporation)
Task: {75BCEC0D-FA05-49EA-956E-22B3324217CA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9E370534-C907-463A-A18D-18E6605A8D7E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-17] (Adobe Systems Incorporated)
Task: {AAC6FC5A-1A9A-4A05-9432-7B4641E9445F} - System32\Tasks\{266D9F78-9D2F-47B6-B081-8E1A5A3982FA} => pcalua.exe -a C:\Users\Bismillah\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=tugs
Task: {ADC646E5-1AEA-4F28-B04E-A74485B0AB1F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-22] (Google Inc.)
Task: {C219AA82-2805-4BF3-950B-E05FC0FD94C7} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-10-26 07:19 - 2012-07-24 12:36 - 00028672 _____ () C:\Windows\SysWOW64\UMonit.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2009-12-04 15:59 - 2009-12-04 15:59 - 00619816 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
2009-12-04 16:04 - 2009-12-04 16:04 - 00013096 _____ () C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
2012-10-26 07:18 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-05 17:59 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 01:42 - 2014-11-30 21:04 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:AD022376
AlternateDataStreams: C:\Users\Bismillah\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "jmesoft"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "UpdateStar Drivers"
HKU\S-1-5-21-265324917-246502483-178326081-1001\...\StartupApproved\Run: => "TomTomHOME.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-265324917-246502483-178326081-500 - Administrator - Disabled)
Bismillah (S-1-5-21-265324917-246502483-178326081-1001 - Administrator - Enabled) => C:\Users\Bismillah
Gast (S-1-5-21-265324917-246502483-178326081-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-265324917-246502483-178326081-1004 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 27%
Total physical RAM: 8147.33 MB
Available physical RAM: 5902.06 MB
Total Pagefile: 9427.33 MB
Available Pagefile: 6919.27 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:1835.98 GB) (Free:1738.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 12076AA1)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-06 20:59:33
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-3 ST2000DM001-9YN164 rev.CC62 1863,02GB
Running: Gmer-19357.exe; Driver: C:\Users\BISMIL~1\AppData\Local\Temp\uftdrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\dwm.exe[348] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[748] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[580] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5056] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\WINDOWS\explorer.exe[41012] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Program Files\Internet Explorer\iexplore.exe[63280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff8eaa11f6a 4 bytes [A1, EA, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff8eaa11f82 4 bytes [A1, EA, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8ef56169a 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8ef5616a2 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8ef56181a 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe[15280] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8ef561832 4 bytes [56, EF, F8, 7F]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff8f1cf2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff8f1cf2d14 8 bytes {JMP 0xffffffffffffffd8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff8f1cf2ee8 16 bytes {JMP 0xffffffffffffffb8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff8f1cf3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff8f1cf3878 8 bytes {JMP 0xffffffffffffffd3}
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff8f1cf425c 8 bytes {JMP 0xffffffffffffffbb}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff8f1cf4a2b 8 bytes {JMP 0xffffffffffffffde}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff8f1cf4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff8f1cf4cfc 8 bytes {JMP 0xffffffffffffffb1}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff8f1cf5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff8f1cf511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff8f1cf6693 8 bytes {JMP 0xffffffffffffffde}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff8f1cf6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff8f1cf6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff8f1cf740f 8 bytes {JMP 0xffffffffffffffe8}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff8f1cf75c7 8 bytes {JMP 0xffffffffffffffe5}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff8f1cfa8b3 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff8f1cfa8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff8f1cfa9c4 8 bytes {JMP 0xffffffffffffffe1}
.text ... * 3
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff8f1cfad90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff8f1cfb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff8f1cfb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff8f1cfb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff8f1cfb648 8 bytes [10, 6A, F8, 7F, 00, 00, 00, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff8f1cfb88c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff8f1cfb98c 8 bytes [E0, 69, F8, 7F, 00, 00, 00, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff8f1cfbc38 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff8f1cfbe94 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff8f1d71740 8 bytes {JMP QWORD [RIP-0x75dba]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff8f1d718c0 8 bytes {JMP QWORD [RIP-0x75eda]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff8f1d718f0 8 bytes {JMP QWORD [RIP-0x762ae]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff8f1d71a10 8 bytes {JMP QWORD [RIP-0x7618a]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff8f1d71ac0 8 bytes {JMP QWORD [RIP-0x76403]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff8f1d72180 8 bytes {JMP QWORD [RIP-0x762f2]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff8f1d72480 8 bytes {JMP QWORD [RIP-0x7684e]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff8f1d72d00 8 bytes {JMP QWORD [RIP-0x771f6]}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 381 000000007757137d 16 bytes {JMP 0xffffffffffffffd3}
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 386 0000000077571512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077571551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuSetStackPointer + 23 0000000077571577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuResetToConsistentState + 516 0000000077571784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuThreadInit + 50 00000000775717c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000775717e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077571834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 0000000077571841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 0000000077571a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077572ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077572c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe[15548] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000077572c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [764:1820] fffff960009adb90
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\avengine.dll.a500c54fd49c0b4d0fb6e3c9244b51a0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f8f0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavbase.kdl.7aa539a1cbbfb4baa644b9866f4bcf4b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f850000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavemu.kdl.b6b6dd223ad2aad28374217a028b59b0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ecb0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kjim.kdl.104b20cc4ad0260caa6022d868ce31a7 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f600000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\mark.kdl.6c69ef8fd152138b474ef4e5105233c9 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f5a0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\qscan.kdl.b2ff916870cb69af1da84f4b229ebcec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f470000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\arkmon.kdl.aeeec152e3e81f218d27686fcaf9d774 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f440000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavsys.kdl.6320146b23a54cc3a482468b7b46e6a4 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f3c0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\uds.dll.00000000000690c0-01d00cd64521e47a-01d00fa1727a682f (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ec40000
Library c:\programdata\kaspersky lab\avp15.0.0\data\wlengine.dll (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006f370000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\intctrl.kdl.0000000000090000-01d00cd643c8281f-01d00cdbf6056197 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006ea30000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\vlns.kdl.75bc7021d19dabc13b3578597a15f843 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006b3d0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pbs.kdl.eefcc4c76375abb2b40e8e5c00c7eccf (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 000000006b270000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavasyswatch.dll.000000000010ee00-01d00cd643ccece2-01d00cd8d7693354 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061af0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon.kdl.0000000000019800-01d00cd644894c11-01d010750096e0e8 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000616e0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon_drv.kdl.0000000000018600-01d00cd644b8fb86-01d01861bd7f73b8 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000616a0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pdm.kdl.0000000000069740-01d00cd64448ebc0-01cf757c6cdf4600 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061630000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\heurap.dll.0ce84b1af150e117a14d119f99292f28 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 0000000061550000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\bsshlp2.kdl.7b5ed3ca6d3d7225b866af3c09484fec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000614d0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\sys_critical_obj.dll.0000000000023800-01d00cd644e18420-01cf757be4f93c00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1920] (FILE NOT FOUND) 00000000613e0000
Process C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe (*** suspicious ***) @ C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\6SNPM86V\FRST64.exe [15280] (Farbar Recovery Scan Tool/Farbar)(2015-01-06 19:53:33) 00007ff679f80000
Process C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe (*** suspicious ***) @ C:\Users\Bismillah\AppData\Local\Microsoft\Windows\INetCache\IE\L7AXOZWX\Gmer-19357.exe [15548](2015-01-06 19:54:34) 0000000000400000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
| Themen zu Lollipop eingefangen, lässt sich nicht entfernen und bei FF Problem: dieser Verbindung wird nicht vertraut |
| adware, bonjour, browser, computer, converter, desktop, dvdvideosoft ltd., ebanking, entfernen, firefox, flash player, google, home, homepage, installmanager.exe, junkware, kaspersky, mozilla, problem, realtek, registry, scan, security, software, svchost.exe, system, updates, usb, windows |
Baum-Darstellung