| |
| |||||||
Log-Analyse und Auswertung: BlockandSurf Reste nicht auffindbarWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.01.2015, 11:23
| #1 |
| |  BlockandSurf Reste nicht auffindbar Hallo, ich habe auf meinen Rechner (Windows 8.1 (x64), i5-4570 und 8GB Ram) den Trojaner Block and Surf eingefangen. Daraufhin habe ich die Lösungen welche für mehrere Betroffene im Forum beschrieben wurden abgearbeitet: Revo uninstaller ADWCleaner Malwarebytes CCleaner Danach alle Browser zurückgsetzt und zB Firefox total gelöscht und wieder installiert. Leider kommt die Werbung und die grün unterstrichenen Texte trotzdem bei allen Browsern wieder. Habe auch extra Opera als Browser installiert, hat aber leider das gleiche Ergebnis. Wenn ich inzwischen eine Suche starte findet keines der oben genannten Programme inklusive Kaspersky etwas mehr. Bin daher schon ziemlich verzweifelt, da ich scheinbar die Lage verschlimmert habe. Vielen Dank für eure Hilfe. Code:
ATTFilter # AdwCleaner v4.107 - Bericht erstellt am 12/01/2015 um 11:08:15
# Aktualisiert 07/01/2015 von Xplode
# Database : 2014-12-21.4 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Michael - GAMER
# Gestartet von : C:\Users\Michael\Downloads\AdwCleaner_4.107.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\bzb9mj22.default\user.js
Datei Gefunden : C:\Users\Michael\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage
Datei Gefunden : C:\Users\Michael\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage-journal
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0.5 (x86 de)
-\\ Opera v26.0.1656.60
*************************
AdwCleaner[R5].txt - [909 octets] - [11/01/2015 11:26:39]
AdwCleaner[R6].txt - [1408 octets] - [12/01/2015 11:00:08]
AdwCleaner[R7].txt - [1932 octets] - [12/01/2015 11:08:15]
AdwCleaner[S4].txt - [969 octets] - [11/01/2015 11:27:39]
########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [2051 octets] ##########
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 Ran by Michael (administrator) on GAMER on 12-01-2015 11:12:54 Running from C:\Users\Michael\Downloads Loaded Profile: Michael (Available profiles: Michael) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\System32\PnkBstrA.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPOP3.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) D:\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Users\Michael\Downloads\AdwCleaner_4.107.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation) HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [8292120 2013-11-14] (Logitech Inc.) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-03-12] (Intel Corporation) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-08-01] (RealNetworks, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKLM-x32\...\Run: [iTunesHelper] => D:\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKU\S-1-5-21-1810438206-4125388404-2537037518-1002\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1810438206-4125388404-2537037518-1002\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.) HKU\S-1-5-21-1810438206-4125388404-2537037518-1002\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-1810438206-4125388404-2537037518-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/ StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1810438206-4125388404-2537037518-1002 -> {9C5FF05E-14BD-410B-AA45-52DF554BDBEF} URL = SearchScopes: HKU\S-1-5-21-1810438206-4125388404-2537037518-1002 -> {BDF61FAE-9D19-40F0-8F34-688DEB334CA9} URL = hxxp://securedsearch.lavasoft.com/results.php?pr=vmn&id=webcompa&ent=ch_WCYID10088_test01_150105&q={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKU\S-1-5-21-1810438206-4125388404-2537037518-1002 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKU\S-1-5-21-1810438206-4125388404-2537037518-1002 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab Tcpip\Parameters: [DhcpNameServer] 10.0.0.3 FireFox: ======== FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\bzb9mj22.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB) FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll (EA Digital Illusions CE AB) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @real.com/nppl3260;version=17.0.11.7 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\bzb9mj22.default\user.js FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-01] FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-08] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-08] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-08] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation) S3 Origin Client Service; D:\Origin\OriginClientService.exe [1903472 2015-01-04] (Electronic Arts) R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-19] () R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-07-19] () R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] () R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-01] (RealNetworks, Inc.) R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-25] () [File not signed] S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 Apowersoft_AudioDevice; C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab) R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [150536 2015-01-08] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [247480 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [799944 2015-01-08] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [68616 2015-01-08] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [77512 2015-01-08] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-12] (Malwarebytes Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation) S3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation) S3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation) S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [129856 2012-10-20] (Ray Hinchliffe) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) R2 webinstrNHK; C:\Windows\system32\Drivers\webinstrNHK.sys [56432 2015-01-07] (Corsica) S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation) U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-12 10:50 - 2015-01-12 10:50 - 00037502 _____ () C:\Users\Michael\Downloads\Addition.txt 2015-01-12 10:49 - 2015-01-12 11:12 - 00021767 _____ () C:\Users\Michael\Downloads\FRST.txt 2015-01-12 10:49 - 2015-01-12 11:12 - 00000000 ____D () C:\FRST 2015-01-12 10:48 - 2015-01-12 10:48 - 02124288 _____ (Farbar) C:\Users\Michael\Downloads\FRST64.exe 2015-01-12 10:43 - 2015-01-12 10:43 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-12 10:43 - 2015-01-12 10:43 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-12 10:43 - 2015-01-12 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-12 10:42 - 2015-01-12 10:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-12 10:42 - 2015-01-12 10:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Michael\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-12 10:42 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-12 10:42 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-01-12 10:42 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-01-12 10:33 - 2015-01-12 10:33 - 00232424 _____ () C:\Users\Michael\Downloads\Thumbmaker (3).exe 2015-01-12 10:33 - 2015-01-12 10:33 - 00232424 _____ () C:\Users\Michael\Downloads\Thumbmaker (2).exe 2015-01-12 10:24 - 2015-01-12 10:24 - 00232424 _____ () C:\Users\Michael\Downloads\Thumbmaker (1).exe 2015-01-12 10:24 - 2015-01-12 10:24 - 00168258 _____ () C:\Users\Michael\Downloads\Thumbmaker.zip 2015-01-12 10:23 - 2015-01-12 10:23 - 00232424 _____ () C:\Users\Michael\Downloads\Thumbmaker.exe 2015-01-12 10:19 - 2015-01-12 10:39 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-01-12 10:19 - 2015-01-12 10:19 - 00683664 _____ (Opera Software) C:\Users\Michael\Downloads\Opera_NI_stable.exe 2015-01-12 10:19 - 2015-01-12 10:19 - 00003840 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1421054383 2015-01-12 10:19 - 2015-01-12 10:19 - 00001158 _____ () C:\Users\Public\Desktop\Opera.lnk 2015-01-12 10:19 - 2015-01-12 10:19 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2015-01-12 10:19 - 2015-01-12 10:19 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Opera Software 2015-01-12 10:19 - 2015-01-12 10:19 - 00000000 ____D () C:\Users\Michael\AppData\Local\Opera Software 2015-01-12 10:18 - 2015-01-12 10:18 - 00000122 _____ () C:\Users\Michael\AppData\Roaming\profiles.ini 2015-01-12 10:18 - 2015-01-12 10:18 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Crash Reports 2015-01-12 09:33 - 2015-01-12 09:33 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-01-12 09:33 - 2015-01-12 09:33 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-01-12 09:33 - 2015-01-12 09:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-12 09:33 - 2015-01-12 09:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-12 09:13 - 2015-01-12 09:13 - 00244264 _____ () C:\Users\Michael\Downloads\Firefox Setup Stub 34.0.5 (1).exe 2015-01-11 14:55 - 2015-01-11 14:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Michael\Downloads\revosetup95.exe 2015-01-11 14:55 - 2015-01-11 14:55 - 00001291 _____ () C:\Users\Michael\Desktop\Revo Uninstaller.lnk 2015-01-11 14:55 - 2015-01-11 14:55 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-11 11:26 - 2015-01-12 11:08 - 00000000 ____D () C:\AdwCleaner 2015-01-11 11:26 - 2015-01-11 11:26 - 02191360 _____ () C:\Users\Michael\Downloads\AdwCleaner_4.107.exe 2015-01-11 11:22 - 2015-01-11 11:22 - 02785665 _____ (PortableApps.com) C:\Users\Michael\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf(1).exe 2015-01-11 11:21 - 2015-01-11 11:23 - 00000000 ____D () C:\Users\Michael\Downloads\RevoUninstallerPortable 2015-01-11 11:21 - 2015-01-11 11:21 - 02785665 _____ (PortableApps.com) C:\Users\Michael\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe 2015-01-08 18:58 - 2015-01-12 09:13 - 00244264 _____ () C:\Users\Michael\Downloads\Firefox Setup Stub 34.0.5.exe 2015-01-08 08:15 - 2015-01-08 08:15 - 00002357 _____ () C:\Users\Michael\Desktop\Sicherer Zahlungsverkehr.lnk 2015-01-08 08:13 - 2015-01-12 10:46 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-01-08 08:13 - 2015-01-08 08:16 - 00799944 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys 2015-01-08 08:13 - 2015-01-08 08:16 - 00150536 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys 2015-01-08 08:13 - 2015-01-08 08:13 - 00002163 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk 2015-01-08 08:13 - 2015-01-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2015-01-08 08:13 - 2015-01-08 08:13 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab 2015-01-08 08:13 - 2014-08-12 18:32 - 00247480 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys 2015-01-08 08:13 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll 2015-01-08 08:07 - 2015-01-08 08:12 - 204164680 _____ () C:\Users\Michael\Downloads\kis15.0.1.415de-de.exe 2015-01-07 21:59 - 2015-01-12 10:34 - 00006520 _____ () C:\Windows\PFRO.log 2015-01-07 21:20 - 2015-01-12 09:23 - 00424543 _____ () C:\Windows\WindowsUpdate.log 2015-01-07 17:45 - 2015-01-12 11:11 - 00000000 ____D () C:\Users\Michael\Desktop\Virus, Malware 2015-01-07 17:26 - 2015-01-07 17:26 - 00056432 _____ (Corsica) C:\Windows\system32\Drivers\webinstrNHK.sys 2015-01-06 19:38 - 2015-01-07 17:26 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2015-01-06 19:38 - 2015-01-06 19:38 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNHK_01009.Wdf 2015-01-05 16:06 - 2015-01-05 16:06 - 00000000 ____D () C:\Users\Michael\Documents\Firefall 2015-01-05 16:06 - 2015-01-05 16:06 - 00000000 ____D () C:\Users\Michael\AppData\Local\Red 5 Studios 2015-01-05 14:01 - 2015-01-05 17:05 - 00000000 ____D () C:\Users\Michael\Documents\Xinco 2015-01-05 12:39 - 2015-01-07 16:56 - 00000069 _____ () C:\Users\Michael\AppData\Roaming\WB.CFG 2015-01-05 11:38 - 2015-01-05 11:38 - 00000000 ____D () C:\Users\Michael\AppData\Local\WorldofTanks 2015-01-05 11:23 - 2015-01-05 11:23 - 00004688 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-01-05 11:23 - 2015-01-05 11:23 - 00002520 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-01-05 11:23 - 2015-01-05 11:23 - 00002520 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-01-05 11:23 - 2015-01-05 11:23 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\LavasoftStatistics 2015-01-05 11:23 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-01-05 11:23 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-01-05 11:20 - 2015-01-05 11:48 - 00000000 ____D () C:\ProgramData\Lavasoft 2015-01-05 11:07 - 2015-01-05 11:07 - 00003154 _____ () C:\Windows\System32\Tasks\{3D6FF52C-BA39-426D-92E3-930D2A4CEEF7} 2015-01-05 10:58 - 2015-01-07 17:31 - 00002019 _____ () C:\Windows\patsearch.bin 2015-01-05 10:57 - 2015-01-05 10:57 - 00001337 _____ () C:\Users\Michael\Desktop\Continue installation .lnk 2015-01-04 18:43 - 2015-01-04 18:43 - 00000909 _____ () C:\Users\Public\Desktop\Battlefield 4.lnk 2015-01-04 18:43 - 2015-01-04 18:43 - 00000893 _____ () C:\Users\Public\Desktop\Battlefield 4(64 bit).lnk 2014-12-24 20:15 - 2014-12-24 20:15 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2014-12-24 12:20 - 2014-12-26 11:01 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\SpinTires 2014-12-21 16:57 - 2014-12-21 16:57 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Frontier Developments 2014-12-21 16:57 - 2014-12-21 16:57 - 00000000 ____D () C:\Users\Michael\AppData\Local\Frontier Developments 2014-12-21 15:26 - 2014-12-21 15:26 - 00000000 ____D () C:\Users\Michael\AppData\Local\Frontier_Developments 2014-12-21 15:17 - 2014-12-21 15:17 - 00000679 _____ () C:\Users\Public\Desktop\Elite Dangerous Launcher.lnk 2014-12-21 15:17 - 2014-12-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frontier 2014-12-21 12:50 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2014-12-21 12:50 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2014-12-17 13:00 - 2014-12-17 13:13 - 00024996 _____ () C:\Users\Michael\Desktop\Vendor_Information_Ritoc.xlsx 2014-12-17 12:53 - 2014-12-17 12:58 - 00024985 _____ () C:\Users\Michael\Desktop\Vendor_Information.xlsx 2014-12-15 08:36 - 2014-12-15 08:37 - 00000000 ____D () C:\Users\Michael\Desktop\910GSFEU 2014-12-15 08:32 - 2015-01-12 10:49 - 00000000 ____D () C:\Users\Michael\AppData\Local\A5C43E11-D12D-4232-BFF8-321977A7BA46.aplzod 2014-12-15 08:32 - 2015-01-12 10:34 - 00000000 ___RD () C:\Users\Michael\iCloudDrive 2014-12-15 08:32 - 2014-12-15 08:32 - 00000000 ____D () C:\Users\Michael\AppData\Local\Apple Inc 2014-12-15 08:28 - 2014-12-15 08:28 - 00001864 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-12-15 08:28 - 2014-12-15 08:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-12-15 08:28 - 2014-12-15 08:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2014-12-15 08:28 - 2014-12-15 08:28 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-12-15 08:27 - 2014-12-15 08:27 - 00001458 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-12-15 08:27 - 2014-12-15 08:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-12-15 08:27 - 2014-12-15 08:27 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2014-12-15 08:27 - 2014-12-15 08:27 - 00000000 ____D () C:\Program Files\iTunes 2014-12-15 08:27 - 2014-12-15 08:27 - 00000000 ____D () C:\Program Files\iPod ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-12 11:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2015-01-12 10:50 - 2013-12-12 15:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-12 10:48 - 2013-12-12 14:07 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1810438206-4125388404-2537037518-1002 2015-01-12 10:41 - 2013-10-08 20:42 - 00765378 _____ () C:\Windows\system32\perfh007.dat 2015-01-12 10:41 - 2013-10-08 20:42 - 00159696 _____ () C:\Windows\system32\perfc007.dat 2015-01-12 10:41 - 2013-10-08 20:09 - 01780340 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-12 10:35 - 2014-03-18 14:34 - 00003338 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1810438206-4125388404-2537037518-1002 2015-01-12 10:35 - 2014-03-18 14:34 - 00003286 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1810438206-4125388404-2537037518-1002 2015-01-12 10:35 - 2013-12-12 14:03 - 00000000 ___DO () C:\Users\Michael\SkyDrive 2015-01-12 10:34 - 2014-01-21 08:54 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-12 10:34 - 2013-11-22 20:35 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-01-12 10:34 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-12 10:34 - 2013-08-22 14:25 - 00786432 ___SH () C:\Windows\system32\config\BBI 2015-01-12 10:28 - 2013-12-12 14:02 - 00000000 ____D () C:\Users\Michael\AppData\Local\VirtualStore 2015-01-12 10:14 - 2014-01-21 08:54 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-12 09:02 - 2014-01-21 08:54 - 00000000 ____D () C:\Users\Michael\AppData\Local\Google 2015-01-12 09:02 - 2014-01-21 08:54 - 00000000 ____D () C:\Program Files (x86)\Google 2015-01-12 08:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-01-12 07:54 - 2013-12-12 14:06 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{698EDE99-51AC-43A1-810F-A3339027F5D7} 2015-01-12 07:50 - 2014-04-22 16:04 - 00000348 _____ () C:\Windows\BRRBCOM.INI 2015-01-12 07:48 - 2014-03-18 14:45 - 00003360 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1810438206-4125388404-2537037518-1002 2015-01-12 07:48 - 2014-03-18 14:45 - 00003308 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1810438206-4125388404-2537037518-1002 2015-01-11 14:56 - 2014-05-24 08:01 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\uTorrent 2015-01-08 12:16 - 2014-10-20 09:44 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk 2015-01-08 12:16 - 2014-10-20 09:44 - 00000000 ____D () C:\ProgramData\Skype 2015-01-08 12:16 - 2014-10-20 09:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-01-08 08:16 - 2014-08-13 19:34 - 00077512 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwtp.sys 2015-01-08 08:16 - 2014-07-25 13:13 - 00068616 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwfp.sys 2015-01-08 08:13 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP 2015-01-08 08:13 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2015-01-07 22:05 - 2014-05-24 09:36 - 00000000 ____D () C:\Users\Michael\Desktop\Alte Firefox-Daten 2015-01-07 21:55 - 2013-12-12 15:06 - 00083456 ___SH () C:\Users\Michael\Downloads\Thumbs.db 2015-01-07 18:13 - 2014-07-21 14:21 - 00199680 ___SH () C:\Users\Michael\Desktop\Thumbs.db 2015-01-07 17:47 - 2013-12-14 20:11 - 00000000 ____D () C:\Users\Michael\AppData\Local\CrashDumps 2015-01-07 17:47 - 2013-12-12 14:55 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\TS3Client 2015-01-06 19:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2015-01-06 19:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2015-01-05 21:21 - 2014-10-20 09:44 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Skype 2015-01-05 10:38 - 2014-01-03 13:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2015-01-05 10:38 - 2014-01-03 13:11 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-31 12:14 - 2013-12-14 16:19 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-12-28 11:08 - 2014-05-17 22:01 - 00281032 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr 2014-12-28 11:08 - 2013-12-13 12:41 - 00281032 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2014-12-26 11:09 - 2013-12-13 12:41 - 00280792 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0 2014-12-26 10:05 - 2014-02-11 14:18 - 00000000 ____D () C:\Users\Michael\Desktop\Gaming 2014-12-21 15:17 - 2013-12-13 12:41 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-21 13:58 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-15 10:09 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-12-15 08:38 - 2014-05-17 18:25 - 00000000 ____D () C:\Users\Michael\AppData\Local\Apple Computer 2014-12-15 08:32 - 2014-05-17 18:25 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Apple Computer 2014-12-15 08:32 - 2014-05-17 18:24 - 00000000 ____D () C:\Users\Michael\AppData\Local\Apple 2014-12-15 08:32 - 2013-12-12 14:01 - 00000000 ____D () C:\Users\Michael 2014-12-15 08:28 - 2014-05-17 18:24 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-12-15 08:27 - 2014-06-06 12:05 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-12-14 22:06 - 2014-08-03 15:08 - 00000000 ____D () C:\Users\Michael\AppData\Local\Adobe 2014-12-14 22:06 - 2013-12-12 15:34 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater Some content of TEMP: ==================== C:\Users\Michael\AppData\Local\Temp\99648137-C26F-E6FB-3819-EB158432D633.dll C:\Users\Michael\AppData\Local\Temp\99648137-C26F-E6FB-3819-EB158432D633.exe C:\Users\Michael\AppData\Local\Temp\A8B293B6-0520-1E1E-C444-05C89AD3F685.exe C:\Users\Michael\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-08 18:09 ==================== End Of Log ============================ |
| Themen zu BlockandSurf Reste nicht auffindbar |
| block and surf, bonjour, browser, defender, desktop, firefox, flash player, google, iexplore.exe, installation, internet, internet explorer, kaspersky, kis, launch, mozilla, realtek, registry, rundll, scan, security, software, svchost.exe, trojaner, virus, werbung, windows, windowsapps |
Baum-Darstellung