| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
15.01.2015, 16:53
| #16 |
 |  Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L?FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2015
Ran by ***** (administrator) on +++++ on 15-01-2015 16:48:37
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\AMCore\mcshield.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McUICnt.exe
(Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
() C:\Program Files\MaxUp Video Downloader\maxup.exe
(EasyBits Software AS) C:\ProgramData\GameXN\GameXNGO.exe
(Microsoft Corporation) C:\Windows\System32\cmmon32.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Microsoft Corporation) C:\Windows\System32\reg.exe
(Microsoft Corporation) C:\Windows\System32\grpconv.exe
(Microsoft Corporation) C:\Windows\System32\bootcfg.exe
(Microsoft Corporation) C:\Windows\System32\WPDShextAutoplay.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\CSP\1.3.336.0\McCSPServiceHost.exe
(Ipswitch) C:\Program Files\WS_FTP Pro\WsftpCOMHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [417792 2009-11-10] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [141608 2010-02-15] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [514832 2014-10-06] (McAfee, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [499352 2014-09-17] (McAfee, Inc.)
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [110348472 2015-01-14] (Microsoft Corporation)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [MaxUp Video Downloader] => C:\Program Files\MaxUp Video Downloader\maxup.exe [30720 2010-02-11] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Google Update] => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-25] (Google Inc.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [GameXN GO] => C:\ProgramData\GameXN\GameXNGO.exe [347008 2012-02-25] (EasyBits Software AS)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mortgage-plant] => C:\Users\PAULUS~1\AppData\Local\Temp\Mortgagerealize\mortgage-strip.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [ear-according] => C:\Users\*****\AppData\Local\Temp\Earabuse\earprovide.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\MountPoints2: {e9c492e8-c7fe-11e1-b6ec-002421af38dd} - F:\LaunchU3.exe -a
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-03-20] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000 -> {3A28514C-0D87-4C90-A786-E1FE060B9784} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE0D20140325&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
DPF: {142DC14B-63E4-453E-8B4B-AE36A52BF049} hxxp://appdown.naver.com/naver/sports/Cabs/NLiveCastX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\5hgb4j72.default
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Homepage: hxxp://www.******.de
FF Keyword.URL: https://de.search.yahoo.com/search?fr=mcafee&type=B111DE0D20140325&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\*****\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @talk.google.com/O1DPlugin -> C:\Users\*****\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @tools.google.com/Google Update;version=3 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @tools.google.com/Google Update;version=9 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF Extension: Skype extension - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-12-10]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2014-03-25]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-03-25]
FF HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2014-12-18]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [131136 2014-12-03] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [529216 2014-10-06] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\Mcafee\ActWiz\McAWFwk.exe [287728 2013-04-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [338160 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471560 2014-12-03] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [661088 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [171368 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [179608 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62840 2014-10-01] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [135880 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [238312 2014-10-01] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [67824 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [371712 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [575992 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [352360 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81304 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [217232 2014-10-01] (McAfee, Inc.)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [40448 2009-08-28] (Apple, Inc.) [File not signed]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-15 16:48 - 2015-01-15 16:49 - 00018531 _____ () C:\Users\*****\Desktop\FRST.txt
2015-01-15 16:01 - 2015-01-15 16:04 - 00007250 _____ () C:\Users\*****\Desktop\Neues Textdokument (2).txt
2015-01-15 14:57 - 2015-01-15 14:57 - 01116672 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2015-01-15 10:50 - 2015-01-15 10:50 - 00000000 ___HD () C:\Users\*****\AppData\Local\Mountainproposed
2015-01-14 23:44 - 2015-01-15 16:46 - 00000000 ____D () C:\Users\*****\Desktop\alte ERgebnisse
2015-01-14 23:20 - 2015-01-14 23:40 - 00000705 _____ () C:\Users\*****\Desktop\JRT.txt
2015-01-14 23:18 - 2015-01-14 23:18 - 00000000 ____D () C:\Windows\ERUNT
2015-01-14 23:17 - 2015-01-14 23:17 - 01707939 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2015-01-14 23:00 - 2015-01-14 23:07 - 00000000 ____D () C:\AdwCleaner
2015-01-14 22:59 - 2015-01-14 22:59 - 02191360 _____ () C:\Users\*****\Desktop\AdwCleaner_4.107.exe
2015-01-14 17:04 - 2015-01-14 22:51 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-14 17:04 - 2015-01-14 20:47 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-14 17:04 - 2015-01-14 17:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-14 17:01 - 2015-01-14 20:46 - 00079576 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-14 17:00 - 2015-01-14 21:01 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2015-01-14 16:58 - 2015-01-14 16:59 - 16448208 _____ (Malwarebytes Corp.) C:\Users\*****\Desktop\mbar-1.08.2.1001.exe
2015-01-14 12:04 - 2015-01-14 16:47 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2015-01-14 12:03 - 2015-01-14 12:03 - 00000000 ____D () C:\3172b0be09dd49095d85
2015-01-14 09:27 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:27 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:27 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-14 09:27 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 09:27 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:27 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 16:26 - 2015-01-13 16:49 - 00000236 _____ () C:\Users\*****\Desktop\defogger_disable.txt
2015-01-13 15:56 - 2015-01-13 15:56 - 00152400 _____ () C:\Windows\Minidump\011315-24242-01.dmp
2015-01-13 15:38 - 2015-01-13 15:38 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2015-01-13 15:32 - 2015-01-15 16:48 - 00000000 ____D () C:\FRST
2015-01-13 15:20 - 2015-01-13 16:49 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2015-01-13 15:20 - 2015-01-13 15:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2015-01-13 15:18 - 2015-01-13 15:18 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2015-01-10 16:14 - 2015-01-10 16:14 - 00000000 ___HD () C:\Users\*****\AppData\Local\Price-deposit
2015-01-10 15:55 - 2015-01-10 15:55 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Mortgage_imagine
2015-01-09 09:15 - 2015-01-09 09:15 - 00000000 ___HD () C:\Users\*****\AppData\Local\Doctor-command
2015-01-09 09:06 - 2015-01-09 09:06 - 00000000 ___HD () C:\Users\*****\AppData\Local\Farmer-joke
2015-01-08 09:23 - 2015-01-08 09:28 - 00785408 _____ () C:\Users\*****\Desktop\Formular Inventur Düsseldorf 2014.xls
2015-01-08 08:40 - 2015-01-08 08:40 - 00000000 ___HD () C:\Users\*****\AppData\Local\Pin-phase
2015-01-06 10:37 - 2015-01-08 17:17 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Farmer-cook
2015-01-05 18:40 - 2015-01-05 18:40 - 00005816 _____ () C:\Users\*****\AppData\Roaming\out.bin
2015-01-05 15:18 - 2015-01-05 15:18 - 00182784 _____ () C:\Users\*****\AppData\Roaming\salmagundis.c
2015-01-02 08:17 - 2015-01-14 17:29 - 00000000 ___HD () C:\Users\*****\AppData\Local\Farmer-golf
2014-12-19 21:10 - 2014-12-23 20:56 - 00000000 ____D () C:\Users\*****\Desktop\Presentazione Düsseldorf -
2014-12-19 09:26 - 2015-01-14 17:29 - 00000000 ___HD () C:\Users\*****\AppData\Local\Doctor-shoulder
2014-12-18 11:08 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-15 16:48 - 2009-12-11 11:40 - 01722681 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 16:47 - 2009-12-11 14:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2015-01-15 16:42 - 2012-02-25 19:45 - 00000000 ____D () C:\ProgramData\GameXN
2015-01-15 16:41 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-15 16:41 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 16:41 - 2009-07-14 05:39 - 00252158 _____ () C:\Windows\setupact.log
2015-01-15 16:29 - 2010-12-12 13:09 - 00001168 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA.job
2015-01-15 16:26 - 2009-07-14 05:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 16:26 - 2009-07-14 05:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 16:18 - 2009-12-11 12:10 - 00882152 _____ () C:\Windows\PFRO.log
2015-01-15 16:07 - 2009-12-11 11:59 - 00000000 ____D () C:\Users\*****
2015-01-15 16:00 - 2012-02-25 19:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\go
2015-01-14 20:40 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-14 20:29 - 2010-12-12 13:09 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core.job
2015-01-14 17:29 - 2014-10-17 09:43 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Update
2015-01-14 12:03 - 2013-08-15 09:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:03 - 2009-12-11 12:06 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 15:56 - 2014-08-07 10:26 - 00000000 ____D () C:\Windows\Minidump
2015-01-13 15:56 - 2014-08-07 10:25 - 380116606 _____ () C:\Windows\MEMORY.DMP
2015-01-13 15:10 - 2009-12-11 12:35 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-01-12 17:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-01-10 16:35 - 2009-12-11 14:18 - 00000000 ____D () C:\Users\*****\AppData\Local\Apple Computer
2015-01-06 15:46 - 2009-12-11 11:54 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-24 10:46 - 2014-12-15 09:55 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Mortgage-explain
2014-12-22 14:50 - 2013-06-23 09:48 - 00000000 ____D () C:\Users\*****\Documents\Agnes
2014-12-20 16:55 - 2012-10-27 09:57 - 00000000 ____D () C:\Users\*****\Documents\Gabriela
2014-12-19 10:33 - 2013-02-27 13:02 - 00000000 ____D () C:\Program Files\Common Files\Mcafee
2014-12-19 10:33 - 2011-12-04 21:26 - 00000000 ____D () C:\ProgramData\McAfee
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-14 12:19
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-01-2015
Ran by ***** at 2015-01-15 16:50:10
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 6.0 Sprint (HKLM\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 10.0.45.2 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}) (Version: 2.1.7 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}) (Version: 2.6.0.32 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}) (Version: 5.1.1.4 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
d71kibj5usy (HKLM\...\{2028b740-5aa6-4f26-b77c-db4d43d458a2}.sdb) (Version: - )
Epson Easy Photo Print 2 (HKLM\...\{DEDB47A3-C988-4A43-A645-E2CEA571E680}) (Version: 2.0.0.0 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
EPSON Stylus Office BX300F_TX300F Handbuch (HKLM\...\EPSON Stylus Office BX300F_TX300F Benutzerhandbuch) (Version: - )
GameXN GO (HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Game Organizer) (Version: - GameXN AS)
Garmin City Navigator Europe NT 2010.31 Update (HKLM\...\{D22F5242-773E-4270-AB1F-492021BCABBE}) (Version: 13.31.0.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin (HKLM\...\{15F4085A-BC98-4590-AFFD-03BBBE49524E}) (Version: 2.9.1 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
Google Talk Plugin (HKLM\...\{0C5C1177-94C5-3EFB-A8BE-3F6AF1AF887F}) (Version: 5.38.6.0 - Google)
Ipswitch WS_FTP 12 (HKLM\...\{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}) (Version: 12.4 - Ipswitch)
Ipswitch WS_FTP Pro Uninstall (HKLM\...\WS_FTPPro) (Version: - )
iTunes (HKLM\...\{81063354-9060-42B2-A000-1EBE96778AA9}) (Version: 9.0.3.15 - Apple Inc.)
Java(TM) 6 Update 29 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
MaxUp Video Downloader 1.0 (HKLM\...\MaxUp Video Downloader_is1) (Version: - )
McAfee Internet Security (HKLM\...\MSC) (Version: 13.6.1492 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.156 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Nero 7 Essentials (HKLM\...\{F17F7703-1E72-40C1-A0DD-E5B365661031}) (Version: 7.02.0794 - Nero AG)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
oryvs1aqn (HKLM\...\{9d31bfce-bd21-4218-bb95-90d535e179ad}.sdb) (Version: - )
Pacchetto di compatibilità per Office System 2007 (HKLM\...\{90120000-0020-0410-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
pkauey3tjte (HKLM\...\{668f6d88-11ad-439a-8277-66a1790133df}.sdb) (Version: - )
QuickTime (HKLM\...\{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}) (Version: 7.65.17.80 - Apple Inc.)
Shared C Run-time for x86 (Version: 10.0.0 - McAfee) Hidden
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
TeamViewer 8 (HKLM\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)
Voipwise (HKLM\...\Voipwise_is1) (Version: 4.04 build 550 - Finarea S.A. Switzerland)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.99\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.57\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.69\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.2.183.39\goopdate.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.79\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Google Talk Plugin\googletalkax.dll (Google)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.149\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Google Talk Plugin\o1dax.dll (Google)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.65\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
==================== Restore Points =========================
14-08-2014 15:45:31 Windows Update
15-08-2014 02:00:59 Windows Update
15-08-2014 06:39:58 Windows Update
15-08-2014 08:56:54 Windows Update
15-08-2014 15:46:44 Windows Update
15-08-2014 18:52:37 Windows Update
16-08-2014 15:21:32 Windows Update
16-08-2014 17:29:54 Windows Update
24-08-2014 14:29:40 Windows Update
24-08-2014 16:58:16 Windows Update
25-08-2014 19:56:20 Windows Update
26-08-2014 04:55:22 Windows Update
26-08-2014 20:07:12 Windows Update
27-08-2014 03:41:53 Windows Update
27-08-2014 11:03:58 Windows Update
27-08-2014 11:19:31 Windows Update
27-08-2014 17:48:37 Windows Update
28-08-2014 11:03:42 Windows Update
28-08-2014 12:06:41 Windows Update
28-08-2014 15:41:36 Windows Update
28-08-2014 19:15:34 Windows Update
28-08-2014 20:18:58 Windows Update
29-08-2014 08:11:48 Windows Update
29-08-2014 18:57:49 Windows Update
30-08-2014 09:36:02 Windows Update
30-08-2014 17:54:55 Windows Update
31-08-2014 09:25:08 Windows Update
31-08-2014 17:07:02 Windows Update
01-09-2014 10:50:30 Windows Update
01-09-2014 18:26:52 Windows Update
02-09-2014 18:45:20 Windows Update
03-09-2014 17:21:59 Windows Update
04-09-2014 10:50:38 Windows Update
04-09-2014 19:08:12 Windows Update
05-09-2014 10:58:22 Windows Update
05-09-2014 16:46:13 Windows Update
05-09-2014 17:28:20 Windows Update
06-09-2014 18:48:51 Windows Update
07-09-2014 05:58:34 Windows Update
07-09-2014 11:08:41 Windows Update
07-09-2014 18:05:49 Windows Update
08-09-2014 06:57:55 Windows Update
08-09-2014 07:46:53 Windows Update
08-09-2014 19:23:15 Windows Update
10-09-2014 02:00:40 Windows Update
11-09-2014 09:48:30 Windows Update
19-09-2014 18:28:52 Geplanter Prüfpunkt
24-09-2014 13:25:20 Windows Update
01-10-2014 17:52:13 Windows Update
09-10-2014 17:36:19 Geplanter Prüfpunkt
17-10-2014 10:53:55 Windows Update
28-10-2014 11:30:44 Geplanter Prüfpunkt
10-11-2014 09:42:48 Geplanter Prüfpunkt
23-11-2014 16:49:01 Windows Update
09-12-2014 12:41:10 Geplanter Prüfpunkt
11-12-2014 17:16:41 Windows Update
12-12-2014 11:19:46 Windows Update
18-12-2014 11:56:46 Windows Update
12-01-2015 17:15:48 Geplanter Prüfpunkt
13-01-2015 14:55:35 Pacchetto di compatibilità per Office System 2007 rimosso
14-01-2015 12:02:19 Windows Update
14-01-2015 17:28:35 Malwarebytes Anti-Rootkit Restore Point
14-01-2015 20:14:21 Malwarebytes Anti-Rootkit Restore Point
14-01-2015 20:37:53 Malwarebytes Anti-Rootkit Restore Point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2015-01-15 16:07 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {206CE3E2-8524-4F1C-B7FF-CDE721B58C9E} - System32\Tasks\{B442546E-03F9-4483-BC3C-58AA2C567E8A} => C:\Program Files\Skype\Phone\Skype.exe [2014-08-27] (Skype Technologies S.A.)
Task: {43404FC0-9F2A-45FE-AD73-62205FC36867} - System32\Tasks\{7146788D-B689-4C90-9E0F-54F548C2E2C3} => pcalua.exe -a "C:\Users\*****\Desktop\garmin_rmu_cneunt2010_30c.exe" -d "C:\Users\*****\Desktop"
Task: {6D19F507-D68A-44A8-8607-57C33CAA7633} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {99AE1380-A9DE-4929-ABEC-236142A35B77} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9DFC69C3-8097-41C6-B432-ED2B1334BB5C} - System32\Tasks\{EBF9F240-B55D-44CE-B449-5BF99E3F757B} => pcalua.exe -a "E:\WS_FTP Pro 6.0 GER\wsftpsup.exe" -d "E:\WS_FTP Pro 6.0 GER"
Task: {F21621DF-23FF-4F93-B32B-9B421CF7A1FE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {F5C0661C-94A5-4F91-92D3-2EA7CFEE4519} - System32\Tasks\{579295C0-AD4F-418C-A9F7-C0C85BCB4C22} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {F7BF453F-D5E8-4E5E-8ECB-C7A3E9BFC313} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-02-20 20:29 - 2012-02-20 20:29 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 20:28 - 2012-02-20 20:28 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
1999-07-23 08:08 - 1999-07-23 08:08 - 00045568 _____ () C:\Program Files\WS_FTP Pro\nsftpch.dll
2014-04-22 18:06 - 2012-10-12 15:39 - 06622288 _____ () C:\Program Files\WS_FTP Pro\res0407.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2009-07-16 15:34 - 2009-07-16 15:34 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
2010-04-11 12:45 - 2010-02-11 22:26 - 00030720 _____ () C:\Program Files\MaxUp Video Downloader\maxup.exe
2010-04-11 12:45 - 2009-11-03 13:03 - 00043008 _____ () C:\Program Files\MaxUp Video Downloader\_socket.pyd
2010-04-11 12:45 - 2009-11-03 13:03 - 00805376 _____ () C:\Program Files\MaxUp Video Downloader\_ssl.pyd
2010-04-11 12:45 - 2009-11-20 17:23 - 01169920 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtCore.pyd
2010-04-11 12:45 - 2009-10-22 19:52 - 01951744 _____ () C:\Program Files\MaxUp Video Downloader\QtCore4.dll
2010-04-11 12:45 - 2009-11-20 17:10 - 00059904 _____ () C:\Program Files\MaxUp Video Downloader\sip.pyd
2010-04-11 12:45 - 2009-11-20 17:28 - 04477952 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtGui.pyd
2010-04-11 12:45 - 2009-10-22 20:00 - 07236608 _____ () C:\Program Files\MaxUp Video Downloader\QtGui4.dll
2010-04-11 12:45 - 2009-11-20 17:29 - 00151040 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtWebKit.pyd
2010-04-11 12:45 - 2009-10-22 20:38 - 08476672 _____ () C:\Program Files\MaxUp Video Downloader\QtWebKit4.dll
2010-04-11 12:45 - 2009-10-22 20:04 - 00241664 _____ () C:\Program Files\MaxUp Video Downloader\phonon4.dll
2010-04-11 12:45 - 2009-10-22 19:53 - 00875520 _____ () C:\Program Files\MaxUp Video Downloader\QtNetwork4.dll
2010-04-11 12:45 - 2009-11-20 17:28 - 00343040 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtNetwork.pyd
2010-04-11 12:45 - 2009-11-03 12:35 - 00092160 _____ () C:\Program Files\MaxUp Video Downloader\win32api.pyd
2010-04-11 12:45 - 2009-11-03 13:04 - 00107520 _____ () C:\Program Files\MaxUp Video Downloader\pywintypes26.dll
2010-04-11 12:45 - 2009-11-03 13:04 - 00353792 _____ () C:\Program Files\MaxUp Video Downloader\pythoncom26.dll
2010-04-11 12:45 - 2009-11-03 12:43 - 00244736 _____ () C:\Program Files\MaxUp Video Downloader\win32com.shell.shell.pyd
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2950267747-3488905677-2633809525-500 - Administrator - Disabled)
Gast (S-1-5-21-2950267747-3488905677-2633809525-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2950267747-3488905677-2633809525-1005 - Limited - Enabled)
***** (S-1-5-21-2950267747-3488905677-2633809525-1000 - Administrator - Enabled) => C:\Users\*****
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/15/2015 04:46:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 04:46:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 04:03:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 04:03:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 02:55:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 02:55:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 02:46:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 02:46:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 02:35:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 14.1.2015.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2744
Startzeit: 01d030a14a85ebf6
Endzeit: 6
Anwendungspfad: C:\Users\*****\Desktop\FRST.exe
Berichts-ID:
Error: (01/15/2015 00:12:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3026
System errors:
=============
Error: (01/15/2015 04:42:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (01/15/2015 04:42:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "iPod-Dienst" wurde mit folgendem Fehler beendet:
%%-2147417831
Error: (01/15/2015 02:53:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee CSP Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/15/2015 02:53:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee CSP Service erreicht.
Error: (01/15/2015 02:50:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (01/15/2015 02:50:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "iPod-Dienst" wurde mit folgendem Fehler beendet:
%%-2147417831
Error: (01/15/2015 09:04:43 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005
Error: (01/15/2015 09:04:09 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee CSP Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/15/2015 09:04:09 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee CSP Service erreicht.
Microsoft Office Sessions:
=========================
Error: (01/15/2015 04:46:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 04:46:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 04:03:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 04:03:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 02:55:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 02:55:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 02:46:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 02:46:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 02:35:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST.exe14.1.2015.1274401d030a14a85ebf66C:\Users\*****\Desktop\FRST.exe
Error: (01/15/2015 00:12:46 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3026
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 50%
Total physical RAM: 3070.18 MB
Available physical RAM: 1524.23 MB
Total Pagefile: 6138.65 MB
Available Pagefile: 4499.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1920.06 MB
==================== Drives ================================
Drive c: (COMPAQ) (Fixed) (Total:583.49 GB) (Free:471.46 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:12.67 GB) (Free:1.79 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=583.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=12.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
15.01.2015, 20:23
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Da ist noch was
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mortgage-plant] => C:\Users\PAULUS~1\AppData\Local\Temp\Mortgagerealize\mortgage-strip.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [ear-according] => C:\Users\*****\AppData\Local\Temp\Earabuse\earprovide.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
C:\Users\*****\AppData\Local\Pin-phase
C:\Users\*****\AppData\Local\Doctor-command
C:\Users\*****\AppData\Local\Price-deposit
C:\Users\*****\AppData\Local\Mountainproposed
C:\Users\*****\AppData\Local\Farmer-joke
C:\Users\*****\AppData\Local\Doctor-command
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ |
|
15.01.2015, 20:52
| #18 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L?Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 15-01-2015
Ran by ***** at 2015-01-15 20:39:30 Run:2
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mortgage-plant] => C:\Users\PAULUS~1\AppData\Local\Temp\Mortgagerealize\mortgage-strip.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [ear-according] => C:\Users\*****\AppData\Local\Temp\Earabuse\earprovide.exe <===== ATTENTION
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe [67584 2015-01-10] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe [67584 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe [135168 2015-01-09] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe [142336 2015-01-08] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\RunOnce: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe [146432 2015-01-15] ()
C:\Users\*****\AppData\Local\Pin-phase
C:\Users\*****\AppData\Local\Doctor-command
C:\Users\*****\AppData\Local\Price-deposit
C:\Users\*****\AppData\Local\Mountainproposed
C:\Users\*****\AppData\Local\Farmer-joke
C:\Users\*****\AppData\Local\Doctor-command
EmptyTemp:
*****************
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mortgage-plant => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\pin-arrive => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ear-according => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\doctor-cable => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\price-calendar => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mountain-choose => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\Run\\farmer-raise => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\price-calendar => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\farmer-raise => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\doctor-cable => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pin-arrive => value deleted successfully.
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mountain-choose => value deleted successfully.
"C:\Users\*****\AppData\Local\Pin-phase" directory move:
Could not move "C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Pin-phase" directory. => Scheduled to move on reboot.
"C:\Users\*****\AppData\Local\Doctor-command" directory move:
Could not move "C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Doctor-command" directory. => Scheduled to move on reboot.
"C:\Users\*****\AppData\Local\Price-deposit" directory move:
Could not move "C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Price-deposit" directory. => Scheduled to move on reboot.
"C:\Users\*****\AppData\Local\Mountainproposed" directory move:
Could not move "C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Mountainproposed" directory. => Scheduled to move on reboot.
"C:\Users\*****\AppData\Local\Farmer-joke" directory move:
Could not move "C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Farmer-joke" directory. => Scheduled to move on reboot.
"C:\Users\*****\AppData\Local\Doctor-command" directory move:
Could not move "C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe" => Scheduled to move on reboot.
Could not move "C:\Users\*****\AppData\Local\Doctor-command" directory. => Scheduled to move on reboot.
EmptyTemp: => Removed 21.3 MB temporary data.
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-01-15 20:43:06)<=
C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Pin-phase => Is moved successfully.
C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Doctor-command => Is moved successfully.
C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Price-deposit => Is moved successfully.
C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Mountainproposed => Is moved successfully.
C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Farmer-joke => Is moved successfully.
C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe => Is moved successfully.
C:\Users\*****\AppData\Local\Doctor-command => Is moved successfully.
==== End of Fixlog 20:43:06 ====
|
|
15.01.2015, 21:02
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? MRT.exe ist das "Microsoft Tool zum Entfernen bösartiger Software" selbst!  Bitte neue FRST Logs posten
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
15.01.2015, 21:20
| #20 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? hm, ach so FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2015
Ran by ***** (administrator) on +++++ on 15-01-2015 21:13:30
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\CSP\1.3.336.0\McCSPServiceHost.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\Common Files\Mcafee\Platform\McUICnt.exe
(Logitech Inc.) C:\Program Files\Logitech\Logitech Vid\Vid.exe
() C:\Program Files\MaxUp Video Downloader\maxup.exe
(EasyBits Software AS) C:\ProgramData\GameXN\GameXNGO.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [417792 2009-11-10] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [141608 2010-02-15] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [514832 2014-10-06] (McAfee, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [499352 2014-09-17] (McAfee, Inc.)
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [110348472 2015-01-14] (Microsoft Corporation)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Logitech Vid] => C:\Program Files\Logitech\Logitech Vid\vid.exe [5458704 2009-07-16] (Logitech Inc.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [MaxUp Video Downloader] => C:\Program Files\MaxUp Video Downloader\maxup.exe [30720 2010-02-11] ()
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Google Update] => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-25] (Google Inc.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [GameXN GO] => C:\ProgramData\GameXN\GameXNGO.exe [347008 2012-02-25] (EasyBits Software AS)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [pin-arrive] => C:\Users\*****\AppData\Local\Pin-phase\pin-slight.exe
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [doctor-cable] => C:\Users\*****\AppData\Local\Doctor-command\doctorshow.exe
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [price-calendar] => C:\Users\*****\AppData\Local\Price-deposit\price-closet.exe
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [mountain-choose] => C:\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Run: [farmer-raise] => C:\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\MountPoints2: {e9c492e8-c7fe-11e1-b6ec-002421af38dd} - F:\LaunchU3.exe -a
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-03-20] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000 -> {3A28514C-0D87-4C90-A786-E1FE060B9784} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE0D20140325&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
DPF: {142DC14B-63E4-453E-8B4B-AE36A52BF049} hxxp://appdown.naver.com/naver/sports/Cabs/NLiveCastX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\5hgb4j72.default
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Homepage: hxxp://www.******.de
FF Keyword.URL: https://de.search.yahoo.com/search?fr=mcafee&type=B111DE0D20140325&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\*****\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @talk.google.com/O1DPlugin -> C:\Users\*****\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @tools.google.com/Google Update;version=3 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2950267747-3488905677-2633809525-1000: @tools.google.com/Google Update;version=9 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF Extension: Skype extension - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-12-10]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2014-03-25]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-03-25]
FF HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2014-12-18]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [131136 2014-12-03] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [529216 2014-10-06] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\Mcafee\ActWiz\McAWFwk.exe [287728 2013-04-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [338160 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471560 2014-12-03] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [661088 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [171368 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [179608 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [286672 2014-10-31] (McAfee, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [62840 2014-10-01] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [135880 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [238312 2014-10-01] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [67824 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [371712 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [575992 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [352360 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81304 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [217232 2014-10-01] (McAfee, Inc.)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [40448 2009-08-28] (Apple, Inc.) [File not signed]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-15 21:13 - 2015-01-15 21:14 - 00016969 _____ () C:\Users\*****\Desktop\FRST.txt
2015-01-15 20:35 - 2015-01-15 20:37 - 00002451 _____ () C:\Users\*****\Desktop\Neues Textdokument.txt
2015-01-15 16:01 - 2015-01-15 16:04 - 00007250 _____ () C:\Users\*****\Desktop\Neues Textdokument (2).txt
2015-01-15 14:57 - 2015-01-15 14:57 - 01116672 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2015-01-14 23:44 - 2015-01-15 20:38 - 00000000 ____D () C:\Users\*****\Desktop\alte ERgebnisse
2015-01-14 23:20 - 2015-01-14 23:40 - 00000705 _____ () C:\Users\*****\Desktop\JRT.txt
2015-01-14 23:18 - 2015-01-14 23:18 - 00000000 ____D () C:\Windows\ERUNT
2015-01-14 23:17 - 2015-01-14 23:17 - 01707939 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2015-01-14 23:00 - 2015-01-14 23:07 - 00000000 ____D () C:\AdwCleaner
2015-01-14 22:59 - 2015-01-14 22:59 - 02191360 _____ () C:\Users\*****\Desktop\AdwCleaner_4.107.exe
2015-01-14 17:04 - 2015-01-14 22:51 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-14 17:04 - 2015-01-14 20:47 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-14 17:04 - 2015-01-14 17:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-14 17:01 - 2015-01-14 20:46 - 00079576 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-14 17:00 - 2015-01-14 21:01 - 00000000 ____D () C:\Users\*****\Desktop\mbar
2015-01-14 16:58 - 2015-01-14 16:59 - 16448208 _____ (Malwarebytes Corp.) C:\Users\*****\Desktop\mbar-1.08.2.1001.exe
2015-01-14 12:04 - 2015-01-14 16:47 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2015-01-14 12:03 - 2015-01-14 12:03 - 00000000 ____D () C:\3172b0be09dd49095d85
2015-01-14 09:27 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:27 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:27 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-14 09:27 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 09:27 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:27 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 16:26 - 2015-01-13 16:49 - 00000236 _____ () C:\Users\*****\Desktop\defogger_disable.txt
2015-01-13 15:56 - 2015-01-13 15:56 - 00152400 _____ () C:\Windows\Minidump\011315-24242-01.dmp
2015-01-13 15:38 - 2015-01-13 15:38 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2015-01-13 15:32 - 2015-01-15 21:13 - 00000000 ____D () C:\FRST
2015-01-13 15:20 - 2015-01-13 16:49 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log
2015-01-13 15:20 - 2015-01-13 15:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2015-01-13 15:18 - 2015-01-13 15:18 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2015-01-10 15:55 - 2015-01-10 15:55 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Mortgage_imagine
2015-01-08 09:23 - 2015-01-08 09:28 - 00785408 _____ () C:\Users\*****\Desktop\Formular Inventur Düsseldorf 2014.xls
2015-01-06 10:37 - 2015-01-08 17:17 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Farmer-cook
2015-01-05 18:40 - 2015-01-05 18:40 - 00005816 _____ () C:\Users\*****\AppData\Roaming\out.bin
2015-01-05 15:18 - 2015-01-05 15:18 - 00182784 _____ () C:\Users\*****\AppData\Roaming\salmagundis.c
2015-01-02 08:17 - 2015-01-14 17:29 - 00000000 ___HD () C:\Users\*****\AppData\Local\Farmer-golf
2014-12-19 21:10 - 2014-12-23 20:56 - 00000000 ____D () C:\Users\*****\Desktop\Presentazione Düsseldorf -
2014-12-19 09:26 - 2015-01-14 17:29 - 00000000 ___HD () C:\Users\*****\AppData\Local\Doctor-shoulder
2014-12-18 11:08 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-15 21:13 - 2012-02-25 19:45 - 00000000 ____D () C:\ProgramData\GameXN
2015-01-15 21:12 - 2009-12-11 14:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2015-01-15 20:48 - 2009-07-14 05:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-15 20:48 - 2009-07-14 05:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-15 20:46 - 2009-12-11 11:40 - 01740845 _____ () C:\Windows\WindowsUpdate.log
2015-01-15 20:40 - 2009-12-11 12:10 - 00883324 _____ () C:\Windows\PFRO.log
2015-01-15 20:40 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-15 20:40 - 2009-07-14 05:39 - 00252214 _____ () C:\Windows\setupact.log
2015-01-15 20:32 - 2010-12-12 13:09 - 00001168 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA.job
2015-01-15 20:32 - 2010-12-12 13:09 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core.job
2015-01-15 16:41 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-15 16:07 - 2009-12-11 11:59 - 00000000 ____D () C:\Users\*****
2015-01-15 16:00 - 2012-02-25 19:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\go
2015-01-14 20:40 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-01-14 17:29 - 2014-10-17 09:43 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Update
2015-01-14 12:03 - 2013-08-15 09:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:03 - 2009-12-11 12:06 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 15:56 - 2014-08-07 10:26 - 00000000 ____D () C:\Windows\Minidump
2015-01-13 15:56 - 2014-08-07 10:25 - 380116606 _____ () C:\Windows\MEMORY.DMP
2015-01-13 15:10 - 2009-12-11 12:35 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-01-12 17:17 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-01-10 16:35 - 2009-12-11 14:18 - 00000000 ____D () C:\Users\*****\AppData\Local\Apple Computer
2015-01-06 15:46 - 2009-12-11 11:54 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-24 10:46 - 2014-12-15 09:55 - 00000000 ___HD () C:\Users\*****\AppData\Roaming\Mortgage-explain
2014-12-22 14:50 - 2013-06-23 09:48 - 00000000 ____D () C:\Users\*****\Documents\Agnes
2014-12-20 16:55 - 2012-10-27 09:57 - 00000000 ____D () C:\Users\*****\Documents\Gabriela
2014-12-19 10:33 - 2013-02-27 13:02 - 00000000 ____D () C:\Program Files\Common Files\Mcafee
2014-12-19 10:33 - 2011-12-04 21:26 - 00000000 ____D () C:\ProgramData\McAfee
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-14 12:19
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-01-2015
Ran by ***** at 2015-01-15 21:14:21
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 6.0 Sprint (HKLM\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 10.0.45.2 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}) (Version: 2.1.7 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}) (Version: 2.6.0.32 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}) (Version: 5.1.1.4 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
d71kibj5usy (HKLM\...\{2028b740-5aa6-4f26-b77c-db4d43d458a2}.sdb) (Version: - )
Epson Easy Photo Print 2 (HKLM\...\{DEDB47A3-C988-4A43-A645-E2CEA571E680}) (Version: 2.0.0.0 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
EPSON Stylus Office BX300F_TX300F Handbuch (HKLM\...\EPSON Stylus Office BX300F_TX300F Benutzerhandbuch) (Version: - )
GameXN GO (HKU\S-1-5-21-2950267747-3488905677-2633809525-1000\...\Game Organizer) (Version: - GameXN AS)
Garmin City Navigator Europe NT 2010.31 Update (HKLM\...\{D22F5242-773E-4270-AB1F-492021BCABBE}) (Version: 13.31.0.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin (HKLM\...\{15F4085A-BC98-4590-AFFD-03BBBE49524E}) (Version: 2.9.1 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
Google Talk Plugin (HKLM\...\{0C5C1177-94C5-3EFB-A8BE-3F6AF1AF887F}) (Version: 5.38.6.0 - Google)
Ipswitch WS_FTP 12 (HKLM\...\{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}) (Version: 12.4 - Ipswitch)
Ipswitch WS_FTP Pro Uninstall (HKLM\...\WS_FTPPro) (Version: - )
iTunes (HKLM\...\{81063354-9060-42B2-A000-1EBE96778AA9}) (Version: 9.0.3.15 - Apple Inc.)
Java(TM) 6 Update 29 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.)
Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
MaxUp Video Downloader 1.0 (HKLM\...\MaxUp Video Downloader_is1) (Version: - )
McAfee Internet Security (HKLM\...\MSC) (Version: 13.6.1492 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.156 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Nero 7 Essentials (HKLM\...\{F17F7703-1E72-40C1-A0DD-E5B365661031}) (Version: 7.02.0794 - Nero AG)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
oryvs1aqn (HKLM\...\{9d31bfce-bd21-4218-bb95-90d535e179ad}.sdb) (Version: - )
Pacchetto di compatibilità per Office System 2007 (HKLM\...\{90120000-0020-0410-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
pkauey3tjte (HKLM\...\{668f6d88-11ad-439a-8277-66a1790133df}.sdb) (Version: - )
QuickTime (HKLM\...\{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}) (Version: 7.65.17.80 - Apple Inc.)
Shared C Run-time for x86 (Version: 10.0.0 - McAfee) Hidden
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
TeamViewer 8 (HKLM\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)
Voipwise (HKLM\...\Voipwise_is1) (Version: 4.04 build 550 - Finarea S.A. Switzerland)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.99\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.57\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.69\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.2.183.39\goopdate.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.79\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Google Talk Plugin\googletalkax.dll (Google)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.149\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Google Talk Plugin\o1dax.dll (Google)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\ProgramData\GameXN\ezGameXN.dll (Easybits)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.65\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.11\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2950267747-3488905677-2633809525-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
==================== Restore Points =========================
14-08-2014 15:45:31 Windows Update
15-08-2014 02:00:59 Windows Update
15-08-2014 06:39:58 Windows Update
15-08-2014 08:56:54 Windows Update
15-08-2014 15:46:44 Windows Update
15-08-2014 18:52:37 Windows Update
16-08-2014 15:21:32 Windows Update
16-08-2014 17:29:54 Windows Update
24-08-2014 14:29:40 Windows Update
24-08-2014 16:58:16 Windows Update
25-08-2014 19:56:20 Windows Update
26-08-2014 04:55:22 Windows Update
26-08-2014 20:07:12 Windows Update
27-08-2014 03:41:53 Windows Update
27-08-2014 11:03:58 Windows Update
27-08-2014 11:19:31 Windows Update
27-08-2014 17:48:37 Windows Update
28-08-2014 11:03:42 Windows Update
28-08-2014 12:06:41 Windows Update
28-08-2014 15:41:36 Windows Update
28-08-2014 19:15:34 Windows Update
28-08-2014 20:18:58 Windows Update
29-08-2014 08:11:48 Windows Update
29-08-2014 18:57:49 Windows Update
30-08-2014 09:36:02 Windows Update
30-08-2014 17:54:55 Windows Update
31-08-2014 09:25:08 Windows Update
31-08-2014 17:07:02 Windows Update
01-09-2014 10:50:30 Windows Update
01-09-2014 18:26:52 Windows Update
02-09-2014 18:45:20 Windows Update
03-09-2014 17:21:59 Windows Update
04-09-2014 10:50:38 Windows Update
04-09-2014 19:08:12 Windows Update
05-09-2014 10:58:22 Windows Update
05-09-2014 16:46:13 Windows Update
05-09-2014 17:28:20 Windows Update
06-09-2014 18:48:51 Windows Update
07-09-2014 05:58:34 Windows Update
07-09-2014 11:08:41 Windows Update
07-09-2014 18:05:49 Windows Update
08-09-2014 06:57:55 Windows Update
08-09-2014 07:46:53 Windows Update
08-09-2014 19:23:15 Windows Update
10-09-2014 02:00:40 Windows Update
11-09-2014 09:48:30 Windows Update
19-09-2014 18:28:52 Geplanter Prüfpunkt
24-09-2014 13:25:20 Windows Update
01-10-2014 17:52:13 Windows Update
09-10-2014 17:36:19 Geplanter Prüfpunkt
17-10-2014 10:53:55 Windows Update
28-10-2014 11:30:44 Geplanter Prüfpunkt
10-11-2014 09:42:48 Geplanter Prüfpunkt
23-11-2014 16:49:01 Windows Update
09-12-2014 12:41:10 Geplanter Prüfpunkt
11-12-2014 17:16:41 Windows Update
12-12-2014 11:19:46 Windows Update
18-12-2014 11:56:46 Windows Update
12-01-2015 17:15:48 Geplanter Prüfpunkt
13-01-2015 14:55:35 Pacchetto di compatibilità per Office System 2007 rimosso
14-01-2015 12:02:19 Windows Update
14-01-2015 17:28:35 Malwarebytes Anti-Rootkit Restore Point
14-01-2015 20:14:21 Malwarebytes Anti-Rootkit Restore Point
14-01-2015 20:37:53 Malwarebytes Anti-Rootkit Restore Point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:04 - 2015-01-15 16:07 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {206CE3E2-8524-4F1C-B7FF-CDE721B58C9E} - System32\Tasks\{B442546E-03F9-4483-BC3C-58AA2C567E8A} => C:\Program Files\Skype\Phone\Skype.exe [2014-08-27] (Skype Technologies S.A.)
Task: {43404FC0-9F2A-45FE-AD73-62205FC36867} - System32\Tasks\{7146788D-B689-4C90-9E0F-54F548C2E2C3} => pcalua.exe -a "C:\Users\*****\Desktop\garmin_rmu_cneunt2010_30c.exe" -d "C:\Users\*****\Desktop"
Task: {6D19F507-D68A-44A8-8607-57C33CAA7633} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {99AE1380-A9DE-4929-ABEC-236142A35B77} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9DFC69C3-8097-41C6-B432-ED2B1334BB5C} - System32\Tasks\{EBF9F240-B55D-44CE-B449-5BF99E3F757B} => pcalua.exe -a "E:\WS_FTP Pro 6.0 GER\wsftpsup.exe" -d "E:\WS_FTP Pro 6.0 GER"
Task: {F21621DF-23FF-4F93-B32B-9B421CF7A1FE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {F5C0661C-94A5-4F91-92D3-2EA7CFEE4519} - System32\Tasks\{579295C0-AD4F-418C-A9F7-C0C85BCB4C22} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {F7BF453F-D5E8-4E5E-8ECB-C7A3E9BFC313} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000Core.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950267747-3488905677-2633809525-1000UA.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-02-20 20:29 - 2012-02-20 20:29 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 20:28 - 2012-02-20 20:28 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2009-07-16 15:34 - 2009-07-16 15:34 - 02140944 _____ () C:\Program Files\Logitech\Logitech Vid\QtCore4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 07704336 _____ () C:\Program Files\Logitech\Logitech Vid\QtGui4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00968976 _____ () C:\Program Files\Logitech\Logitech Vid\QtNetwork4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00475408 _____ () C:\Program Files\Logitech\Logitech Vid\QtOpenGL4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00363792 _____ () C:\Program Files\Logitech\Logitech Vid\QtXml4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00199952 _____ () C:\Program Files\Logitech\Logitech Vid\QtSql4.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 00027408 _____ () C:\Program Files\Logitech\Logitech Vid\SDL.dll
2009-07-16 15:35 - 2009-07-16 15:35 - 11311888 _____ () C:\Program Files\Logitech\Logitech Vid\QtWebKit4.dll
2009-07-16 15:34 - 2009-07-16 15:34 - 00291600 _____ () C:\Program Files\Logitech\Logitech Vid\phonon4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00028944 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qgif4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00035088 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qico4.dll
2009-07-16 15:36 - 2009-07-16 15:36 - 00138000 _____ () C:\Program Files\Logitech\Logitech Vid\plugins\imageformats\qjpeg4.dll
2010-04-11 12:45 - 2010-02-11 22:26 - 00030720 _____ () C:\Program Files\MaxUp Video Downloader\maxup.exe
2010-04-11 12:45 - 2009-11-03 13:03 - 00043008 _____ () C:\Program Files\MaxUp Video Downloader\_socket.pyd
2010-04-11 12:45 - 2009-11-03 13:03 - 00805376 _____ () C:\Program Files\MaxUp Video Downloader\_ssl.pyd
2010-04-11 12:45 - 2009-11-20 17:23 - 01169920 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtCore.pyd
2010-04-11 12:45 - 2009-10-22 19:52 - 01951744 _____ () C:\Program Files\MaxUp Video Downloader\QtCore4.dll
2010-04-11 12:45 - 2009-11-20 17:10 - 00059904 _____ () C:\Program Files\MaxUp Video Downloader\sip.pyd
2010-04-11 12:45 - 2009-11-20 17:28 - 04477952 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtGui.pyd
2010-04-11 12:45 - 2009-10-22 20:00 - 07236608 _____ () C:\Program Files\MaxUp Video Downloader\QtGui4.dll
2010-04-11 12:45 - 2009-11-20 17:29 - 00151040 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtWebKit.pyd
2010-04-11 12:45 - 2009-10-22 20:38 - 08476672 _____ () C:\Program Files\MaxUp Video Downloader\QtWebKit4.dll
2010-04-11 12:45 - 2009-10-22 20:04 - 00241664 _____ () C:\Program Files\MaxUp Video Downloader\phonon4.dll
2010-04-11 12:45 - 2009-10-22 19:53 - 00875520 _____ () C:\Program Files\MaxUp Video Downloader\QtNetwork4.dll
2010-04-11 12:45 - 2009-11-20 17:28 - 00343040 _____ () C:\Program Files\MaxUp Video Downloader\PyQt4.QtNetwork.pyd
2010-04-11 12:45 - 2009-11-03 12:35 - 00092160 _____ () C:\Program Files\MaxUp Video Downloader\win32api.pyd
2010-04-11 12:45 - 2009-11-03 13:04 - 00107520 _____ () C:\Program Files\MaxUp Video Downloader\pywintypes26.dll
2010-04-11 12:45 - 2009-11-03 13:04 - 00353792 _____ () C:\Program Files\MaxUp Video Downloader\pythoncom26.dll
2010-04-11 12:45 - 2009-11-03 12:43 - 00244736 _____ () C:\Program Files\MaxUp Video Downloader\win32com.shell.shell.pyd
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
2014-12-10 10:18 - 2014-12-10 10:18 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2950267747-3488905677-2633809525-500 - Administrator - Disabled)
Gast (S-1-5-21-2950267747-3488905677-2633809525-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2950267747-3488905677-2633809525-1005 - Limited - Enabled)
***** (S-1-5-21-2950267747-3488905677-2633809525-1000 - Administrator - Enabled) => C:\Users\*****
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/15/2015 09:12:50 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 09:12:50 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5117
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5117
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4119
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4119
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/15/2015 08:14:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3120
Error: (01/15/2015 08:14:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3120
System errors:
=============
Error: (01/15/2015 04:42:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (01/15/2015 04:42:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "iPod-Dienst" wurde mit folgendem Fehler beendet:
%%-2147417831
Error: (01/15/2015 02:53:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee CSP Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/15/2015 02:53:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee CSP Service erreicht.
Error: (01/15/2015 02:50:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (01/15/2015 02:50:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "iPod-Dienst" wurde mit folgendem Fehler beendet:
%%-2147417831
Error: (01/15/2015 09:04:43 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005
Error: (01/15/2015 09:04:09 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee CSP Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/15/2015 09:04:09 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst McAfee CSP Service erreicht.
Microsoft Office Sessions:
=========================
Error: (01/15/2015 09:12:50 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 09:12:50 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Epson Software\Easy Photo Print\Microsoft.VC80.MFC\MFC80.DLL
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5117
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5117
Error: (01/15/2015 08:14:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4119
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4119
Error: (01/15/2015 08:14:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/15/2015 08:14:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3120
Error: (01/15/2015 08:14:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3120
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 35%
Total physical RAM: 3070.18 MB
Available physical RAM: 1973.69 MB
Total Pagefile: 6138.65 MB
Available Pagefile: 4806.79 MB
Total Virtual: 2047.88 MB
Available Virtual: 1916.06 MB
==================== Drives ================================
Drive c: (COMPAQ) (Fixed) (Total:583.49 GB) (Free:469.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:12.67 GB) (Free:1.79 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=583.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=12.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
15.01.2015, 22:19
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Der Mist scheint immer noch dazu sein....Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ --> Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? |
|
16.01.2015, 11:56
| #22 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? hab wohl die Zeit überschritten... Ich habe die Anleitung vom 29.03.2008 zu MBAM befolgt. Als Sprache war schon Deutsch angegeben, ab schritt 4. aber auf Englisch. Dank eurer Bildanleitung scan durchgeführt. MBAM hat nichts gefunden, grün. ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=47239146a0d21744b1a3c2f226c37beb
# engine=21995
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-16 10:31:24
# local_time=2015-01-16 11:31:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='McAfee Anti-Virus and Anti-Spyware'
# compatibility_mode=5124 16777213 88 100 2395061 184214462 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 47699730 173035475 0 0
# scanned=361646
# found=98
# cleaned=0
# scan_time=9853
sh=534C6C6410721E9FE6206E0D7D9EAC341619DB37 ft=1 fh=34e1abfeb0b434b1 vn="Variante von Win32/Kryptik.CUWZ Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Doctor-command\doctorshow.exe.xBAD"
sh=C77286436007B23827FDDCF30DCCD08E6B212393 ft=1 fh=f1d15e40a6b280b4 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe.xBAD"
sh=C52E9079A3D52BDAA26D6BF905DD8916D802D3C2 ft=1 fh=2ecb6c281fa98d05 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Pin-phase\pin-slight.exe.xBAD"
sh=50F673444E6693B1F0F3E3E410EA9C530ADE331B ft=1 fh=fdf4ef8d592af440 vn="Variante von Win32/Kryptik.CUYK Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Price-deposit\price-closet.exe.xBAD"
sh=B252BBE7B64EA863E115D3BFECA6B39E3E17A18F ft=1 fh=097d18a63b1c1296 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Temp\Earabuse\earprovide.exe.xBAD"
sh=3B0B516F28DAB4E5DF32F4EFA063730DC79C73C0 ft=1 fh=25ec46b98566a176 vn="Variante von Win32/Kryptik.CNSG Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\antimalware_software.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\beneficiary_kpp.exe"
sh=D06ACB6D2CF8B2A4F9DB0BF2FBF7C6BEBD5B4116 ft=1 fh=21d07ab943c073cb vn="Variante von Win32/Kryptik.COLP Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\bluetooth.exe"
sh=D06ACB6D2CF8B2A4F9DB0BF2FBF7C6BEBD5B4116 ft=1 fh=21d07ab943c073cb vn="Variante von Win32/Kryptik.COLP Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\encoding.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\favorites.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\glass.exe"
sh=1A188BCC25D2980128CB159FBDE96699A3C81B69 ft=1 fh=f6304112cc29f982 vn="Variante von Win32/Kryptik.COCQ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\long_date.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\track.exe"
sh=D946B8CD6D28CA38D3ACCE897F07856474DED6B4 ft=1 fh=47c4bcac63278daa vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician\windows_location_provider.exe"
sh=D946B8CD6D28CA38D3ACCE897F07856474DED6B4 ft=1 fh=47c4bcac63278daa vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\bitlocker.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\ipsec.exe"
sh=DADBA16A2593C8751A46753A5500DEE26CE023DC ft=1 fh=d773637edf5346e6 vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\right_arrow.exe"
sh=D946B8CD6D28CA38D3ACCE897F07856474DED6B4 ft=1 fh=47c4bcac63278daa vn="Variante von Win32/Kryptik.CNWZ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\rolling_shutter.exe"
sh=D06ACB6D2CF8B2A4F9DB0BF2FBF7C6BEBD5B4116 ft=1 fh=21d07ab943c073cb vn="Variante von Win32/Kryptik.COLP Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\stabilization.exe"
sh=1A188BCC25D2980128CB159FBDE96699A3C81B69 ft=1 fh=f6304112cc29f982 vn="Variante von Win32/Kryptik.COCQ Trojaner" ac=I fn="C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\unavailable.exe"
sh=AEA1DC54336DDBB0952CBBAB91F335C34502D58A ft=1 fh=9f7d46fd60edff75 vn="Variante von Win32/Kryptik.CUEI Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\account_balance.exe"
sh=D95DE1DBFFC1CBCD56E29847946EF9B1D57C15A5 ft=1 fh=b437e5cea2f20990 vn="Variante von Win32/Kryptik.CTSK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\app_container.exe"
sh=7BC489B3947F42A6A4C3BAAE48E1F6244D0EDB81 ft=1 fh=5423004c929326ae vn="Variante von Win32/Kryptik.CURT Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\block.exe"
sh=EDD4CEE91D62F16EA08BF3A8B8EA2D062C1FA1B0 ft=1 fh=9c4b55fbc60dd861 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\camera.exe"
sh=7495C5EA97E6DC4EC05A8A2A9F41A0E89BF220C0 ft=1 fh=62146591d430d9fb vn="Variante von Win32/Kryptik.CUNW Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\counter.exe"
sh=75CEF67AB2050D6619B539D0EFA123A09D4DBD9C ft=1 fh=9dea98f019cc44c0 vn="Variante von Win32/Kryptik.CTUO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\discharge.exe"
sh=2CD63456472F10D7A286756CDC514316BAD2F0F6 ft=1 fh=5423004c32586239 vn="Variante von Win32/Kryptik.CURT Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\file_format.exe"
sh=F2EAD050AF34089F5BD0E8E11EFD6BE2DD019E91 ft=1 fh=b65bf3dd6bc9f4b7 vn="Variante von Win32/Kryptik.CTFI Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\general_ledger.exe"
sh=637CD2A7B112294D0263AF65F13A5F57513FE5D9 ft=1 fh=f2fb6beff5883945 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\gsm_network.exe"
sh=F45DEF343B802D2FE2003A29D2931E8AB7F6480D ft=1 fh=162fd3e6ce70e9cb vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\hard_disk.exe"
sh=2E6364031808ABD1B649B09EFD2D79813F58DD3A ft=1 fh=839400fb20a6efce vn="Variante von Win32/Kryptik.CUEI Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\in_collection.exe"
sh=75CEF67AB2050D6619B539D0EFA123A09D4DBD9C ft=1 fh=9dea98f019cc44c0 vn="Variante von Win32/Kryptik.CTUO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\low_density_lipoprotein.exe"
sh=D4E10F08416D4D211C7660C0F565823597E4D366 ft=1 fh=e262cab0bd6e442d vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\microsoft_schweiz_gmbh.exe"
sh=C374781B91ED9E83F7A614B7861BC6BFC8013FBC ft=1 fh=6e95649460775656 vn="Variante von Win32/Kryptik.CTKY Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\mobile.exe"
sh=0E962D405C5A93111E4490171B542E3B7FEB441C ft=1 fh=eb8ff4b77e6964a4 vn="Variante von Win32/Kryptik.CTDK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\phone_language.exe"
sh=D7AAF82F5549F001F4096DD279ECCEC510A86610 ft=1 fh=9c4b55fb054f7d7e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\respiratory_rate.exe"
sh=050246929725A7F6B6FFC827FE9C83F3051F5553 ft=1 fh=584acbc06d65c453 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\silent.exe"
sh=0E962D405C5A93111E4490171B542E3B7FEB441C ft=1 fh=eb8ff4b77e6964a4 vn="Variante von Win32/Kryptik.CTDK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\sms_center_number.exe"
sh=A5DC6F2C2814E286752E899997E97DBCCBA587A8 ft=1 fh=e691352e58b60b25 vn="Variante von Win32/Kryptik.CTSK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\snap_mode.exe"
sh=B748A1F266E3BC85E9AFD52282CF2454D18879CF ft=1 fh=b6c7f12322b6b6bc vn="Variante von Win32/Kryptik.CUNW Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\speed_dial.exe"
sh=D95DE1DBFFC1CBCD56E29847946EF9B1D57C15A5 ft=1 fh=b437e5cea2f20990 vn="Variante von Win32/Kryptik.CTSK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\synced_folders.exe"
sh=C374781B91ED9E83F7A614B7861BC6BFC8013FBC ft=1 fh=6e95649460775656 vn="Variante von Win32/Kryptik.CTKY Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\tap_gesture.exe"
sh=F2EAD050AF34089F5BD0E8E11EFD6BE2DD019E91 ft=1 fh=b65bf3dd6bc9f4b7 vn="Variante von Win32/Kryptik.CTFI Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\transfer.exe"
sh=050246929725A7F6B6FFC827FE9C83F3051F5553 ft=1 fh=584acbc06d65c453 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\value_added_tax.exe"
sh=8144B0C7C9080C2EBB783FDFCC5366977062E3D3 ft=1 fh=bd29844e22b15760 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\video.exe"
sh=637CD2A7B112294D0263AF65F13A5F57513FE5D9 ft=1 fh=f2fb6beff5883945 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\windows_8_single_language.exe"
sh=B748A1F266E3BC85E9AFD52282CF2454D18879CF ft=1 fh=b6c7f12322b6b6bc vn="Variante von Win32/Kryptik.CUNW Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\windows_essentials.exe"
sh=D4E10F08416D4D211C7660C0F565823597E4D366 ft=1 fh=e262cab0bd6e442d vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\windows_rt.exe"
sh=D4BE0ED435CF3A4B8DC5B503BCB9F4DE69587C2D ft=1 fh=d45b456a18d81c73 vn="Variante von Win32/Kryptik.CTSK Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj\property\wi_fi_networking.exe"
sh=C55C32F177579AF54A4A31A6CE31ED9FF8646F9B ft=1 fh=a11b3e373c438e08 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\unlock.exe"
sh=294C69FF1DD8CFEEB3F1986D747BE80AAB6F20B7 ft=1 fh=fa0491840994bf44 vn="Variante von Win32/Kryptik.CTTD Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\authorize.exe"
sh=58086C13BA00B300752F48E402B693BEF73FBBF5 ft=1 fh=391f51c399497a5d vn="Variante von Win32/Kryptik.CVJP Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\beacon.exe"
sh=3106298CC37BDC47F32BB482FB96652FB78FA8E3 ft=1 fh=d2f3b7e1c798ae76 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\capi2.exe"
sh=A04022D4F3931E0B59AD5601CDBEEE7AF0CF6A13 ft=1 fh=b30a7786a7dd3a97 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\drop_down_arrow.exe"
sh=9F6905FB8871B0B59414FF90C83E59268D8BA751 ft=1 fh=bf2339e9d4f2f696 vn="Variante von Win32/Kryptik.CUUQ Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\file_explorer.exe"
sh=DC97EAFB3D26B3DCD2C1E8CFE0BE1161D938BF33 ft=1 fh=780ba8053633df7f vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\korean_won.exe"
sh=8B0B5BB9D416596D93E283C2838DA96F9A03350F ft=1 fh=c71c0011fef5fb24 vn="Variante von Win32/Kryptik.CVCT Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\package.exe"
sh=FE6297DBD17E5F9073A012118B3F34B515546E34 ft=1 fh=7ded8fe077ea2b99 vn="Variante von Win32/Injector.BRMJ Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\refresh.exe"
sh=3106298CC37BDC47F32BB482FB96652FB78FA8E3 ft=1 fh=d2f3b7e1c798ae76 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\safety.exe"
sh=FD835A848303A6F8204CD3F712EB04C490DF0FB9 ft=1 fh=4ac14dbf3f6ff20a vn="Variante von Win32/Kryptik.CTYX Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\sources.exe"
sh=8B0B5BB9D416596D93E283C2838DA96F9A03350F ft=1 fh=c71c0011fef5fb24 vn="Variante von Win32/Kryptik.CVCT Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\swipe_gesture.exe"
sh=5286E929B42665432DA35D30117CA01671B68170 ft=1 fh=c71c0011aac9acca vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\target.exe"
sh=C83CD4ABCA3D7A0DCA8128F3C1A6F1D223F58A8C ft=1 fh=b31c627e3a9b63e7 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\windows_search.exe"
sh=DCDA5DFD8BB4594B84B40E10DA9BFE6F992D5115 ft=1 fh=a789273229fd1634 vn="Variante von Win32/Kryptik.CUVG Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj\contacts\dynamic_access_control.exe"
sh=DCDA5DFD8BB4594B84B40E10DA9BFE6F992D5115 ft=1 fh=a789273229fd1634 vn="Variante von Win32/Kryptik.CUVG Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj\contacts\pairing_request.exe"
sh=0C89C0DB570C0FC1A18423B83EBBD8FD615F5FB0 ft=1 fh=3f6db4b2027a4c64 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj\contacts\pre_boot.exe"
sh=7256D30BD64C519F14FD7EDBCFBF155341A45F7E ft=1 fh=d661a948bef3adfd vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj\contacts\security_administrator.exe"
sh=2CD63456472F10D7A286756CDC514316BAD2F0F6 ft=1 fh=5423004c32586239 vn="Variante von Win32/Kryptik.CURT Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\tty_tdd.exe"
sh=07834D4F9E82FABDD74F4E337AC9894CFB5BEE8F ft=1 fh=c4789c2abfe51385 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\achievement.exe"
sh=0C89C0DB570C0FC1A18423B83EBBD8FD615F5FB0 ft=1 fh=3f6db4b2027a4c64 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\catalog.exe"
sh=07834D4F9E82FABDD74F4E337AC9894CFB5BEE8F ft=1 fh=c4789c2abfe51385 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\flagged.exe"
sh=C55C32F177579AF54A4A31A6CE31ED9FF8646F9B ft=1 fh=a11b3e373c438e08 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Program Files\Bonjour\Bonjour.Resources\da.lproj\blood_glucose_measurement\notification.exe"
sh=9F6905FB8871B0B59414FF90C83E59268D8BA751 ft=1 fh=bf2339e9d4f2f696 vn="Variante von Win32/Kryptik.CUUQ Trojaner" ac=I fn="C:\ProgramData\GameXN\Chat\windows_calendar\emergency_profile.exe"
sh=7422A67DBF024380D2AC71EB1750382DE90D281D ft=1 fh=e8da2f4c8d23a058 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\ProgramData\GameXN\MLS\discussion\inicis.exe"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\branch_code.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\other.exe"
sh=537B5E77C27072D7F4F286DB98C229F8FBB6253E ft=1 fh=efa98ed6c8bb2828 vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\permissions.exe"
sh=FF605A9AC8054AB0F920368B8C261954CCE49081 ft=1 fh=a8c1e202931e0739 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\wi_fi.exe"
sh=A97B4E8F319E27D4B113B202BCA1D9E3CCFFFADA ft=1 fh=d7c17976677fbbcf vn="Variante von Win32/Kryptik.CUWE Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\beacon.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\heart_rate_monitor.exe"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\kit_item.exe"
sh=DF34C6830F4357F6C0205CC7421736A0C4331488 ft=1 fh=cc5b6beb1a41762d vn="Variante von Win32/Kryptik.CVDB Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\messaging.exe"
sh=DBC737F2FA8E0F6D19BBA9362986FD5BE83AF733 ft=1 fh=937b62b55c4ce067 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\music_videos.exe"
sh=E9124F1581F24A5810DF0C5F7E221C551190D332 ft=1 fh=17fef44e2c8f3582 vn="Variante von Win32/Kryptik.CUUM Trojaner" ac=I fn="C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\watch.exe"
sh=9F6905FB8871B0B59414FF90C83E59268D8BA751 ft=1 fh=bf2339e9d4f2f696 vn="Variante von Win32/Kryptik.CUUQ Trojaner" ac=I fn="C:\Users\All Users\GameXN\Chat\windows_calendar\emergency_profile.exe"
sh=7422A67DBF024380D2AC71EB1750382DE90D281D ft=1 fh=e8da2f4c8d23a058 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Users\All Users\GameXN\MLS\discussion\inicis.exe"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\branch_code.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\other.exe"
sh=537B5E77C27072D7F4F286DB98C229F8FBB6253E ft=1 fh=efa98ed6c8bb2828 vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\permissions.exe"
sh=FF605A9AC8054AB0F920368B8C261954CCE49081 ft=1 fh=a8c1e202931e0739 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\wi_fi.exe"
sh=A97B4E8F319E27D4B113B202BCA1D9E3CCFFFADA ft=1 fh=d7c17976677fbbcf vn="Variante von Win32/Kryptik.CUWE Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\beacon.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\heart_rate_monitor.exe"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\kit_item.exe"
sh=DF34C6830F4357F6C0205CC7421736A0C4331488 ft=1 fh=cc5b6beb1a41762d vn="Variante von Win32/Kryptik.CVDB Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\messaging.exe"
sh=DBC737F2FA8E0F6D19BBA9362986FD5BE83AF733 ft=1 fh=937b62b55c4ce067 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\music_videos.exe"
sh=E9124F1581F24A5810DF0C5F7E221C551190D332 ft=1 fh=17fef44e2c8f3582 vn="Variante von Win32/Kryptik.CUUM Trojaner" ac=I fn="C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\watch.exe"
sh=CA8CFF0304B871DF4AB039CE21D455344F93BB37 ft=1 fh=7cff629c7cb85300 vn="Variante von Win32/Kryptik.CQTL Trojaner" ac=I fn="C:\Users\*****\AppData\Local\Win\win.exe"
sh=B3596019AE6715F414D514979D8ED89FA091D66A ft=1 fh=f666d472bcff13d0 vn="Variante von Win32/Kryptik.CVAX Trojaner" ac=I fn="C:\Users\*****\AppData\Roaming\Mortgage_imagine\mortgage_station.exe"
|
|
16.01.2015, 12:15
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Hui....  ...was ESET denn da alles in Programmordnern legitimer Programme gefunden....Code:
ATTFilter C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question\bitlocker.exe
Wenn die Datei schon ausgewertet sein sollte, bitte eine weitere Auswertung starten.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.01.2015, 12:27
| #24 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? mit Ergebnislink meinst du das? Code:
ATTFilter hxxps://www.virustotal.com/de/file/529c55c27db20dc495e0622dd4e3b0f6ececfaaf16f97e32c49e3dd0d602a0b7/analysis/1421407411/
|
|
16.01.2015, 13:21
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ |  Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Oha tatsächlich...da hat sich die Malware breitärschig in deine Programme gesetzt Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\*****\AppData\Local\Win
C:\Users\*****\AppData\Roaming\Mortgage_imagine
C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician
C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj
C:\Program Files\Bonjour\Bonjour.Resources\da.lproj
C:\ProgramData\GameXN\Chat\windows_calendar\emergency_profile.exe
C:\ProgramData\GameXN\MLS\discussion\inicis.exe
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464
C:\Users\All Users\GameXN\Chat\windows_calendar\emergency_profile.exe
C:\Users\All Users\GameXN\MLS\discussion\inicis.exe
C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458
C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.01.2015, 14:37
| #26 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Schön, dass du sie gefunden hast. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 15-01-2015
Ran by ***** at 2015-01-16 14:33:20 Run:3
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\*****\AppData\Local\Win
C:\Users\*****\AppData\Roaming\Mortgage_imagine
C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician
C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj
C:\Program Files\Bonjour\Bonjour.Resources\da.lproj
C:\ProgramData\GameXN\Chat\windows_calendar\emergency_profile.exe
C:\ProgramData\GameXN\MLS\discussion\inicis.exe
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464
C:\Users\All Users\GameXN\Chat\windows_calendar\emergency_profile.exe
C:\Users\All Users\GameXN\MLS\discussion\inicis.exe
C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458
C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464
*****************
C:\Users\*****\AppData\Local\Win => Moved successfully.
C:\Users\*****\AppData\Roaming\Mortgage_imagine => Moved successfully.
C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\referring_physician => Moved successfully.
C:\Program Files\Adobe\Reader 11.0\Reader\Browser\question => Moved successfully.
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\da.lproj => Moved successfully.
C:\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj => Moved successfully.
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\es.lproj => Moved successfully.
C:\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj => Moved successfully.
C:\Program Files\Bonjour\Bonjour.Resources\da.lproj => Moved successfully.
C:\ProgramData\GameXN\Chat\windows_calendar\emergency_profile.exe => Moved successfully.
C:\ProgramData\GameXN\MLS\discussion\inicis.exe => Moved successfully.
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458 => Moved successfully.
C:\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464 => Moved successfully.
"C:\Users\All Users\GameXN\Chat\windows_calendar\emergency_profile.exe" => File/Directory not found.
"C:\Users\All Users\GameXN\MLS\discussion\inicis.exe" => File/Directory not found.
"C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458" => File/Directory not found.
"C:\Users\All Users\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464" => File/Directory not found.
==== End of Fixlog 14:33:22 ====
|
|
17.01.2015, 16:49
| #27 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Bitte neue Kontrollscans mit MBAM und ESET
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.01.2015, 18:00
| #28 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? MBAM grün. ESET nun nur noch die Hälfte  Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=47239146a0d21744b1a3c2f226c37beb
# engine=22025
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-18 04:48:04
# local_time=2015-01-18 05:48:04 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='McAfee Anti-Virus and Anti-Spyware'
# compatibility_mode=5124 16777214 88 100 2594060 184409861 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 47895129 173230874 0 0
# scanned=363794
# found=39
# cleaned=0
# scan_time=7911
sh=294C69FF1DD8CFEEB3F1986D747BE80AAB6F20B7 ft=1 fh=fa0491840994bf44 vn="Variante von Win32/Kryptik.CTTD Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\authorize.exe"
sh=58086C13BA00B300752F48E402B693BEF73FBBF5 ft=1 fh=391f51c399497a5d vn="Variante von Win32/Kryptik.CVJP Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\beacon.exe"
sh=3106298CC37BDC47F32BB482FB96652FB78FA8E3 ft=1 fh=d2f3b7e1c798ae76 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\capi2.exe"
sh=A04022D4F3931E0B59AD5601CDBEEE7AF0CF6A13 ft=1 fh=b30a7786a7dd3a97 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\drop_down_arrow.exe"
sh=9F6905FB8871B0B59414FF90C83E59268D8BA751 ft=1 fh=bf2339e9d4f2f696 vn="Variante von Win32/Kryptik.CUUQ Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\file_explorer.exe"
sh=DC97EAFB3D26B3DCD2C1E8CFE0BE1161D938BF33 ft=1 fh=780ba8053633df7f vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\korean_won.exe"
sh=30EC58AB0092D46A283299851115FFF48EF47B04 ft=1 fh=a29541424edb5d73 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\live_mesh.exe"
sh=8B0B5BB9D416596D93E283C2838DA96F9A03350F ft=1 fh=c71c0011fef5fb24 vn="Variante von Win32/Kryptik.CVCT Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\package.exe"
sh=FE6297DBD17E5F9073A012118B3F34B515546E34 ft=1 fh=7ded8fe077ea2b99 vn="Variante von Win32/Injector.BRMJ Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\refresh.exe"
sh=3106298CC37BDC47F32BB482FB96652FB78FA8E3 ft=1 fh=d2f3b7e1c798ae76 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\safety.exe"
sh=FD835A848303A6F8204CD3F712EB04C490DF0FB9 ft=1 fh=4ac14dbf3f6ff20a vn="Variante von Win32/Kryptik.CTYX Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\sources.exe"
sh=8B0B5BB9D416596D93E283C2838DA96F9A03350F ft=1 fh=c71c0011fef5fb24 vn="Variante von Win32/Kryptik.CVCT Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\swipe_gesture.exe"
sh=5286E929B42665432DA35D30117CA01671B68170 ft=1 fh=c71c0011aac9acca vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\target.exe"
sh=C83CD4ABCA3D7A0DCA8128F3C1A6F1D223F58A8C ft=1 fh=b31c627e3a9b63e7 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdate.Resources\en.lproj\asn_1\table\windows_search.exe"
sh=07834D4F9E82FABDD74F4E337AC9894CFB5BEE8F ft=1 fh=c4789c2abfe51385 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\achievement.exe"
sh=0C89C0DB570C0FC1A18423B83EBBD8FD615F5FB0 ft=1 fh=3f6db4b2027a4c64 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\catalog.exe"
sh=07834D4F9E82FABDD74F4E337AC9894CFB5BEE8F ft=1 fh=c4789c2abfe51385 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\Program Files\Apple Software Update\SoftwareUpdateFiles.Resources\sv.lproj\upload\device_channels\flagged.exe"
sh=9F6905FB8871B0B59414FF90C83E59268D8BA751 ft=1 fh=bf2339e9d4f2f696 vn="Variante von Win32/Kryptik.CUUQ Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GameXN\Chat\windows_calendar\emergency_profile.exe.xBAD"
sh=7422A67DBF024380D2AC71EB1750382DE90D281D ft=1 fh=e8da2f4c8d23a058 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GameXN\MLS\discussion\inicis.exe.xBAD"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\branch_code.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\other.exe"
sh=537B5E77C27072D7F4F286DB98C229F8FBB6253E ft=1 fh=efa98ed6c8bb2828 vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\permissions.exe"
sh=FF605A9AC8054AB0F920368B8C261954CCE49081 ft=1 fh=a8c1e202931e0739 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330458\antispyware_software\wi_fi.exe"
sh=A97B4E8F319E27D4B113B202BCA1D9E3CCFFFADA ft=1 fh=d7c17976677fbbcf vn="Variante von Win32/Kryptik.CUWE Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\beacon.exe"
sh=8CB5FACA7A374EA49F1F147673FD82EA02D1D757 ft=1 fh=902b22b0cb49280e vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\heart_rate_monitor.exe"
sh=EAEE91C9ED39069B33B55DB5670F5E5F1C5B5B64 ft=1 fh=63bc4243cc823c7d vn="Variante von Win32/Kryptik.CVIV Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\kit_item.exe"
sh=DF34C6830F4357F6C0205CC7421736A0C4331488 ft=1 fh=cc5b6beb1a41762d vn="Variante von Win32/Kryptik.CVDB Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\messaging.exe"
sh=DBC737F2FA8E0F6D19BBA9362986FD5BE83AF733 ft=1 fh=937b62b55c4ce067 vn="Win32/TrojanDownloader.Nymaim.AL Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\music_videos.exe"
sh=E9124F1581F24A5810DF0C5F7E221C551190D332 ft=1 fh=17fef44e2c8f3582 vn="Variante von Win32/Kryptik.CUUM Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\GARMIN\Maps\City Navigator Europe NT 2010.30.gmap\Product1\00330464\connection_manager\watch.exe"
sh=534C6C6410721E9FE6206E0D7D9EAC341619DB37 ft=1 fh=34e1abfeb0b434b1 vn="Variante von Win32/Kryptik.CUWZ Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Doctor-command\doctorshow.exe.xBAD"
sh=C77286436007B23827FDDCF30DCCD08E6B212393 ft=1 fh=f1d15e40a6b280b4 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Farmer-joke\farmer-manage.exe.xBAD"
sh=44656ADE6F82A3C58A847013274EDB0134622CB3 ft=1 fh=c32abebcdbb6c20e vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Mountainproposed\mountain-record.exe.xBAD"
sh=C52E9079A3D52BDAA26D6BF905DD8916D802D3C2 ft=1 fh=2ecb6c281fa98d05 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Pin-phase\pin-slight.exe.xBAD"
sh=50F673444E6693B1F0F3E3E410EA9C530ADE331B ft=1 fh=fdf4ef8d592af440 vn="Variante von Win32/Kryptik.CUYK Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Price-deposit\price-closet.exe.xBAD"
sh=B252BBE7B64EA863E115D3BFECA6B39E3E17A18F ft=1 fh=097d18a63b1c1296 vn="Win32/Trustezeb.K Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Temp\Earabuse\earprovide.exe.xBAD"
sh=CA8CFF0304B871DF4AB039CE21D455344F93BB37 ft=1 fh=7cff629c7cb85300 vn="Variante von Win32/Kryptik.CQTL Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Local\Win\win.exe"
sh=B3596019AE6715F414D514979D8ED89FA091D66A ft=1 fh=f666d472bcff13d0 vn="Variante von Win32/Kryptik.CVAX Trojaner" ac=I fn="C:\FRST\Quarantine\C\Users\*****\AppData\Roaming\Mortgage_imagine\mortgage_station.exe"
sh=30EC58AB0092D46A283299851115FFF48EF47B04 ft=1 fh=a29541424edb5d73 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\ProgramData\GameXN\Chat\windows_calendar\shuffle_all.exe"
sh=30EC58AB0092D46A283299851115FFF48EF47B04 ft=1 fh=a29541424edb5d73 vn="Win32/TrojanDownloader.Nymaim.AO Trojaner" ac=I fn="C:\Users\All Users\GameXN\Chat\windows_calendar\shuffle_all.exe"
|
|
18.01.2015, 20:59
| #29 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\GameXN
C:\Users\All Users\GameXN
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.01.2015, 21:29
| #30 |
| | Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L?Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-01-2015 01
Ran by ***** at 2015-01-18 21:17:05 Run:4
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** (Available profiles: *****)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\ProgramData\GameXN
C:\Users\All Users\GameXN
EmptyTemp:
Hosts:
*****************
"C:\ProgramData\GameXN" directory move:
C:\ProgramData\GameXN\ezGameXN.dll => Moved successfully.
C:\ProgramData\GameXN\ezShell64Run.exe => Moved successfully.
C:\ProgramData\GameXN\GameXNGO.exe => Moved successfully.
C:\ProgramData\GameXN\go.sdat => Moved successfully.
C:\ProgramData\GameXN\go.upd.sdat => Moved successfully.
C:\ProgramData\GameXN\goRel.dat => Moved successfully.
C:\ProgramData\GameXN\out.bin => Moved successfully.
C:\ProgramData\GameXN\pxml.xml => Moved successfully.
C:\ProgramData\GameXN\sc1.pub => Moved successfully.
C:\ProgramData\GameXN\ShortIDs.dat => Moved successfully.
C:\ProgramData\GameXN\swf.map => Moved successfully.
C:\ProgramData\GameXN\_bpid.dat => Moved successfully.
C:\ProgramData\GameXN\_gompu.dat => Moved successfully.
C:\ProgramData\GameXN\_gosti.dat => Moved successfully.
C:\ProgramData\GameXN\_luc.dat => Moved successfully.
C:\ProgramData\GameXN\_mu1.dat => Moved successfully.
C:\ProgramData\GameXN\_popularity.dat => Moved successfully.
C:\ProgramData\GameXN\Tabs\tabs.dat => Moved successfully.
C:\ProgramData\GameXN\Sounds\ChatMessage.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\GameReady.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\Invitation.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\LobbyStart.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\NewFriend.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\Notification.mp3 => Moved successfully.
C:\ProgramData\GameXN\Sounds\Sounds.ini => Moved successfully.
C:\ProgramData\GameXN\Sounds\splayer.swf => Moved successfully.
C:\ProgramData\GameXN\News\news.dat => Moved successfully.
C:\ProgramData\GameXN\News\premium\newsletter.xml => Moved successfully.
C:\ProgramData\GameXN\News\premium\PremiumBanner.swf => Moved successfully.
C:\ProgramData\GameXN\MLS\CompltetedLangs.dat => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ARE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_BGR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_CHS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_CHT.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_CSY.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_DAN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_DEU.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ELL.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ESN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ETI.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_FIN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_FRA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_HEB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_HUN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ITA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_JPN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_KOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_LTH.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_NLD.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_NOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_PLK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_PTB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_PTG.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_ROM.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_RUS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_SVE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOLobby_TRK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ARE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_BGR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_CHS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_CHT.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_CSY.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_DAN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_DEU.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ELL.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ESN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ETI.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_FIN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_FRA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_HEB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_HUN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ITA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_JPN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_KOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_LTH.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_NLD.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_NOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_PLK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_PTB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_PTG.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_ROM.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_RUS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_SVE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GoNet_TRK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ARE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_BGR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_CHS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_CHT.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_CSY.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_DAN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_DEU.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ELL.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ESN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ETI.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_FIN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_FRA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_HEB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_HUN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ITA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_JPN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_KOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_LTH.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_NLD.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_NOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_PLK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_PTB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_PTG.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_ROM.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_RUS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_SVE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GOV1_TRK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ARE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_BGR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_CHS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_CHT.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_CSY.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_DAN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_DEU.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ELL.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ESN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ETI.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_FIN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_FRA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_HEB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_HUN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ITA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_JPN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_KOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_LTH.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_NLD.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_NOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_PLK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_PTB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_PTG.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_ROM.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_RUS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_SVE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\GO_TRK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ARE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_BGR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_CHS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_CHT.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_CSY.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_DAN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_DEU.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ELL.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ESN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ETI.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_FIN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_FRA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_HEB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_HUN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ITA.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_JPN.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_KOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_LTH.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_NLD.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_NOR.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_PLK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_PTB.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_PTG.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_ROM.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_RUS.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_SVE.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\skypePM_TRK.mls => Moved successfully.
C:\ProgramData\GameXN\MLS\discussion\sxsvj.pam => Moved successfully.
C:\ProgramData\GameXN\Local Cache\00858AFBC4C6418397A981061E85E95C_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\00858AFBC4C6418397A981061E85E95C_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\01E408B224F44A85B5C58CEAFA619E53_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\01E408B224F44A85B5C58CEAFA619E53_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0493A0A710B44406A0AC4B1383B8D07D_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0493A0A710B44406A0AC4B1383B8D07D_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0827725D5A0C415AB3B72E8ECA712134_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0827725D5A0C415AB3B72E8ECA712134_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0C99AA2DA06E4F6BA61B15297AA0DBEF_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0C99AA2DA06E4F6BA61B15297AA0DBEF_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0DD3EA14790940ECB8BD992F24F4FF20_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\0DD3EA14790940ECB8BD992F24F4FF20_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\1451CA7AD738404FBA1572F0D15F00A8_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\1451CA7AD738404FBA1572F0D15F00A8_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\164368FE9051439A8E8FB3FE5730FC7C_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\164368FE9051439A8E8FB3FE5730FC7C_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\2E06D5039B734EE8A1244F34184BD499_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\2E06D5039B734EE8A1244F34184BD499_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\3AC42E18194147CF8DA2997C926EEC36_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\3AC42E18194147CF8DA2997C926EEC36_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\3AC42E18194147CF8DA2997C926EEC36_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4136746E049B4E648BAE5299828AAC2B_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4136746E049B4E648BAE5299828AAC2B_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4396EDB7C1A140ADA40B775FEB3C0D25_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4396EDB7C1A140ADA40B775FEB3C0D25_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\454EB22F4CF24AD0B14FBA4A4C21E879_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\454EB22F4CF24AD0B14FBA4A4C21E879_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4C89916128C54976B7A80B10F3C19137_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\4C89916128C54976B7A80B10F3C19137_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\5823ABD88F47457C9D2BF864D89C5FBC_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\5823ABD88F47457C9D2BF864D89C5FBC_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\6BD422D51C4342F2B6B8AB37C42AA17B_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\6BD422D51C4342F2B6B8AB37C42AA17B_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\72314F0D257D448BADABB1BC59272131_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\72314F0D257D448BADABB1BC59272131_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\77714F0D257D448BADABB1BC59272131_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\77714F0D257D448BADABB1BC59272131_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\78814F0D257D448BADABB1BC59272131_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\78814F0D257D448BADABB1BC59272131_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79914F0D257D448BADABB1BC59272131_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79914F0D257D448BADABB1BC59272131_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79AE9A1F56F842A7A099E5DDFD7710B3_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79AE9A1F56F842A7A099E5DDFD7710B3_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79FF86CC601045CE9675AF1363600ED9_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\79FF86CC601045CE9675AF1363600ED9_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\7FF10FD1D9E1467181402A0155363CB2_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\7FF10FD1D9E1467181402A0155363CB2_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\80FA788DB37F44C4AC03D1206073EF67_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\80FA788DB37F44C4AC03D1206073EF67_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\8CA38853EAF74A618812B5185704FA72_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\8CA38853EAF74A618812B5185704FA72_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\8F2BEA1A2B56457AA3182B880C863A52_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\8F2BEA1A2B56457AA3182B880C863A52_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\91B6FD143522487DBC07A35DE803C671_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\91B6FD143522487DBC07A35DE803C671_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\ABC0C93967AD43098E0382FD5EA9DFE1_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\ABC0C93967AD43098E0382FD5EA9DFE1_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B1F1A04AC9AD41CE8E83313BF9788957_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B1F1A04AC9AD41CE8E83313BF9788957_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B5362B0B24E14E6B8A330041B208FF78_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B5362B0B24E14E6B8A330041B208FF78_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B76A8D6A7F0A4415B459E204940E45DA_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\B76A8D6A7F0A4415B459E204940E45DA_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C1CD45C3F42A43AB899F31B591A5211F_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C1CD45C3F42A43AB899F31B591A5211F_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C5094D21049946CC8CCB397AAB28817A_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C5094D21049946CC8CCB397AAB28817A_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C7D94334204347AEBB0F776ED21C7F29_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\C7D94334204347AEBB0F776ED21C7F29_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\CA2E420582B3484EA454CB5E7A1C8892_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\CA2E420582B3484EA454CB5E7A1C8892_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\CE6B3C1D64654E4B8331A1CB0ED028AD_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\CE6B3C1D64654E4B8331A1CB0ED028AD_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\D8F6378E7EE742B9A38730ECE6FA7CCA_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\D8F6378E7EE742B9A38730ECE6FA7CCA_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\DE3FAACAE2834545AADAAE424244F5D8_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\DE3FAACAE2834545AADAAE424244F5D8_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\E573AAFBCCC6425157A989000E12A77B_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\E573AAFBCCC6425157A989000E12A77B_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EB659AD2FCC647F38E82982293E1663C_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EB659AD2FCC647F38E82982293E1663C_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EC0BD23BB8FB49AB9CEA5FC8EDE66BDB_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EC0BD23BB8FB49AB9CEA5FC8EDE66BDB_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EF40E569ACCA4FA3A41083BA475C2102_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\EF40E569ACCA4FA3A41083BA475C2102_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\F48988F4365D412F9DDA68C7805772BF_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\F48988F4365D412F9DDA68C7805772BF_thumb135x80.jpg => Moved successfully.
C:\ProgramData\GameXN\Local Cache\F9C6228EE2884EB0B722ECBB9296FA74_icon16.png => Moved successfully.
C:\ProgramData\GameXN\Local Cache\F9C6228EE2884EB0B722ECBB9296FA74_thumb.swf => Moved successfully.
C:\ProgramData\GameXN\Local Cache\~Please do not delete files from this folder => Moved successfully.
C:\ProgramData\GameXN\HTML\named_strings.mlsxml => Moved successfully.
C:\ProgramData\GameXN\HTML\organizer2.swf => Moved successfully.
C:\ProgramData\GameXN\HTML\organizer3.swf => Moved successfully.
C:\ProgramData\GameXN\HTML\organizer4.swf => Moved successfully.
C:\ProgramData\GameXN\HTML\uswk\ufci.uku => Moved successfully.
C:\ProgramData\GameXN\HTML\startup\bg.jpg => Moved successfully.
C:\ProgramData\GameXN\HTML\startup\default.htm => Moved successfully.
C:\ProgramData\GameXN\HTML\startup\default_mls.htm => Moved successfully.
C:\ProgramData\GameXN\HTML\mls\GameOrganizer.xml => Moved successfully.
C:\ProgramData\GameXN\GUP\UL\DefLog.ezlog => Moved successfully.
C:\ProgramData\GameXN\gost\recent.dat => Moved successfully.
C:\ProgramData\GameXN\Games\bg.gif => Moved successfully.
C:\ProgramData\GameXN\Games\CommonGamesStrings_MLS.xml => Moved successfully.
C:\ProgramData\GameXN\Games\game.htm => Moved successfully.
C:\ProgramData\GameXN\Chat\chat.htm => Moved successfully.
C:\ProgramData\GameXN\Chat\chat.swf => Moved successfully.
C:\ProgramData\GameXN\Chat\chat_MLS.xml => Moved successfully.
C:\ProgramData\GameXN\Chat\xnChat_MLS.xml => Moved successfully.
C:\ProgramData\GameXN\Chat\windows_calendar\aqbsa.cmy => Moved successfully.
C:\ProgramData\GameXN\Chat\windows_calendar\fhg.dky => Moved successfully.
C:\ProgramData\GameXN\Chat\windows_calendar\shuffle_all.exe => Moved successfully.
Could not move "C:\ProgramData\GameXN" directory. => Scheduled to move on reboot.
"C:\Users\All Users\GameXN" directory move:
Could not move "C:\Users\All Users\GameXN" directory. => Scheduled to move on reboot.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 102.5 MB temporary data.
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-01-18 21:21:03)<=
C:\ProgramData\GameXN => Is moved successfully.
C:\Users\All Users\GameXN => Is moved successfully.
==== End of Fixlog 21:21:03 ====
|
|
| Themen zu Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L? |
| avira, bonjour, browser, downloader, ebanking, email, entfernen, euro, firefox, flash player, google, home, homepage, iexplore.exe, langsam, mozilla, profiler.gen.ac, registry, required, rundll, scan, security, siteadvisor, software, svchost.exe, system, trojaner, win 32/matsnu.l, windows |
Linear-Darstellung
