| |
| |||||||
Log-Analyse und Auswertung: Sicherheitswarnung zu meinem Internetzugang durch die TelekomWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
16.01.2015, 08:30
| #1 |
 |  Sicherheitswarnung zu meinem Internetzugang durch die Telekom Hallo, habe Post von der Telekom bekommen, das ein Virus oder Trojaner auf mein Laptops Laptop ist. Habe leider keine Erfahrungen mit sowas. Über meinen Anschluss gehen 3 Laptops zwei Tablet und ein Handy ins Internet. Ich habe nun die Schritte auf meinem Laptop durchgeführt, die anderen kommen dann danach denke, es wird wohl besser sein einer nach dem andern zumachen. Vielen Dank im Vorraus für ihre Gedult mit mir. Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2015 01
Ran by Anja xxx at 2015-01-16 06:25:51
Running from C:\Users\Anja xxx\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4260 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.238 - AVG Technologies)
AVG PC TuneUp 2015 (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
Bad Piggies (HKLM-x32\...\{32941438-AD79-4EF4-B7E4-86039E41B4D3}) (Version: 1.0.0 - Rovio)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Firefox Packages (HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\Firefox Packages) (Version: - ) <==== ATTENTION
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
HP Deskjet 1510 series - Grundlegende Software für das Gerät (HKLM\...\{FD79E5D2-5CFE-49C2-9461-D011D1355696}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.16432 - HP)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3309 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7040 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.16.201411190934 - Sony Mobile Communications Inc.)
Sony PC Companion 2.10.236 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.236 - Sony)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.18.9.4384 - Enigma Software Group, LLC)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
Unity Web Player (HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
21-12-2014 21:31:37 Removed Microsoft Silverlight
13-01-2015 12:59:49 Geplanter Prüfpunkt
15-01-2015 13:39:52 Installed AVG 2015
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {13027B2D-7230-4FCD-8411-A24F4525095E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-12] (Microsoft Corporation)
Task: {2A86C589-3235-42AD-B8B9-686305881BAA} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-10-07] (Oracle Corporation)
Task: {41544D9A-0D21-43B6-B7D2-03B0D0423EE4} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {48C77DD8-DE99-415D-BC0E-6BC0631341B5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-11] (AVAST Software)
Task: {4EC2D950-642A-4A7B-B353-34D4C416277E} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-01-15] (Enigma Software Group USA, LLC.)
Task: {7260B9F2-B5FB-436B-9EC8-575386B4C567} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {B1042412-B30E-4EE5-BA49-C50AA488B412} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2014-12-16] ()
Task: {E203C98C-6294-4879-809F-2FF5AAB87394} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)
Task: {FE20B1CF-34CB-420F-98FE-D75DF4DB0327} - \RealPlayer Cloud (32-bit) No Task File <==== ATTENTION
Task: {FF6B227B-3D3A-4BEB-A425-B5D3F8EDB02F} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-08-08] (Dolby Laboratories Inc.)
Task: C:\WINDOWS\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
==================== Loaded Modules (whitelisted) =============
2013-10-08 12:22 - 2013-06-27 09:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2014-11-24 12:48 - 2014-11-24 12:48 - 00713528 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2014-11-24 12:49 - 2014-11-24 12:49 - 00856888 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll
2013-10-08 12:22 - 2013-09-11 11:41 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-08-08 16:53 - 2013-08-08 16:53 - 00050904 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2013-10-08 12:22 - 2012-10-23 18:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-10-08 12:22 - 2013-07-18 15:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-11-26 22:47 - 2014-11-26 22:47 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll
2015-01-15 14:15 - 2015-01-15 14:15 - 02910720 _____ () C:\Program Files\AVAST Software\Avast\defs\15011500\algo.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-16 01:20 - 2015-01-16 01:20 - 02910720 _____ () C:\Program Files\AVAST Software\Avast\defs\15011502\algo.dll
2013-10-08 12:22 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-10-08 12:22 - 2009-12-18 15:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2014-12-11 21:28 - 2014-12-11 21:28 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-12-09 10:14 - 2014-12-09 10:14 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Anja xxx\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Anja xxx\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: BTDevManager => 2
MSCONFIG\Services: CyberLink PowerDVD 10 MS Monitor Service => 2
MSCONFIG\Services: CyberLink PowerDVD 10 MS Service => 2
MSCONFIG\Services: RichVideo64 => 2
MSCONFIG\Services: Sony PC Companion => 3
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "TkBellExe"
========================= Accounts: ==========================
Administrator (S-1-5-21-2968767656-935505287-1886515523-500 - Administrator - Disabled) => C:\Users\Administrator
Anja xxx (S-1-5-21-2968767656-935505287-1886515523-1001 - Administrator - Enabled) => C:\Users\Anja xxx
Gast (S-1-5-21-2968767656-935505287-1886515523-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-2968767656-935505287-1886515523-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/15/2015 08:32:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 303c
Startzeit: 01d030f94b78c568
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 400ba8bd-9ced-11e4-8299-0c54a513726f
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (01/15/2015 08:05:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 32d4
Startzeit: 01d030f51a60c878
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 6896d697-9ce9-11e4-8299-0c54a513726f
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (01/15/2015 08:04:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Bei der Aktivierung der App „Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/15/2015 08:02:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17031 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1c10
Startzeit: 01d030f51a5be5e5
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe
Berichts-ID: 111a61c9-9ce9-11e4-8299-0c54a513726f
Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (01/15/2015 07:58:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Die App „Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (01/15/2015 07:29:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Bei der Aktivierung der App „Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/15/2015 07:29:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Bei der Aktivierung der App „Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/15/2015 07:28:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Die App „Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (01/15/2015 07:27:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Die App „Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (01/15/2015 06:58:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm DiskDoctor.exe, Version 15.0.1001.238 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1460
Startzeit: 01d030eccbaabf19
Endzeit: 12
Anwendungspfad: C:\Program Files (x86)\AVG\AVG PC TuneUp\DiskDoctor.exe
Berichts-ID: 1f274b10-9ce0-11e4-8299-0c54a513726f
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
System errors:
=============
Error: (01/15/2015 08:37:54 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {D63B10C5-BB46-4990-A94F-E40B9D520160}
Error: (01/15/2015 07:58:50 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: Pinball.App
Error: (01/15/2015 07:29:16 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: Pinball.App
Error: (01/15/2015 07:27:40 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: Pinball.App
Error: (01/15/2015 01:22:54 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Windows-Tool zum Entfernen bösartiger Software für Windows 8, 8.1 und Windows Server 2012, 2012 R2 x64 Edition - Januar 2015 (KB890830)
Error: (01/14/2015 07:19:49 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {C2BFE331-6739-4270-86C9-493D9A04CD38}
Error: (01/14/2015 06:55:21 AM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca
Error: (01/14/2015 06:55:21 AM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca
Error: (01/14/2015 06:55:20 AM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa
Error: (01/11/2015 09:42:21 AM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}
Microsoft Office Sessions:
=========================
Error: (01/15/2015 08:32:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20689303c01d030f94b78c5684294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe400ba8bd-9ced-11e4-8299-0c54a513726fmicrosoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (01/15/2015 08:05:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.2068932d401d030f51a60c8784294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe6896d697-9ce9-11e4-8299-0c54a513726fmicrosoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (01/15/2015 08:04:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App-2144927141
Error: (01/15/2015 08:02:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: wwahost.exe6.3.9600.170311c1001d030f51a5be5e54294967295C:\WINDOWS\syswow64\wwahost.exe111a61c9-9ce9-11e4-8299-0c54a513726fMicrosoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5cApp
Error: (01/15/2015 07:58:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App
Error: (01/15/2015 07:29:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App-2144927142
Error: (01/15/2015 07:29:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_8wekyb3d8bbwe!Pinball.App-2144927141
Error: (01/15/2015 07:28:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App
Error: (01/15/2015 07:27:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: ANJA)
Description: Microsoft.Studios.PinballFx2_1.7.1.942_x86__8wekyb3d8bbwe+Pinball.App
Error: (01/15/2015 06:58:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: DiskDoctor.exe15.0.1001.238146001d030eccbaabf1912C:\Program Files (x86)\AVG\AVG PC TuneUp\DiskDoctor.exe1f274b10-9ce0-11e4-8299-0c54a513726f
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU N2910 @ 1.60GHz
Percentage of memory in use: 57%
Total physical RAM: 3976.19 MB
Available physical RAM: 1700.83 MB
Total Pagefile: 5112.19 MB
Available Pagefile: 1890.79 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:336.35 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.62 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01 Ran by Anja xxx (administrator) on ANJA on 16-01-2015 06:23:09 Running from C:\Users\Anja xxx\Downloads Loaded Profiles: Anja xxx (Available profiles: Anja xxx & Administrator & Gast) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe () C:\Program Files (x86)\PHotkey\POsd.exe () C:\Program Files (x86)\PHotkey\GPMTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\System32\WWAHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor) HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software) HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-12-21] (RealNetworks, Inc.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1 HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {9e3cc924-4ce3-11e3-8279-806e6f6e6963} - "E:\.\Helper\ServiceDVD.bin" -app .\ServiceDVD\browser7\application.ini HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {cc79c1d0-cdd7-11e3-8295-240a64e270fc} - "F:\Startme.exe" IFEO\photoproduct.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe" IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe" ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms} HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/ HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006 StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = SearchScopes: HKLM-x32 -> DefaultScope {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> DefaultScope {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> {CFD733B9-6D05-4D7D-805C-F7798C8E5F90} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggbc_14_47_ie&cd=2XzuyEtN2Y1L1QzutByEtD0AyCyE0EtByBtD0F0DtBtAyDtDtN0D0Tzu0StCtDyDyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEtAtDtDtC0AyD0EtGyE0FtBtBtGyE0DyEtCtG0Azyzy0AtGtD0A0F0A0B0EtA0C0ByD0Czy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyCyCtC0Bzz0CtDtGyC0ByEtCtGyE0FyDyDtGzyzyyBtAtGyDtAyCtC0EtC0BzyyByDyE0E2Q&cr=1214126725&ir= SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKU\S-1-5-21-2968767656-935505287-1886515523-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Anja xxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Extension: DownloadHelper - C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-24] Chrome: ======= CHR Profile: C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-15] CHR Extension: (Google Drive) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-15] CHR Extension: (YouTube) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-15] CHR Extension: (Google-Suche) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-15] CHR Extension: (Avast Online Security) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-15] CHR Extension: (Google Mail) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-15] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-11] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-11] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-11] (Avast Software) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.) S4 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed] S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink) S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink) R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [File not signed] R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S4 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-12-21] (RealNetworks, Inc.) S4 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] () R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2015-01-15] (Enigma Software Group USA, LLC.) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2014-11-24] (AVG Technologies) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-11] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-11] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-11] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-11] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-11] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-11] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-11] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-11] () S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [277784 2014-09-24] (AVG Technologies CZ, s.r.o.) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-15] () U0 lwtuxduo; C:\Windows\System32\drivers\tjmseccc.sys [79064 2015-01-16] (Malwarebytes Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-10-22] () R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation ) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-11] (Avast Software) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 06:24 - 2015-01-16 06:24 - 00380416 _____ () C:\Users\Anja xxx\Downloads\Gmer-19357.exe 2015-01-16 06:23 - 2015-01-16 06:24 - 00019376 _____ () C:\Users\Anja xxx\Downloads\FRST.txt 2015-01-16 06:22 - 2015-01-16 06:23 - 00000000 ____D () C:\FRST 2015-01-16 06:21 - 2015-01-16 06:21 - 02125312 _____ (Farbar) C:\Users\Anja xxx\Downloads\FRST64.exe 2015-01-16 06:20 - 2015-01-16 06:20 - 00000484 _____ () C:\Users\Anja xxx\Downloads\defogger_disable.log 2015-01-16 06:20 - 2015-01-16 06:20 - 00000000 _____ () C:\Users\Anja xxx\defogger_reenable 2015-01-16 06:18 - 2015-01-16 06:19 - 00050477 _____ () C:\Users\Anja xxx\Downloads\Defogger.exe 2015-01-16 06:11 - 2015-01-16 06:11 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\tjmseccc.sys 2015-01-16 05:48 - 2015-01-16 05:57 - 128449792 _____ (Microsoft Corporation) C:\Users\Anja xxx\Downloads\msert(1).exe 2015-01-16 05:46 - 2015-01-16 05:46 - 01048576 _____ () C:\Users\Anja xxx\Downloads\msert.exe 2015-01-16 05:37 - 2015-01-16 05:38 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-01-16 05:37 - 2015-01-16 05:37 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-16 05:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-01-16 05:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-01-16 05:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-01-16 05:34 - 2015-01-16 05:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Anja xxx\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-16 01:21 - 2015-01-16 01:21 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-00-21-00.096-AvastVBoxSVC.exe-3856.log 2015-01-16 01:19 - 2015-01-16 01:19 - 00000000 _____ () C:\WINDOWS\setuperr.log 2015-01-15 19:20 - 2015-01-15 19:20 - 00003704 _____ () C:\WINDOWS\System32\Tasks\Java Platform SE Auto Updater 2015-01-15 18:45 - 2015-01-15 18:45 - 00002245 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk 2015-01-15 18:45 - 2015-01-15 18:45 - 00002233 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk 2015-01-15 18:45 - 2015-01-15 18:45 - 00002221 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk 2015-01-15 18:45 - 2014-11-24 12:48 - 00040248 _____ (AVG Technologies) C:\WINDOWS\system32\TURegOpt.exe 2015-01-15 18:45 - 2014-11-24 12:48 - 00029496 _____ (AVG Technologies) C:\WINDOWS\system32\authuitu.dll 2015-01-15 18:45 - 2014-11-24 12:48 - 00025400 _____ (AVG Technologies) C:\WINDOWS\SysWOW64\authuitu.dll 2015-01-15 18:44 - 2015-01-15 18:44 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG 2015-01-15 18:43 - 2015-01-15 18:45 - 00000000 ____D () C:\ProgramData\AVG 2015-01-15 18:43 - 2015-01-15 18:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg 2015-01-15 18:24 - 2015-01-15 18:31 - 90844984 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_tuh_stf_all_2015_238_24c4.exe 2015-01-15 14:22 - 2015-01-15 14:22 - 00000000 _____ () C:\autoexec.bat 2015-01-15 14:21 - 2015-01-15 14:21 - 00003342 _____ () C:\WINDOWS\System32\Tasks\SpyHunter4Startup 2015-01-15 14:21 - 2015-01-15 14:21 - 00001107 _____ () C:\Users\Anja xxx\Desktop\SpyHunter.lnk 2015-01-15 14:21 - 2015-01-15 14:21 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Enigma Software Group 2015-01-15 14:20 - 2015-01-15 14:21 - 00000000 ____D () C:\sh4ldr 2015-01-15 14:17 - 2015-01-15 14:17 - 00022704 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys 2015-01-15 14:17 - 2015-01-15 14:17 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-01-15 14:15 - 2015-01-15 14:15 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Anja xxx\Downloads\SpyHunter-Installer.exe 2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Avg_Update_1014av 2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\ProgramData\Avg_Update_1014av 2015-01-15 13:43 - 2015-01-15 13:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG2015 2015-01-15 13:42 - 2015-01-15 13:42 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk 2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\TuneUp Software 2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-01-15 13:41 - 2015-01-15 18:44 - 00000000 ____D () C:\Program Files (x86)\AVG 2015-01-15 13:41 - 2015-01-15 14:18 - 00000000 ____D () C:\ProgramData\AVG2015 2015-01-15 13:41 - 2015-01-15 13:41 - 00000000 ___HD () C:\$AVG 2015-01-15 13:33 - 2015-01-16 06:00 - 00000000 ____D () C:\ProgramData\MFAData 2015-01-15 13:33 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg2015 2015-01-15 13:33 - 2015-01-15 13:33 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\MFAData 2015-01-15 13:32 - 2015-01-15 13:33 - 04578024 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_avct_stb_all_2015_5315_ppc17.exe 2015-01-14 12:55 - 2015-01-14 12:56 - 00000197 _____ () C:\WINDOWS\system32\2015-01-14-11-55-47.077-AvastVBoxSVC.exe-2468.log 2015-01-14 04:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-14 04:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-14 04:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-14 04:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-14 04:31 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2015-01-14 04:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-14 04:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-14 04:31 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-14 04:31 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-14 04:31 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-14 04:31 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-14 04:31 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2015-01-14 04:31 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2015-01-14 04:31 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2015-01-14 04:31 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-01-14 04:31 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2015-01-14 04:31 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-14 04:31 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2015-01-14 04:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-14 04:31 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-01-14 04:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll 2015-01-12 19:16 - 2015-01-12 19:16 - 00000197 _____ () C:\WINDOWS\system32\2015-01-12-18-16-11.057-AvastVBoxSVC.exe-3148.log 2015-01-02 12:00 - 2015-01-02 12:01 - 00000197 _____ () C:\WINDOWS\system32\2015-01-02-11-00-58.043-AvastVBoxSVC.exe-2848.log 2015-01-01 10:19 - 2015-01-01 10:19 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Sony 2014-12-27 10:24 - 2014-12-27 10:24 - 00000197 _____ () C:\WINDOWS\system32\2014-12-27-09-24-41.071-AvastVBoxSVC.exe-2944.log 2014-12-23 18:28 - 2015-01-07 12:44 - 00000000 ____D () C:\Users\Anja xxx\dwhelper 2014-12-23 18:27 - 2014-12-23 18:27 - 00000197 _____ () C:\WINDOWS\system32\2014-12-23-17-27-53.020-AvastVBoxSVC.exe-3032.log 2014-12-22 14:25 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-25-16.010-aswFe.exe-1316.log 2014-12-22 14:17 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-17-47.025-aswFe.exe-3408.log 2014-12-22 14:17 - 2014-12-22 14:18 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-13-17-43.087-AvastVBoxSVC.exe-3024.log 2014-12-22 09:34 - 2014-12-22 09:36 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-34-42.055-AvastVBoxSVC.exe-2044.log 2014-12-22 09:28 - 2014-12-22 09:28 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-28-00.073-AvastVBoxSVC.exe-2448.log 2014-12-22 09:20 - 2014-12-22 09:27 - 00000000 ____D () C:\Program Files\Unlocker 2014-12-22 09:20 - 2014-12-22 09:20 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker 2014-12-22 04:41 - 2014-12-22 04:41 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\MassFaces 2014-12-21 21:11 - 2014-12-21 21:13 - 00000197 _____ () C:\WINDOWS\system32\2014-12-21-20-11-59.078-AvastVBoxSVC.exe-2488.log 2014-12-21 21:07 - 2014-12-21 21:07 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll 2014-12-21 20:42 - 2014-12-21 21:04 - 00003344 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001 2014-12-21 20:42 - 2014-12-21 21:04 - 00003290 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001 2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\ProgramData\Real 2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\Program Files (x86)\Real 2014-12-21 20:39 - 2014-12-22 09:22 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Real 2014-12-21 17:42 - 2015-01-11 19:07 - 00000000 ____D () C:\Users\Anja xxx\Basteln 2014-12-19 15:01 - 2014-12-19 15:01 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-14-01-04.093-AvastVBoxSVC.exe-2476.log 2014-12-17 12:45 - 2014-12-17 12:45 - 00000197 _____ () C:\WINDOWS\system32\2014-12-17-11-45-53.068-AvastVBoxSVC.exe-2296.log 2014-12-17 06:06 - 2014-12-17 06:06 - 00153239 _____ () C:\Users\Anja xxx\Downloads\1492_quadrata_lim.zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 06:20 - 2014-11-21 06:42 - 00000000 ____D () C:\Users\Anja xxx 2015-01-16 06:11 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages 2015-01-16 06:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-01-16 05:43 - 2014-11-21 15:48 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2968767656-935505287-1886515523-1001 2015-01-16 05:29 - 2014-11-21 07:49 - 01598924 _____ () C:\WINDOWS\WindowsUpdate.log 2015-01-16 05:14 - 2014-12-16 04:35 - 00003356 _____ () C:\WINDOWS\System32\Tasks\HP Photo Creations Communicator 2015-01-16 05:14 - 2014-12-16 04:35 - 00000360 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job 2015-01-16 05:13 - 2014-11-21 07:53 - 00235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log 2015-01-16 04:53 - 2014-11-26 19:38 - 00000000 ___DO () C:\Users\Anja xxx\OneDrive 2015-01-16 02:43 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-01-16 01:19 - 2013-08-22 15:46 - 00071730 _____ () C:\WINDOWS\setupact.log 2015-01-16 01:19 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-15 20:39 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-01-15 19:17 - 2014-12-14 11:53 - 00000000 ____D () C:\WINDOWS\Minidump 2015-01-15 19:17 - 2013-10-07 08:24 - 00000000 ____D () C:\ProgramData\Temp 2015-01-15 19:17 - 2013-10-07 07:05 - 00000000 ___DC () C:\WINDOWS\Panther 2015-01-15 13:56 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-01-15 13:42 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2015-01-15 08:15 - 2014-12-16 04:38 - 00000000 ___RD () C:\Users\Anja xxx\Documents\HP Photo Creations 2015-01-15 08:15 - 2014-12-15 20:52 - 00000000 ____D () C:\ProgramData\HP Photo Creations 2015-01-14 06:12 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-01-06 01:08 - 2014-11-23 23:42 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-01-06 01:08 - 2014-11-23 23:42 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-22 11:46 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\LiveKernelReports 2014-12-22 11:21 - 2013-10-07 06:32 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2014-12-22 11:21 - 2013-10-07 06:32 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2014-12-22 11:21 - 2013-10-07 06:11 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-12-17 13:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-12-17 12:43 - 2013-08-22 15:44 - 00351240 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-12-17 10:02 - 2014-12-16 04:40 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Windows Live Some content of TEMP: ==================== C:\Users\Anja xxx\AppData\Local\Temp\obexpf.dll C:\Users\Anja xxx\AppData\Local\Temp\optprosetup.exe C:\Users\Anja xxx\AppData\Local\Temp\rnsetup0.exe C:\Users\Anja xxx\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-12 13:50 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-16 07:05:20
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000024 ST500LM000-1EJ162 rev.LVD3 465,76GB
Running: Gmer-19357(1).exe; Driver: C:\Users\ANJABR~1\AppData\Local\Temp\fgtdrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\spoolsv.exe[1544] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffb587c169a 4 bytes [7C, 58, FB, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1544] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffb587c16a2 4 bytes [7C, 58, FB, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1544] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffb587c181a 4 bytes [7C, 58, FB, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1544] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffb587c1832 4 bytes [7C, 58, FB, 7F]
.text C:\WINDOWS\system32\svchost.exe[2240] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe[3168] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe[3168] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffb587c169a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe[3168] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffb587c16a2 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe[3168] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffb587c181a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe[3168] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffb587c1832 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe[3440] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe[3440] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffb587c169a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe[3440] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffb587c16a2 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe[3440] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffb587c181a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe[3440] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffb587c1832 4 bytes [7C, 58, FB, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3680] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\svchost.exe[3784] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\wbem\unsecapp.exe[4080] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\Explorer.EXE[3132] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files\AVAST Software\Avast\ng\ngservice.exe[1824] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\taskhostex.exe[4468] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe[4516] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe[4516] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffb587c169a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe[4516] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffb587c16a2 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe[4516] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffb587c181a 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe[4516] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffb587c1832 4 bytes [7C, 58, FB, 7F]
.text C:\Program Files (x86)\PHotkey\ATouch64.exe[5004] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\SearchIndexer.exe[3632] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Windows\System32\skydrive.exe[3840] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[4764] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Windows\System32\igfxtray.exe[4276] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Windows\System32\hkcmd.exe[5144] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Windows\System32\igfxpers.exe[5380] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Windows\system32\igfxsrvc.exe[5552] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[6052] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[5360] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\wbem\unsecapp.exe[5212] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[5208] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\vssvc.exe[5368] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\System32\svchost.exe[5712] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\svchost.exe[6588] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
.text C:\WINDOWS\system32\taskeng.exe[6700] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffb5a791a10 5 bytes JMP 00007ffc4e0e1000
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [780:3952] fffff960008b8b90
Thread C:\WINDOWS\system32\svchost.exe [1940:1680] 00007ffb4b244608
Thread C:\WINDOWS\system32\svchost.exe [1940:328] 00007ffb4b211584
Thread C:\WINDOWS\system32\svchost.exe [1940:3596] 00007ffb4b181b40
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Hoffe es ist so richtig |
|
16.01.2015, 08:36
| #2 |
| /// the machine /// TB-Ausbilder    | Sicherheitswarnung zu meinem Internetzugang durch die Telekom hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
16.01.2015, 13:28
| #3 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Hi chrauber,
__________________hoffe habe alles richtig gemacht. Bitte habe mitleid mit mir , da ich wirklich null Ahnung habe . Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 x64
Ran by Anja xxx on 16.01.2015 at 12:34:51,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.01.2015 at 12:59:51,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter # AdwCleaner v4.107 - Bericht erstellt am 16/01/2015 um 12:24:48
# Aktualisiert 07/01/2015 von Xplode
# Database : 2015-01-13.2 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Anja xxx - ANJA
# Gestartet von : C:\Users\Anja xxx\Downloads\AdwCleaner_4.107.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Anja xxx\Documents\Optimizer Pro
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFD733B9-6D05-4D7D-805C-F7798C8E5F90}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0.5 (x86 de)
-\\ Google Chrome v
[C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
*************************
AdwCleaner[R0].txt - [2398 octets] - [16/01/2015 11:13:35]
AdwCleaner[S0].txt - [2139 octets] - [16/01/2015 12:24:48]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2199 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 16.01.2015 05:38:07, SYSTEM, ANJA, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, Update, 16.01.2015 05:38:07, SYSTEM, ANJA, Manual, Rootkit Database, 2014.11.18.1, 2015.1.14.1, Protection, 16.01.2015 05:38:11, SYSTEM, ANJA, Protection, Malware Protection, Starting, Protection, 16.01.2015 05:38:11, SYSTEM, ANJA, Protection, Malware Protection, Started, Protection, 16.01.2015 05:38:11, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 05:38:12, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Update, 16.01.2015 05:38:51, SYSTEM, ANJA, Manual, Malware Database, 2014.11.20.6, 2015.1.16.2, Protection, 16.01.2015 05:38:51, SYSTEM, ANJA, Protection, Refresh, Starting, Protection, 16.01.2015 05:38:51, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 05:38:51, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 05:39:10, SYSTEM, ANJA, Protection, Refresh, Success, Protection, 16.01.2015 05:39:11, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 05:39:11, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Scan, 16.01.2015 06:11:46, SYSTEM, ANJA, Manual, Start: % 1 "% 2", Dauer: % 1 min 30 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 2 Malwareerkennung, 33-Malwareerkennung, Update, 16.01.2015 06:36:15, SYSTEM, ANJA, Scheduler, Failed, Unable to access update server, Protection, 16.01.2015 06:38:42, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 06:38:43, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 06:38:43, SYSTEM, ANJA, Protection, Malware Protection, Stopping, Protection, 16.01.2015 06:40:50, SYSTEM, ANJA, Protection, Malware Protection, Stopped, Protection, 16.01.2015 06:47:49, SYSTEM, ANJA, Protection, Malware Protection, Starting, Protection, 16.01.2015 06:47:49, SYSTEM, ANJA, Protection, Malware Protection, Started, Protection, 16.01.2015 06:47:50, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 06:47:51, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Protection, 16.01.2015 06:56:49, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 06:56:50, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 06:56:50, SYSTEM, ANJA, Protection, Malware Protection, Stopping, Protection, 16.01.2015 06:56:52, SYSTEM, ANJA, Protection, Malware Protection, Stopped, Protection, 16.01.2015 07:08:08, SYSTEM, ANJA, Protection, Malware Protection, Starting, Protection, 16.01.2015 07:08:08, SYSTEM, ANJA, Protection, Malware Protection, Started, Protection, 16.01.2015 07:08:08, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 07:08:08, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Update, 16.01.2015 07:20:29, SYSTEM, ANJA, Manual, Malware Database, 2015.1.16.2, 2015.1.16.3, Protection, 16.01.2015 07:20:30, SYSTEM, ANJA, Protection, Refresh, Starting, Protection, 16.01.2015 07:20:30, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 07:20:30, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 07:20:55, SYSTEM, ANJA, Protection, Refresh, Success, Protection, 16.01.2015 07:20:55, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 07:20:55, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Scan, 16.01.2015 07:26:47, SYSTEM, ANJA, Manual, Start: % 1 "% 2", Dauer: % 1 min 6 Sekunden, Hyper-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 0-Malwareerkennung, Update, 16.01.2015 08:38:28, SYSTEM, ANJA, Scheduler, Malware Database, 2015.1.16.3, 2015.1.16.4, Protection, 16.01.2015 08:38:28, SYSTEM, ANJA, Protection, Refresh, Starting, Protection, 16.01.2015 08:38:28, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 08:38:28, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 08:39:36, SYSTEM, ANJA, Protection, Refresh, Success, Protection, 16.01.2015 08:39:36, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 08:39:37, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Protection, 16.01.2015 10:27:15, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 10:27:16, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 10:27:16, SYSTEM, ANJA, Protection, Malware Protection, Stopping, Protection, 16.01.2015 10:27:33, SYSTEM, ANJA, Protection, Malware Protection, Stopped, Update, 16.01.2015 10:28:19, SYSTEM, ANJA, Manual, Rootkit Database, 2014.11.18.1, 2015.1.14.1, Update, 16.01.2015 10:28:19, SYSTEM, ANJA, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, Protection, 16.01.2015 10:28:27, SYSTEM, ANJA, Protection, Malware Protection, Starting, Protection, 16.01.2015 10:28:27, SYSTEM, ANJA, Protection, Malware Protection, Started, Protection, 16.01.2015 10:28:27, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 10:28:28, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Update, 16.01.2015 10:29:03, SYSTEM, ANJA, Manual, Malware Database, 2014.11.20.6, 2015.1.16.4, Protection, 16.01.2015 10:29:04, SYSTEM, ANJA, Protection, Refresh, Starting, Protection, 16.01.2015 10:29:04, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 10:29:04, SYSTEM, ANJA, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 10:29:23, SYSTEM, ANJA, Protection, Refresh, Success, Protection, 16.01.2015 10:29:23, SYSTEM, ANJA, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 10:29:23, SYSTEM, ANJA, Protection, Malicious Website Protection, Started, Scan, 16.01.2015 10:53:30, SYSTEM, ANJA, Manual, Start: % 1 "% 2", Dauer: % 1 min 23 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 0-Malwareerkennung, (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.01.2015 Suchlauf-Zeit: 10:29:46 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.16.04 Rootkit Datenbank: v2015.01.14.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Anja xxx Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 411531 Verstrichene Zeit: 23 Min, 43 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01 Ran by Anja xxx (administrator) on ANJA on 16-01-2015 13:17:18 Running from C:\Users\Anja xxx\Downloads Loaded Profiles: Anja xxx (Available profiles: Anja xxx & Administrator & Gast) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe () C:\Program Files (x86)\PHotkey\Atouch64.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe () C:\Program Files (x86)\PHotkey\POsd.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe () C:\Program Files (x86)\PHotkey\GPMTray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor) HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software) HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-12-21] (RealNetworks, Inc.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1 HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {9e3cc924-4ce3-11e3-8279-806e6f6e6963} - "E:\.\Helper\ServiceDVD.bin" -app .\ServiceDVD\browser7\application.ini HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {cc79c1d0-cdd7-11e3-8295-240a64e270fc} - "F:\Startme.exe" IFEO\photoproduct.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe" IFEO\spyhunter4.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe" IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe" ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms} HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/ HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006 StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = SearchScopes: HKLM-x32 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKU\S-1-5-21-2968767656-935505287-1886515523-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Anja xxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Extension: DownloadHelper - C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-24] Chrome: ======= CHR Profile: C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-15] CHR Extension: (Google Drive) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-15] CHR Extension: (YouTube) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-15] CHR Extension: (Google-Suche) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-15] CHR Extension: (Avast Online Security) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-15] CHR Extension: (Google Mail) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-15] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-11] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-11] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-11] (Avast Software) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.) S4 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed] S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink) S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink) R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [File not signed] R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) S4 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-12-21] (RealNetworks, Inc.) S4 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] () S4 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2015-01-15] (Enigma Software Group USA, LLC.) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2014-11-24] (AVG Technologies) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-11] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-11] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-11] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-11] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-11] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-11] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-11] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-11] () S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [277784 2014-09-24] (AVG Technologies CZ, s.r.o.) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-15] () R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-16] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-10-22] () R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation ) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-11] (Avast Software) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 13:12 - 2015-01-16 13:12 - 00000751 _____ () C:\Users\Anja xxx\Desktop\JRT 1.txt 2015-01-16 12:34 - 2015-01-16 12:34 - 00000000 ____D () C:\WINDOWS\ERUNT 2015-01-16 12:32 - 2015-01-16 12:32 - 00001191 _____ () C:\Users\Anja xxx\Desktop\mbam1.txt 2015-01-16 12:31 - 2015-01-16 12:31 - 00006381 _____ () C:\Users\Anja xxx\Desktop\mbam schutz i.txt 2015-01-16 12:30 - 2015-01-16 12:30 - 00002279 _____ () C:\Users\Anja xxx\Desktop\AdwCleaner[S0] 1.txt 2015-01-16 12:28 - 2015-01-16 12:28 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-11-28-38.039-AvastVBoxSVC.exe-3904.log 2015-01-16 11:21 - 2015-01-16 11:21 - 00002762 _____ () C:\WINDOWS\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2015-01-16 11:12 - 2015-01-16 12:24 - 00000000 ____D () C:\AdwCleaner 2015-01-16 10:19 - 2015-01-16 10:24 - 00001284 _____ () C:\Users\Anja xxx\Desktop\Revo Uninstaller.lnk 2015-01-16 10:19 - 2015-01-16 10:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-16 10:16 - 2015-01-16 13:16 - 00000000 ____D () C:\Users\Anja xxx\Desktop\Neuer Ordner 2015-01-16 08:40 - 2015-01-16 08:41 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Anja xxx\Downloads\mbam-setup-2.0.4.1028(1).exe 2015-01-16 08:40 - 2015-01-16 08:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anja xxx\Downloads\revosetup95.exe 2015-01-16 08:39 - 2015-01-16 08:41 - 02191360 _____ () C:\Users\Anja xxx\Downloads\AdwCleaner_4.107.exe 2015-01-16 08:39 - 2015-01-16 08:39 - 01707939 _____ (Thisisu) C:\Users\Anja xxx\Downloads\JRT.exe 2015-01-16 07:09 - 2015-01-16 07:10 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-06-09-59.020-AvastVBoxSVC.exe-3640.log 2015-01-16 06:54 - 2015-01-16 06:55 - 00380416 _____ () C:\Users\Anja xxx\Downloads\Gmer-19357(1).exe 2015-01-16 06:49 - 2015-01-16 06:51 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-05-49-48.033-AvastVBoxSVC.exe-3440.log 2015-01-16 06:25 - 2015-01-16 06:27 - 00024280 _____ () C:\Users\Anja xxx\Downloads\Addition.txt 2015-01-16 06:24 - 2015-01-16 06:24 - 00380416 _____ () C:\Users\Anja xxx\Downloads\Gmer-19357.exe 2015-01-16 06:23 - 2015-01-16 13:17 - 00018073 _____ () C:\Users\Anja xxx\Downloads\FRST.txt 2015-01-16 06:22 - 2015-01-16 13:17 - 00000000 ____D () C:\FRST 2015-01-16 06:21 - 2015-01-16 06:21 - 02125312 _____ (Farbar) C:\Users\Anja xxx\Downloads\FRST64.exe 2015-01-16 06:20 - 2015-01-16 06:20 - 00000484 _____ () C:\Users\Anja xxx\Downloads\defogger_disable.log 2015-01-16 06:20 - 2015-01-16 06:20 - 00000000 _____ () C:\Users\Anja xxx\defogger_reenable 2015-01-16 06:18 - 2015-01-16 06:19 - 00050477 _____ () C:\Users\Anja xxx\Downloads\Defogger.exe 2015-01-16 05:48 - 2015-01-16 05:57 - 128449792 _____ (Microsoft Corporation) C:\Users\Anja xxx\Downloads\msert(1).exe 2015-01-16 05:46 - 2015-01-16 05:46 - 01048576 _____ () C:\Users\Anja xxx\Downloads\msert.exe 2015-01-16 05:37 - 2015-01-16 12:33 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-01-16 05:37 - 2015-01-16 10:27 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-16 05:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-01-16 05:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-01-16 05:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-01-16 05:34 - 2015-01-16 05:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Anja xxx\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-16 01:21 - 2015-01-16 01:21 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-00-21-00.096-AvastVBoxSVC.exe-3856.log 2015-01-16 01:19 - 2015-01-16 01:19 - 00000000 _____ () C:\WINDOWS\setuperr.log 2015-01-15 19:20 - 2015-01-15 19:20 - 00003704 _____ () C:\WINDOWS\System32\Tasks\Java Platform SE Auto Updater 2015-01-15 18:45 - 2015-01-15 18:45 - 00002245 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk 2015-01-15 18:45 - 2015-01-15 18:45 - 00002233 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk 2015-01-15 18:45 - 2015-01-15 18:45 - 00002221 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk 2015-01-15 18:45 - 2014-11-24 12:48 - 00040248 _____ (AVG Technologies) C:\WINDOWS\system32\TURegOpt.exe 2015-01-15 18:45 - 2014-11-24 12:48 - 00029496 _____ (AVG Technologies) C:\WINDOWS\system32\authuitu.dll 2015-01-15 18:45 - 2014-11-24 12:48 - 00025400 _____ (AVG Technologies) C:\WINDOWS\SysWOW64\authuitu.dll 2015-01-15 18:44 - 2015-01-15 18:44 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG 2015-01-15 18:43 - 2015-01-15 18:45 - 00000000 ____D () C:\ProgramData\AVG 2015-01-15 18:43 - 2015-01-15 18:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg 2015-01-15 18:24 - 2015-01-15 18:31 - 90844984 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_tuh_stf_all_2015_238_24c4.exe 2015-01-15 14:22 - 2015-01-15 14:22 - 00000000 _____ () C:\autoexec.bat 2015-01-15 14:21 - 2015-01-16 06:37 - 00003344 _____ () C:\WINDOWS\System32\Tasks\SpyHunter4Startup 2015-01-15 14:21 - 2015-01-15 14:21 - 00001107 _____ () C:\Users\Anja xxx\Desktop\SpyHunter.lnk 2015-01-15 14:21 - 2015-01-15 14:21 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Enigma Software Group 2015-01-15 14:20 - 2015-01-15 14:21 - 00000000 ____D () C:\sh4ldr 2015-01-15 14:17 - 2015-01-15 14:17 - 00022704 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys 2015-01-15 14:17 - 2015-01-15 14:17 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-01-15 14:15 - 2015-01-15 14:15 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Anja xxx\Downloads\SpyHunter-Installer.exe 2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Avg_Update_1014av 2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\ProgramData\Avg_Update_1014av 2015-01-15 13:43 - 2015-01-15 13:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG2015 2015-01-15 13:42 - 2015-01-15 13:42 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk 2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\TuneUp Software 2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-01-15 13:41 - 2015-01-15 18:44 - 00000000 ____D () C:\Program Files (x86)\AVG 2015-01-15 13:41 - 2015-01-15 14:18 - 00000000 ____D () C:\ProgramData\AVG2015 2015-01-15 13:41 - 2015-01-15 13:41 - 00000000 ___HD () C:\$AVG 2015-01-15 13:33 - 2015-01-16 12:00 - 00000000 ____D () C:\ProgramData\MFAData 2015-01-15 13:33 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg2015 2015-01-15 13:33 - 2015-01-15 13:33 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\MFAData 2015-01-15 13:32 - 2015-01-15 13:33 - 04578024 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_avct_stb_all_2015_5315_ppc17.exe 2015-01-14 12:55 - 2015-01-14 12:56 - 00000197 _____ () C:\WINDOWS\system32\2015-01-14-11-55-47.077-AvastVBoxSVC.exe-2468.log 2015-01-14 04:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-14 04:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-14 04:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-14 04:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-14 04:31 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-14 04:31 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2015-01-14 04:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-14 04:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-14 04:31 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-14 04:31 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-14 04:31 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-14 04:31 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-14 04:31 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-14 04:31 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2015-01-14 04:31 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2015-01-14 04:31 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2015-01-14 04:31 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-01-14 04:31 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2015-01-14 04:31 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-14 04:31 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2015-01-14 04:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-14 04:31 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-01-14 04:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll 2015-01-12 19:16 - 2015-01-12 19:16 - 00000197 _____ () C:\WINDOWS\system32\2015-01-12-18-16-11.057-AvastVBoxSVC.exe-3148.log 2015-01-02 12:00 - 2015-01-02 12:01 - 00000197 _____ () C:\WINDOWS\system32\2015-01-02-11-00-58.043-AvastVBoxSVC.exe-2848.log 2015-01-01 10:19 - 2015-01-01 10:19 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Sony 2014-12-27 10:24 - 2014-12-27 10:24 - 00000197 _____ () C:\WINDOWS\system32\2014-12-27-09-24-41.071-AvastVBoxSVC.exe-2944.log 2014-12-23 18:28 - 2015-01-07 12:44 - 00000000 ____D () C:\Users\Anja xxx\dwhelper 2014-12-23 18:27 - 2014-12-23 18:27 - 00000197 _____ () C:\WINDOWS\system32\2014-12-23-17-27-53.020-AvastVBoxSVC.exe-3032.log 2014-12-22 14:25 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-25-16.010-aswFe.exe-1316.log 2014-12-22 14:17 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-17-47.025-aswFe.exe-3408.log 2014-12-22 14:17 - 2014-12-22 14:18 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-13-17-43.087-AvastVBoxSVC.exe-3024.log 2014-12-22 09:34 - 2014-12-22 09:36 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-34-42.055-AvastVBoxSVC.exe-2044.log 2014-12-22 09:28 - 2014-12-22 09:28 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-28-00.073-AvastVBoxSVC.exe-2448.log 2014-12-22 09:20 - 2014-12-22 09:27 - 00000000 ____D () C:\Program Files\Unlocker 2014-12-22 09:20 - 2014-12-22 09:20 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker 2014-12-22 04:41 - 2014-12-22 04:41 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\MassFaces 2014-12-21 21:11 - 2014-12-21 21:13 - 00000197 _____ () C:\WINDOWS\system32\2014-12-21-20-11-59.078-AvastVBoxSVC.exe-2488.log 2014-12-21 21:07 - 2014-12-21 21:07 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll 2014-12-21 21:05 - 2014-12-21 21:05 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll 2014-12-21 20:42 - 2014-12-21 21:04 - 00003344 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001 2014-12-21 20:42 - 2014-12-21 21:04 - 00003290 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001 2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\ProgramData\Real 2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\Program Files (x86)\Real 2014-12-21 20:39 - 2014-12-22 09:22 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Real 2014-12-21 17:42 - 2015-01-11 19:07 - 00000000 ____D () C:\Users\Anja xxx\Basteln 2014-12-19 15:01 - 2014-12-19 15:01 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-14-01-04.093-AvastVBoxSVC.exe-2476.log 2014-12-17 12:45 - 2014-12-17 12:45 - 00000197 _____ () C:\WINDOWS\system32\2014-12-17-11-45-53.068-AvastVBoxSVC.exe-2296.log 2014-12-17 06:06 - 2014-12-17 06:06 - 00153239 _____ () C:\Users\Anja xxx\Downloads\1492_quadrata_lim.zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 13:03 - 2014-11-21 07:49 - 01917181 _____ () C:\WINDOWS\WindowsUpdate.log 2015-01-16 13:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-01-16 12:40 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\LiveKernelReports 2015-01-16 12:27 - 2014-11-26 19:38 - 00000000 ___DO () C:\Users\Anja xxx\OneDrive 2015-01-16 12:26 - 2013-10-07 06:06 - 00043548 _____ () C:\WINDOWS\PFRO.log 2015-01-16 12:26 - 2013-08-22 15:46 - 00072078 _____ () C:\WINDOWS\setupact.log 2015-01-16 12:26 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-16 12:25 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-01-16 11:20 - 2014-11-21 15:48 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2968767656-935505287-1886515523-1001 2015-01-16 11:16 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-01-16 06:50 - 2014-11-24 06:13 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update 2015-01-16 06:46 - 2014-12-16 04:35 - 00000360 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job 2015-01-16 06:46 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages 2015-01-16 06:20 - 2014-11-21 06:42 - 00000000 ____D () C:\Users\Anja xxx 2015-01-16 05:14 - 2014-12-16 04:35 - 00003356 _____ () C:\WINDOWS\System32\Tasks\HP Photo Creations Communicator 2015-01-16 05:13 - 2014-11-21 07:53 - 00235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log 2015-01-15 19:17 - 2014-12-14 11:53 - 00000000 ____D () C:\WINDOWS\Minidump 2015-01-15 19:17 - 2013-10-07 08:24 - 00000000 ____D () C:\ProgramData\Temp 2015-01-15 19:17 - 2013-10-07 07:05 - 00000000 ___DC () C:\WINDOWS\Panther 2015-01-15 13:56 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-01-15 13:42 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2015-01-15 08:15 - 2014-12-16 04:38 - 00000000 ___RD () C:\Users\Anja xxx\Documents\HP Photo Creations 2015-01-15 08:15 - 2014-12-15 20:52 - 00000000 ____D () C:\ProgramData\HP Photo Creations 2015-01-14 06:12 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-01-06 01:08 - 2014-11-23 23:42 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-01-06 01:08 - 2014-11-23 23:42 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-22 11:21 - 2013-10-07 06:32 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2014-12-22 11:21 - 2013-10-07 06:32 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2014-12-22 11:21 - 2013-10-07 06:11 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-12-17 13:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-12-17 12:43 - 2013-08-22 15:44 - 00351240 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-12-17 10:02 - 2014-12-16 04:40 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Windows Live Some content of TEMP: ==================== C:\Users\Anja xxx\AppData\Local\Temp\obexpf.dll C:\Users\Anja xxx\AppData\Local\Temp\optprosetup.exe C:\Users\Anja xxx\AppData\Local\Temp\Quarantine.exe C:\Users\Anja xxx\AppData\Local\Temp\rnsetup0.exe C:\Users\Anja xxx\AppData\Local\Temp\sqlite3.dll C:\Users\Anja xxx\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-12 13:50 ==================== End Of Log ============================ --- --- --- |
|
16.01.2015, 19:04
| #4 |
| /// the machine /// TB-Ausbilder | Sicherheitswarnung zu meinem Internetzugang durch die TelekomESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.01.2015, 20:32
| #5 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Hi schrauber, ein kleines Problem habe ich im moment mit der Maus sie wird nicht mehr erkannt. Und wenn der Laptop fertig ist wollte ich mit dem zweiten los legen, da gehen aber nur ständig neue Webseiten auf. Komme gar nicht dazu eure Seite zuöffnen um die Dateien zudownloaden. Was kann ich tun...Hilfe Gruß Anja Gruss Anja Geändert von Sumsum (16.01.2015 um 20:41 Uhr) |
|
17.01.2015, 12:29
| #6 |
| /// the machine /// TB-Ausbilder | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Maus ab und wieder anklemmen, Batterien erneuern wenn vorhanden, Treiber neu installieren. Den zweiten Rechner machen wir im Anschluss.
__________________ --> Sicherheitswarnung zu meinem Internetzugang durch die Telekom |
|
18.01.2015, 17:36
| #7 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Hi schrauber, Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d64a252e4325b6419a8b75258593ae57
# engine=22007
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-16 09:14:26
# local_time=2015-01-16 10:14:26 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 95 360060 4640468 0 0
# compatibility_mode_1='AVG AntiVirus 2015'
# compatibility_mode=1054 16777213 100 100 54344 108576850 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 3116556 11747185 0 0
# scanned=196585
# found=17
# cleaned=0
# scan_time=6019
sh=75417E5AB458F12115402E20859836A0695FF110 ft=1 fh=59cc105841bb2939 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anja xxx\AppData\Local\Temp\optprosetup.exe"
sh=44F60AFE167D05C8430EFE72CFC942063D907399 ft=1 fh=63026b1a5122f89b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anja xxx\AppData\Local\Temp\DMR\dmr_72.exe"
sh=00D72D2FB835D7C292D9DEE09DD6BA1D9708B774 ft=1 fh=4cc87cfab3a76bca vn="Variante von Win32/AdWare.SpeedingUpMyPC.N Anwendung" ac=I fn="C:\Users\Anja xxx\AppData\Local\Temp\is1488139799\421DFCFE_stp\OptimizerPro.exe"
sh=759C6B702388066E5D418BC85C6C443AE7A437CA ft=1 fh=5a0f16f5d55902dc vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anja xxx\Downloads\Firefox - CHIP-Installer.exe"
sh=4B1FCC06CDE769000E67A6F5565CC718F1D6B6D0 ft=1 fh=651db89cc451c116 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anja xxx\Downloads\Minecraft SkinEdit - CHIP-Installer.exe"
sh=30A96B3008C2243348193B70F351993020AFC067 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.20\f14790216.html"
sh=6EBB6706CF6DD6719A768375BB42F8CA766A2A78 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.20\f14844064.html"
sh=F6C2F802338519C69291303235CDE82489E3A0C5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.23\f23169976.html"
sh=63B55F6CF17CC3B6B772891C9BB00912E55822B2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.23\f23234720.html"
sh=656A085D7BB547F8D4ECB6980062736EC48CEC33 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.25\f25495336.html"
sh=DFA058BA29E01F161880284BA5AFAD1A669CAA85 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.35\f39525280.html"
sh=DFA058BA29E01F161880284BA5AFAD1A669CAA85 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.4\f7991784.html"
sh=E8923832F1D105233173A9C3CDE89889A1F080F5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.40\f55513392.html"
sh=F13E860A97847DC97D4FCD663678C1FC57437D7E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.40\f55513512.html"
sh=F13E860A97847DC97D4FCD663678C1FC57437D7E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.6\f8386240.html"
sh=C8E2E4F373521F9805851138AC436FD63F50B277 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.6\f8388416.html"
sh=F656AF0B8C855C390AFBFA5DD5D596803A951D9E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.69\f80091784.html"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d64a252e4325b6419a8b75258593ae57
# engine=22010
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-17 06:22:21
# local_time=2015-01-17 07:22:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 95 389335 4673343 0 0
# compatibility_mode_1='AVG AntiVirus 2015'
# compatibility_mode=1054 16777213 100 100 33682 108609725 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 3145831 11780060 0 0
# scanned=376320
# found=53
# cleaned=53
# scan_time=10792
sh=75417E5AB458F12115402E20859836A0695FF110 ft=1 fh=59cc105841bb2939 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\AppData\Local\Temp\optprosetup.exe"
sh=44F60AFE167D05C8430EFE72CFC942063D907399 ft=1 fh=63026b1a5122f89b vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\AppData\Local\Temp\DMR\dmr_72.exe"
sh=00D72D2FB835D7C292D9DEE09DD6BA1D9708B774 ft=1 fh=4cc87cfab3a76bca vn="Variante von Win32/AdWare.SpeedingUpMyPC.N Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\AppData\Local\Temp\is1488139799\421DFCFE_stp\OptimizerPro.exe"
sh=759C6B702388066E5D418BC85C6C443AE7A437CA ft=1 fh=5a0f16f5d55902dc vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\Firefox - CHIP-Installer.exe"
sh=4B1FCC06CDE769000E67A6F5565CC718F1D6B6D0 ft=1 fh=651db89cc451c116 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\Minecraft SkinEdit - CHIP-Installer.exe"
sh=30A96B3008C2243348193B70F351993020AFC067 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.20\f14790216.html"
sh=6EBB6706CF6DD6719A768375BB42F8CA766A2A78 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.20\f14844064.html"
sh=F6C2F802338519C69291303235CDE82489E3A0C5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.23\f23169976.html"
sh=63B55F6CF17CC3B6B772891C9BB00912E55822B2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.23\f23234720.html"
sh=656A085D7BB547F8D4ECB6980062736EC48CEC33 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.25\f25495336.html"
sh=DFA058BA29E01F161880284BA5AFAD1A669CAA85 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.35\f39525280.html"
sh=DFA058BA29E01F161880284BA5AFAD1A669CAA85 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.4\f7991784.html"
sh=E8923832F1D105233173A9C3CDE89889A1F080F5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.40\f55513392.html"
sh=F13E860A97847DC97D4FCD663678C1FC57437D7E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.40\f55513512.html"
sh=F13E860A97847DC97D4FCD663678C1FC57437D7E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.6\f8386240.html"
sh=C8E2E4F373521F9805851138AC436FD63F50B277 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.6\f8388416.html"
sh=F656AF0B8C855C390AFBFA5DD5D596803A951D9E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Anja xxx\Downloads\testdisk-6.14.win64\testdisk-6.14\recup_dir.69\f80091784.html"
sh=5A81CC652C858533C5D86DFE6FD23EBF2F96E502 ft=1 fh=abbd31e31464b576 vn="Win32/VOPackage.BC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\nsp8FD6.tmp"
sh=FD78BFEABDE021728698D35449344CC0372D696B ft=1 fh=8a62ed7acf6a31c5 vn="Variante von MSIL/DomaIQ.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\dfs2416.tmp"
sh=FD78BFEABDE021728698D35449344CC0372D696B ft=1 fh=8a62ed7acf6a31c5 vn="Variante von MSIL/DomaIQ.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\dfsEC7C.tmp"
sh=4CCFD8881EC408130C36D96D0D9C9911ABA66AF4 ft=1 fh=921deb979f24fcef vn="Variante von MSIL/NewPlayer.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\newvideoplayersetup.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsc3B04.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsc42E4.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsc4E12.exe"
sh=3560FE1E82F4F75412E044A2A0B6F964ED25A9D2 ft=1 fh=460447689ed950e5 vn="Win32/Conduit.SearchProtect.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsg61D9.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsj5F7B.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsk3ECA.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsn444A.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nso2DA1.exe"
sh=3560FE1E82F4F75412E044A2A0B6F964ED25A9D2 ft=1 fh=460447689ed950e5 vn="Win32/Conduit.SearchProtect.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nso5B60.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsq64CB.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsr288F.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsr599E.exe"
sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsu48C1.exe"
sh=3560FE1E82F4F75412E044A2A0B6F964ED25A9D2 ft=1 fh=460447689ed950e5 vn="Win32/Conduit.SearchProtect.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsv928F.exe"
sh=3560FE1E82F4F75412E044A2A0B6F964ED25A9D2 ft=1 fh=460447689ed950e5 vn="Win32/Conduit.SearchProtect.V evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nsw9687.exe"
sh=CFE3B64AB45C3CF6AEC858EC003730AE7FA6610D ft=1 fh=4e9e1f87ee838ed4 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\optprosetup.exe"
sh=6A3C7109D1ED48984153A7EEC4CA73CB233A8C6B ft=1 fh=ada4696db45b46df vn="Win32/SpeedUpMyPC.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\speedupmypc.exe"
sh=9B72604832B83A5508824184D19DF2E98B654EA4 ft=1 fh=29a0d2f607c0a043 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\spidentifierimpl.exe"
sh=9B72604832B83A5508824184D19DF2E98B654EA4 ft=1 fh=29a0d2f607c0a043 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\spidentifierimpl2.exe"
sh=7E2CB4BEC502F5A4C68F82A986AD0CF05ABB4BA0 ft=1 fh=5edfbebd15701758 vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\is-1B6DB.tmp\SpeedUpMyPC-standalone-setup.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\is45637729\205426224_stp\wajam_validate.exe"
sh=A707761067E38FACE204049CAEF58BFCEBC1F8B3 ft=1 fh=273a117abdd03601 vn="Win32/Distromatic.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\is45637729\205426268_stp\distro-meta-installer.exe"
sh=EEB9942CA0AF1E4A9BB315450F784D8540256BBF ft=1 fh=3eb841d346883bd3 vn="Win32/Systweak.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\is45637729\205426329_stp\rcpsetup_adppi14_adppi14.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\is82122515\205641788_stp\wajam_validate.exe"
sh=11D5EE05ADD03CE3107715CD59EF350BC5084E9F ft=1 fh=825b9b0785a89e52 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\nswFE79\SpSetup.exe"
sh=901CA10DE8427F4DF1B32F0F4AB4448F79D246C7 ft=1 fh=c71c0011296be73c vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Local\Temp\Player.exe\Player.exe"
sh=2B9306B52BB9FDDE632ABBEDC2F539A3A25BBE71 ft=1 fh=0762efd511f24141 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Roaming\OpenCandy\8098EC79B3934140A526B7F35D5D8E13\Installer.exe"
sh=9E77E1D2FD7B77B0FD8A71A70C35DD5A16836CF3 ft=1 fh=b241df9fafd25e77 vn="Win32/Systweak.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows.old\Users\Anja xxx\AppData\Roaming\systweak\ssd\SSDPTstub.exe"
sh=130AAE89477828E3BB62DE638F3885B82F9B3685 ft=1 fh=d5d5dbb680ec40c9 vn="Variante von Win32/ExFriendAlert.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="F:\2014\Download\Neuer Ordner (4)\Setup.exe"
sh=28BB05C8600BF47F356694AE7AE44839C1594678 ft=1 fh=261be7a487092981 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="F:\2014\Download\Neuer Ordner (4)\SoftonicDownloader_fuer_minecraft.exe"
sh=4048567959A9B53F93E46B9BFD1CADA240243B07 ft=1 fh=cd17a125951bd48a vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="F:\Neuer Ordner (2)\Downloads\Kizi_Games.exe"
sh=E115AC80776D091765ED3EA022A001E0D8AA4DC9 ft=1 fh=85ce5afd4a88c17f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="F:\Neuer Ordner (2)\Heiko\unlocker1.9.0.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.93
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus 2015
Windows Defender
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
AVG PC TuneUp 2015
AVG PC TuneUp 2015 (de-DE)
AVG PC TuneUp 2015
Java 8 Update 25
Java version 32-bit out of Date!
Adobe Flash Player 16.0.0.235
Mozilla Firefox (34.0.5)
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast ng vbox\AvastVBoxSVC.exe
AVAST Software Avast ng ngservice.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 01
Ran by Anja xxx (administrator) on ANJA on 18-01-2015 17:30:19
Running from C:\Users\Anja xxx\Downloads
Loaded Profiles: Anja xxx (Available profiles: Anja xxx & Administrator & Gast)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TURatingSynch.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-12-21] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {9e3cc924-4ce3-11e3-8279-806e6f6e6963} - "E:\.\Helper\ServiceDVD.bin" -app .\ServiceDVD\browser7\application.ini
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {cc79c1d0-cdd7-11e3-8295-240a64e270fc} - "F:\Startme.exe"
IFEO\photoproduct.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\spyhunter4.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKU\S-1-5-21-2968767656-935505287-1886515523-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Anja xxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: DownloadHelper - C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-24]
Chrome:
=======
CHR Profile: C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-15]
CHR Extension: (Google Drive) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-15]
CHR Extension: (YouTube) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-15]
CHR Extension: (Google-Suche) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-15]
CHR Extension: (Avast Online Security) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-15]
CHR Extension: (Google Mail) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-15]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-11]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-11] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-11] (Avast Software)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S4 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed]
S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S4 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-12-21] (RealNetworks, Inc.)
S4 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
S4 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2015-01-15] (Enigma Software Group USA, LLC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2014-11-24] (AVG Technologies)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-11] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-11] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-11] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-11] ()
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [277784 2014-09-24] (AVG Technologies CZ, s.r.o.)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-15] ()
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-10-22] ()
S3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-11] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-18 17:30 - 2015-01-18 17:30 - 00000000 ____D () C:\Users\Anja xxx\Downloads\FRST-OlderVersion
2015-01-18 17:28 - 2015-01-18 17:28 - 00001001 _____ () C:\Users\Anja xxx\Desktop\checkup.txt
2015-01-16 20:23 - 2015-01-16 20:23 - 00852504 _____ () C:\Users\Anja xxx\Downloads\SecurityCheck.exe
2015-01-16 20:16 - 2015-01-16 20:16 - 02347384 _____ (ESET) C:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
2015-01-16 15:54 - 2015-01-16 15:54 - 00000000 ____D () C:\WINDOWS\Sun
2015-01-16 12:34 - 2015-01-16 12:34 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-16 12:28 - 2015-01-16 12:29 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-11-28-38.039-AvastVBoxSVC.exe-3904.log
2015-01-16 11:21 - 2015-01-16 11:21 - 00002762 _____ () C:\WINDOWS\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2015-01-16 11:12 - 2015-01-16 12:24 - 00000000 ____D () C:\AdwCleaner
2015-01-16 10:19 - 2015-01-16 10:24 - 00001284 _____ () C:\Users\Anja xxx\Desktop\Revo Uninstaller.lnk
2015-01-16 10:19 - 2015-01-16 10:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-16 10:16 - 2015-01-16 13:36 - 00000000 ____D () C:\Users\Anja xxx\Desktop\Neuer Ordner
2015-01-16 08:40 - 2015-01-16 08:41 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Anja xxx\Downloads\mbam-setup-2.0.4.1028(1).exe
2015-01-16 08:40 - 2015-01-16 08:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anja xxx\Downloads\revosetup95.exe
2015-01-16 08:39 - 2015-01-16 08:41 - 02191360 _____ () C:\Users\Anja xxx\Downloads\AdwCleaner_4.107.exe
2015-01-16 08:39 - 2015-01-16 08:39 - 01707939 _____ (Thisisu) C:\Users\Anja xxx\Downloads\JRT.exe
2015-01-16 07:09 - 2015-01-16 07:10 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-06-09-59.020-AvastVBoxSVC.exe-3640.log
2015-01-16 06:54 - 2015-01-16 06:55 - 00380416 _____ () C:\Users\Anja xxx\Downloads\Gmer-19357(1).exe
2015-01-16 06:49 - 2015-01-16 06:51 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-05-49-48.033-AvastVBoxSVC.exe-3440.log
2015-01-16 06:25 - 2015-01-16 06:27 - 00024280 _____ () C:\Users\Anja xxx\Downloads\Addition.txt
2015-01-16 06:24 - 2015-01-16 06:24 - 00380416 _____ () C:\Users\Anja xxx\Downloads\Gmer-19357.exe
2015-01-16 06:23 - 2015-01-18 17:30 - 00017572 _____ () C:\Users\Anja xxx\Downloads\FRST.txt
2015-01-16 06:22 - 2015-01-18 17:30 - 00000000 ____D () C:\FRST
2015-01-16 06:21 - 2015-01-18 17:30 - 02126848 _____ (Farbar) C:\Users\Anja xxx\Downloads\FRST64.exe
2015-01-16 06:20 - 2015-01-16 06:20 - 00000484 _____ () C:\Users\Anja xxx\Downloads\defogger_disable.log
2015-01-16 06:20 - 2015-01-16 06:20 - 00000000 _____ () C:\Users\Anja xxx\defogger_reenable
2015-01-16 06:18 - 2015-01-16 06:19 - 00050477 _____ () C:\Users\Anja xxx\Downloads\Defogger.exe
2015-01-16 05:48 - 2015-01-16 05:57 - 128449792 _____ (Microsoft Corporation) C:\Users\Anja xxx\Downloads\msert(1).exe
2015-01-16 05:46 - 2015-01-16 05:46 - 01048576 _____ () C:\Users\Anja xxx\Downloads\msert.exe
2015-01-16 05:37 - 2015-01-17 04:28 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-16 05:37 - 2015-01-16 10:27 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-16 05:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-16 05:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-16 05:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-16 05:34 - 2015-01-16 05:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Anja xxx\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-16 01:21 - 2015-01-16 01:21 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-00-21-00.096-AvastVBoxSVC.exe-3856.log
2015-01-16 01:19 - 2015-01-16 01:19 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-01-15 19:20 - 2015-01-15 19:20 - 00003704 _____ () C:\WINDOWS\System32\Tasks\Java Platform SE Auto Updater
2015-01-15 18:45 - 2015-01-15 18:45 - 00002245 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-01-15 18:45 - 2015-01-15 18:45 - 00002233 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-01-15 18:45 - 2015-01-15 18:45 - 00002221 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-01-15 18:45 - 2014-11-24 12:48 - 00040248 _____ (AVG Technologies) C:\WINDOWS\system32\TURegOpt.exe
2015-01-15 18:45 - 2014-11-24 12:48 - 00029496 _____ (AVG Technologies) C:\WINDOWS\system32\authuitu.dll
2015-01-15 18:45 - 2014-11-24 12:48 - 00025400 _____ (AVG Technologies) C:\WINDOWS\SysWOW64\authuitu.dll
2015-01-15 18:44 - 2015-01-15 18:44 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG
2015-01-15 18:43 - 2015-01-15 18:45 - 00000000 ____D () C:\ProgramData\AVG
2015-01-15 18:43 - 2015-01-15 18:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg
2015-01-15 18:24 - 2015-01-15 18:31 - 90844984 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_tuh_stf_all_2015_238_24c4.exe
2015-01-15 14:22 - 2015-01-15 14:22 - 00000000 _____ () C:\autoexec.bat
2015-01-15 14:21 - 2015-01-16 06:37 - 00003344 _____ () C:\WINDOWS\System32\Tasks\SpyHunter4Startup
2015-01-15 14:21 - 2015-01-15 14:21 - 00001107 _____ () C:\Users\Anja xxx\Desktop\SpyHunter.lnk
2015-01-15 14:21 - 2015-01-15 14:21 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Enigma Software Group
2015-01-15 14:20 - 2015-01-15 14:21 - 00000000 ____D () C:\sh4ldr
2015-01-15 14:17 - 2015-01-15 14:17 - 00022704 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys
2015-01-15 14:17 - 2015-01-15 14:17 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-01-15 14:15 - 2015-01-15 14:15 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Anja xxx\Downloads\SpyHunter-Installer.exe
2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Avg_Update_1014av
2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\ProgramData\Avg_Update_1014av
2015-01-15 13:43 - 2015-01-15 13:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG2015
2015-01-15 13:42 - 2015-01-15 13:42 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\TuneUp Software
2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-15 13:41 - 2015-01-15 18:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-01-15 13:41 - 2015-01-15 14:18 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-15 13:41 - 2015-01-15 13:41 - 00000000 ___HD () C:\$AVG
2015-01-15 13:33 - 2015-01-17 04:15 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-15 13:33 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg2015
2015-01-15 13:33 - 2015-01-15 13:33 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\MFAData
2015-01-15 13:32 - 2015-01-15 13:33 - 04578024 _____ (AVG Technologies) C:\Users\Anja xxx\Downloads\avg_avct_stb_all_2015_5315_ppc17.exe
2015-01-14 12:55 - 2015-01-14 12:56 - 00000197 _____ () C:\WINDOWS\system32\2015-01-14-11-55-47.077-AvastVBoxSVC.exe-2468.log
2015-01-14 04:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-14 04:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-14 04:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-14 04:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-14 04:31 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-14 04:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-14 04:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-14 04:31 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-14 04:31 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-14 04:31 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-14 04:31 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-14 04:31 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-14 04:31 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-14 04:31 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-14 04:31 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-14 04:31 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-14 04:31 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-14 04:31 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-14 04:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-14 04:31 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-14 04:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-12 19:16 - 2015-01-12 19:16 - 00000197 _____ () C:\WINDOWS\system32\2015-01-12-18-16-11.057-AvastVBoxSVC.exe-3148.log
2015-01-02 12:00 - 2015-01-02 12:01 - 00000197 _____ () C:\WINDOWS\system32\2015-01-02-11-00-58.043-AvastVBoxSVC.exe-2848.log
2015-01-01 10:19 - 2015-01-01 10:19 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Sony
2014-12-27 10:24 - 2014-12-27 10:24 - 00000197 _____ () C:\WINDOWS\system32\2014-12-27-09-24-41.071-AvastVBoxSVC.exe-2944.log
2014-12-23 18:28 - 2015-01-07 12:44 - 00000000 ____D () C:\Users\Anja xxx\dwhelper
2014-12-23 18:27 - 2014-12-23 18:27 - 00000197 _____ () C:\WINDOWS\system32\2014-12-23-17-27-53.020-AvastVBoxSVC.exe-3032.log
2014-12-22 14:25 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-25-16.010-aswFe.exe-1316.log
2014-12-22 14:17 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-17-47.025-aswFe.exe-3408.log
2014-12-22 14:17 - 2014-12-22 14:18 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-13-17-43.087-AvastVBoxSVC.exe-3024.log
2014-12-22 09:34 - 2014-12-22 09:36 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-34-42.055-AvastVBoxSVC.exe-2044.log
2014-12-22 09:28 - 2014-12-22 09:28 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-28-00.073-AvastVBoxSVC.exe-2448.log
2014-12-22 09:20 - 2014-12-22 09:27 - 00000000 ____D () C:\Program Files\Unlocker
2014-12-22 09:20 - 2014-12-22 09:20 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2014-12-22 04:41 - 2014-12-22 04:41 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\MassFaces
2014-12-21 21:11 - 2014-12-21 21:13 - 00000197 _____ () C:\WINDOWS\system32\2014-12-21-20-11-59.078-AvastVBoxSVC.exe-2488.log
2014-12-21 21:07 - 2014-12-21 21:07 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll
2014-12-21 20:42 - 2014-12-21 21:04 - 00003344 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001
2014-12-21 20:42 - 2014-12-21 21:04 - 00003290 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001
2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\ProgramData\Real
2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\Program Files (x86)\Real
2014-12-21 20:39 - 2014-12-22 09:22 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Real
2014-12-21 17:42 - 2015-01-11 19:07 - 00000000 ____D () C:\Users\Anja xxx\Basteln
2014-12-19 15:01 - 2014-12-19 15:01 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-14-01-04.093-AvastVBoxSVC.exe-2476.log
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-18 17:16 - 2014-11-26 19:38 - 00000000 __RDO () C:\Users\Anja xxx\OneDrive
2015-01-18 17:12 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-18 17:12 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-17 07:26 - 2014-11-21 15:48 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2968767656-935505287-1886515523-1001
2015-01-17 07:13 - 2014-11-21 07:49 - 02072114 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-17 06:40 - 2014-11-21 07:54 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\VirtualStore
2015-01-16 21:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2015-01-16 20:23 - 2013-10-07 06:32 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-16 20:23 - 2013-10-07 06:32 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-16 20:23 - 2013-10-07 06:11 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-16 20:19 - 2013-08-22 15:46 - 00072875 _____ () C:\WINDOWS\setupact.log
2015-01-16 12:26 - 2013-10-07 06:06 - 00043548 _____ () C:\WINDOWS\PFRO.log
2015-01-16 12:26 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-16 12:25 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-16 06:50 - 2014-11-24 06:13 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-01-16 06:46 - 2014-12-16 04:35 - 00000360 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job
2015-01-16 06:46 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2015-01-16 06:20 - 2014-11-21 06:42 - 00000000 ____D () C:\Users\Anja xxx
2015-01-16 05:14 - 2014-12-16 04:35 - 00003356 _____ () C:\WINDOWS\System32\Tasks\HP Photo Creations Communicator
2015-01-16 05:13 - 2014-11-21 07:53 - 00235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log
2015-01-15 19:17 - 2014-12-14 11:53 - 00000000 ____D () C:\WINDOWS\Minidump
2015-01-15 19:17 - 2013-10-07 08:24 - 00000000 ____D () C:\ProgramData\Temp
2015-01-15 19:17 - 2013-10-07 07:05 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-15 13:56 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-15 13:42 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-15 08:15 - 2014-12-16 04:38 - 00000000 ___RD () C:\Users\Anja xxx\Documents\HP Photo Creations
2015-01-15 08:15 - 2014-12-15 20:52 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2015-01-14 06:12 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-06 01:08 - 2014-11-23 23:42 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-06 01:08 - 2014-11-23 23:42 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-11-23 23:22 - 2014-11-23 23:22 - 0000044 _____ () C:\Users\Anja xxx\AppData\Roaming\WB.CFG
2014-11-21 07:53 - 2015-01-16 05:13 - 0235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log
2014-12-15 20:50 - 2014-12-15 20:50 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-10-08 10:56 - 2013-10-08 10:56 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-10-07 08:31 - 2013-10-07 08:31 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-10-07 08:31 - 2013-10-07 08:31 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-10-07 08:28 - 2013-10-07 08:28 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-10-07 08:30 - 2013-10-07 08:31 - 0000111 _____ () C:\ProgramData\{39337565-330E-4ab6-A9AE-AC81E0720B10}.log
2013-10-07 08:29 - 2013-10-07 08:29 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2013-10-07 08:27 - 2013-10-07 08:27 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-10-07 08:29 - 2013-10-07 08:30 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-10-07 08:27 - 2013-10-07 08:28 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-10-07 08:28 - 2013-10-07 08:28 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log
Some content of TEMP:
====================
C:\Users\Anja xxx\AppData\Local\Temp\obexpf.dll
C:\Users\Anja xxx\AppData\Local\Temp\Quarantine.exe
C:\Users\Anja xxx\AppData\Local\Temp\rnsetup0.exe
C:\Users\Anja xxx\AppData\Local\Temp\sqlite3.dll
C:\Users\Anja xxx\AppData\Local\Temp\stubhelper.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-12 13:50
==================== End Of Log ============================
[/C |
|
18.01.2015, 19:43
| #8 |
| /// the machine /// TB-Ausbilder | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Download Ordner leeren, Ordner Windows.old löschen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.01.2015, 20:45
| #9 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Hi schrauber, Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2015 01
Ran by Anja xxx at 2015-01-18 20:39:41
Running from C:\Users\Anja xxx\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus 2015 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2015 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4260 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.238 - AVG Technologies)
AVG PC TuneUp 2015 (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
Bad Piggies (HKLM-x32\...\{32941438-AD79-4EF4-B7E4-86039E41B4D3}) (Version: 1.0.0 - Rovio)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
HP Deskjet 1510 series - Grundlegende Software für das Gerät (HKLM\...\{FD79E5D2-5CFE-49C2-9461-D011D1355696}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.16432 - HP)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3309 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7040 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.16.201411190934 - Sony Mobile Communications Inc.)
Sony PC Companion 2.10.236 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.236 - Sony)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
Unity Web Player (HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
21-12-2014 21:31:37 Removed Microsoft Silverlight
13-01-2015 12:59:49 Geplanter Prüfpunkt
15-01-2015 13:39:52 Installed AVG 2015
18-01-2015 17:46:24 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {28F4BD6B-349E-45B8-92A5-5C1374EEA6EC} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2014-11-24] (AVG Technologies)
Task: {2A86C589-3235-42AD-B8B9-686305881BAA} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-10-07] (Oracle Corporation)
Task: {41544D9A-0D21-43B6-B7D2-03B0D0423EE4} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {48C77DD8-DE99-415D-BC0E-6BC0631341B5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-11] (AVAST Software)
Task: {4B63D892-0597-4538-B074-DA62A4E6FC7F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-12] (Microsoft Corporation)
Task: {4EC2D950-642A-4A7B-B353-34D4C416277E} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-01-15] (Enigma Software Group USA, LLC.)
Task: {7260B9F2-B5FB-436B-9EC8-575386B4C567} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)
Task: {B1042412-B30E-4EE5-BA49-C50AA488B412} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2014-12-16] ()
Task: {E203C98C-6294-4879-809F-2FF5AAB87394} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)
Task: {FE20B1CF-34CB-420F-98FE-D75DF4DB0327} - \RealPlayer Cloud (32-bit) No Task File <==== ATTENTION
Task: {FF6B227B-3D3A-4BEB-A425-B5D3F8EDB02F} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-08-08] (Dolby Laboratories Inc.)
Task: C:\WINDOWS\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
==================== Loaded Modules (whitelisted) =============
2013-10-08 12:22 - 2013-06-27 09:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2014-11-24 12:48 - 2014-11-24 12:48 - 00713528 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2013-10-08 12:22 - 2013-09-11 11:41 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-11-24 12:49 - 2014-11-24 12:49 - 00856888 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll
2013-10-08 12:22 - 2010-12-17 14:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2013-10-08 12:22 - 2012-10-23 18:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-08-08 16:53 - 2013-08-08 16:53 - 00050904 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2013-10-08 12:22 - 2013-07-18 15:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2015-01-16 10:16 - 2015-01-16 10:16 - 02911744 _____ () C:\Program Files\AVAST Software\Avast\defs\15011600\algo.dll
2014-12-11 21:27 - 2014-12-11 21:27 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-16 20:20 - 2015-01-16 20:20 - 02911744 _____ () C:\Program Files\AVAST Software\Avast\defs\15011601\algo.dll
2015-01-18 19:37 - 2015-01-18 19:37 - 02911744 _____ () C:\Program Files\AVAST Software\Avast\defs\15011800\algo.dll
2013-10-08 12:22 - 2009-12-18 15:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-10-08 12:22 - 2009-12-18 15:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2014-12-11 21:28 - 2014-12-11 21:28 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-12-09 10:14 - 2014-12-09 10:14 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Anja xxx\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Anja xxx\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: BTDevManager => 2
MSCONFIG\Services: CyberLink PowerDVD 10 MS Monitor Service => 2
MSCONFIG\Services: CyberLink PowerDVD 10 MS Service => 2
MSCONFIG\Services: RichVideo64 => 2
MSCONFIG\Services: Sony PC Companion => 3
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "TkBellExe"
========================= Accounts: ==========================
Administrator (S-1-5-21-2968767656-935505287-1886515523-500 - Administrator - Disabled) => C:\Users\Administrator
Anja xxx (S-1-5-21-2968767656-935505287-1886515523-1001 - Administrator - Enabled) => C:\Users\Anja xxx
Gast (S-1-5-21-2968767656-935505287-1886515523-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-2968767656-935505287-1886515523-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: Realtek Bluetooth 4.0 + High Speed Chip
Description: Realtek Bluetooth 4.0 + High Speed Chip
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Realtek Semiconductor Corp.
Service: BTHUSB
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/18/2015 05:18:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/18/2015 05:17:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17284, Zeitstempel: 0x53f816dc
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebd22
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000f0d6c
ID des fehlerhaften Prozesses: 0x1d1c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (01/17/2015 07:28:30 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/17/2015 04:20:26 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/17/2015 04:20:22 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/17/2015 04:19:28 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/16/2015 10:14:59 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Bei der Aktivierung der App „Microsoft.SkypeApp_kzf8qxf38zg5c!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (01/16/2015 09:42:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1958
Startzeit: 01d031cbe88f74de
Endzeit: 4294967295
Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe
Berichts-ID: 371f958b-9dc0-11e4-829d-0c54a513726f
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (01/16/2015 08:21:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/16/2015 08:21:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (01/17/2015 07:36:47 AM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (01/17/2015 07:36:47 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (01/17/2015 07:36:47 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (01/17/2015 07:30:03 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Windows-Tool zum Entfernen bösartiger Software für Windows 8, 8.1 und Windows Server 2012, 2012 R2 x64 Edition - Januar 2015 (KB890830)
Error: (01/16/2015 10:14:54 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: App.AppX54xz6wnkhmw763c2y8tb018n7d71dtx7.wwa
Error: (01/16/2015 07:50:29 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (01/16/2015 01:36:40 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/16/2015 01:36:10 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/16/2015 01:27:34 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (01/16/2015 01:27:04 PM) (Source: DCOM) (EventID: 10010) (User: ANJA)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Microsoft Office Sessions:
=========================
Error: (01/18/2015 05:18:31 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (01/18/2015 05:17:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1728453f816dcntdll.dll6.3.9600.1727853eebd22c000037400000000000f0d6c1d1c01d0333a0640c156C:\WINDOWS\Explorer.EXEC:\WINDOWS\SYSTEM32\ntdll.dll8e38b3c7-9f2d-11e4-829d-0c54a513726f
Error: (01/17/2015 07:28:30 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (01/17/2015 04:20:26 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
Error: (01/17/2015 04:20:22 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
Error: (01/17/2015 04:19:28 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
Error: (01/16/2015 10:14:59 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ANJA)
Description: Microsoft.SkypeApp_kzf8qxf38zg5c!App-2144927141
Error: (01/16/2015 09:42:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20689195801d031cbe88f74de4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe371f958b-9dc0-11e4-829d-0c54a513726fmicrosoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1
Error: (01/16/2015 08:21:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
Error: (01/16/2015 08:21:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Anja xxx\Downloads\esetsmartinstaller_deu.exe
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU N2910 @ 1.60GHz
Percentage of memory in use: 47%
Total physical RAM: 3976.19 MB
Available physical RAM: 2104.93 MB
Total Pagefile: 5000.19 MB
Available Pagefile: 1984.06 MB
Total Virtual: 131072 MB
Available Virtual: 131071.85 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:404.05 GB) (Free:340.77 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:45.62 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-01-2015 01
Ran by Anja xxx (administrator) on ANJA on 18-01-2015 20:37:28
Running from C:\Users\Anja xxx\Downloads
Loaded Profiles: Anja xxx (Available profiles: Anja xxx & Administrator & Gast)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653208 2013-09-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-12-21] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {9e3cc924-4ce3-11e3-8279-806e6f6e6963} - "E:\.\Helper\ServiceDVD.bin" -app .\ServiceDVD\browser7\application.ini
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\...\MountPoints2: {cc79c1d0-cdd7-11e3-8295-240a64e270fc} - "F:\Startme.exe"
IFEO\photoproduct.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\spyhunter4.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
IFEO\uninst.exe: [Debugger] "C:\Program Files (x86)\AVG\AVG PC TuneUp\TUAutoReactivator64.exe"
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
HKU\S-1-5-21-2968767656-935505287-1886515523-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2968767656-935505287-1886515523-1001 -> {EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKU\S-1-5-21-2968767656-935505287-1886515523-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Anja xxx\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: DownloadHelper - C:\Users\Anja xxx\AppData\Roaming\Mozilla\Firefox\Profiles\ufbwnsfw.default-1418528386244\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-24]
Chrome:
=======
CHR Profile: C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-15]
CHR Extension: (Google Drive) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-15]
CHR Extension: (YouTube) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-15]
CHR Extension: (Google-Suche) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-15]
CHR Extension: (Avast Online Security) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-15]
CHR Extension: (Google Mail) - C:\Users\Anja xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-15]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-11]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-11] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-11] (Avast Software)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S4 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed]
S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S4 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-12-21] (RealNetworks, Inc.)
S4 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
S4 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025920 2015-01-15] (Enigma Software Group USA, LLC.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2014-11-24] (AVG Technologies)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-11] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-11] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-11] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-11] ()
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [277784 2014-09-24] (AVG Technologies CZ, s.r.o.)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-01-15] ()
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-10-22] ()
S3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-11] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-18 20:37 - 2015-01-18 20:37 - 00017688 _____ () C:\Users\Anja xxx\Downloads\FRST.txt
2015-01-18 20:36 - 2015-01-18 20:36 - 02126848 _____ (Farbar) C:\Users\Anja xxx\Downloads\FRST64.exe
2015-01-18 20:32 - 2015-01-18 20:33 - 00000097 _____ () C:\Users\Anja xxx\Desktop\Fix.txt
2015-01-16 15:54 - 2015-01-16 15:54 - 00000000 ____D () C:\WINDOWS\Sun
2015-01-16 12:34 - 2015-01-16 12:34 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-16 12:28 - 2015-01-16 12:29 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-11-28-38.039-AvastVBoxSVC.exe-3904.log
2015-01-16 11:21 - 2015-01-16 11:21 - 00002762 _____ () C:\WINDOWS\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2015-01-16 11:12 - 2015-01-16 12:24 - 00000000 ____D () C:\AdwCleaner
2015-01-16 10:19 - 2015-01-16 10:24 - 00001284 _____ () C:\Users\Anja xxx\Desktop\Revo Uninstaller.lnk
2015-01-16 10:19 - 2015-01-16 10:24 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-16 10:16 - 2015-01-18 20:22 - 00000000 ____D () C:\Users\Anja xxx\Desktop\Neuer Ordner
2015-01-16 07:09 - 2015-01-16 07:10 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-06-09-59.020-AvastVBoxSVC.exe-3640.log
2015-01-16 06:49 - 2015-01-16 06:51 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-05-49-48.033-AvastVBoxSVC.exe-3440.log
2015-01-16 06:22 - 2015-01-18 20:37 - 00000000 ____D () C:\FRST
2015-01-16 06:20 - 2015-01-16 06:20 - 00000000 _____ () C:\Users\Anja xxx\defogger_reenable
2015-01-16 05:37 - 2015-01-17 04:28 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-16 05:37 - 2015-01-16 10:27 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-16 05:37 - 2015-01-16 10:27 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-16 05:37 - 2015-01-16 05:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-16 05:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-16 05:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-16 05:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-16 01:21 - 2015-01-16 01:21 - 00000197 _____ () C:\WINDOWS\system32\2015-01-16-00-21-00.096-AvastVBoxSVC.exe-3856.log
2015-01-16 01:19 - 2015-01-16 01:19 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-01-15 19:20 - 2015-01-15 19:20 - 00003704 _____ () C:\WINDOWS\System32\Tasks\Java Platform SE Auto Updater
2015-01-15 18:45 - 2015-01-15 18:45 - 00002245 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-01-15 18:45 - 2015-01-15 18:45 - 00002233 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-01-15 18:45 - 2015-01-15 18:45 - 00002221 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-01-15 18:45 - 2014-11-24 12:48 - 00040248 _____ (AVG Technologies) C:\WINDOWS\system32\TURegOpt.exe
2015-01-15 18:45 - 2014-11-24 12:48 - 00029496 _____ (AVG Technologies) C:\WINDOWS\system32\authuitu.dll
2015-01-15 18:45 - 2014-11-24 12:48 - 00025400 _____ (AVG Technologies) C:\WINDOWS\SysWOW64\authuitu.dll
2015-01-15 18:44 - 2015-01-15 18:44 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG
2015-01-15 18:43 - 2015-01-15 18:45 - 00000000 ____D () C:\ProgramData\AVG
2015-01-15 18:43 - 2015-01-15 18:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg
2015-01-15 14:22 - 2015-01-15 14:22 - 00000000 _____ () C:\autoexec.bat
2015-01-15 14:21 - 2015-01-16 06:37 - 00003344 _____ () C:\WINDOWS\System32\Tasks\SpyHunter4Startup
2015-01-15 14:21 - 2015-01-15 14:21 - 00001107 _____ () C:\Users\Anja xxx\Desktop\SpyHunter.lnk
2015-01-15 14:21 - 2015-01-15 14:21 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Enigma Software Group
2015-01-15 14:20 - 2015-01-15 14:21 - 00000000 ____D () C:\sh4ldr
2015-01-15 14:17 - 2015-01-15 14:17 - 00022704 _____ () C:\WINDOWS\system32\Drivers\EsgScanner.sys
2015-01-15 14:17 - 2015-01-15 14:17 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Avg_Update_1014av
2015-01-15 13:57 - 2015-01-15 13:57 - 00000000 ____D () C:\ProgramData\Avg_Update_1014av
2015-01-15 13:43 - 2015-01-15 13:43 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\AVG2015
2015-01-15 13:42 - 2015-01-15 13:42 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\TuneUp Software
2015-01-15 13:42 - 2015-01-15 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-15 13:41 - 2015-01-15 18:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-01-15 13:41 - 2015-01-15 14:18 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-15 13:41 - 2015-01-15 13:41 - 00000000 ___HD () C:\$AVG
2015-01-15 13:33 - 2015-01-17 04:15 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-15 13:33 - 2015-01-15 13:57 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Avg2015
2015-01-15 13:33 - 2015-01-15 13:33 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\MFAData
2015-01-14 12:55 - 2015-01-14 12:56 - 00000197 _____ () C:\WINDOWS\system32\2015-01-14-11-55-47.077-AvastVBoxSVC.exe-2468.log
2015-01-14 04:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-14 04:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-14 04:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-14 04:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-14 04:31 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-14 04:31 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-14 04:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-14 04:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-14 04:31 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-14 04:31 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-14 04:31 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-14 04:31 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-14 04:31 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-14 04:31 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-14 04:31 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-14 04:31 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-14 04:31 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-14 04:31 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-14 04:31 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-14 04:31 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-14 04:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-14 04:31 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-14 04:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-12 19:16 - 2015-01-12 19:16 - 00000197 _____ () C:\WINDOWS\system32\2015-01-12-18-16-11.057-AvastVBoxSVC.exe-3148.log
2015-01-02 12:00 - 2015-01-02 12:01 - 00000197 _____ () C:\WINDOWS\system32\2015-01-02-11-00-58.043-AvastVBoxSVC.exe-2848.log
2015-01-01 10:19 - 2015-01-01 10:19 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\Sony
2014-12-27 10:24 - 2014-12-27 10:24 - 00000197 _____ () C:\WINDOWS\system32\2014-12-27-09-24-41.071-AvastVBoxSVC.exe-2944.log
2014-12-23 18:28 - 2015-01-07 12:44 - 00000000 ____D () C:\Users\Anja xxx\dwhelper
2014-12-23 18:27 - 2014-12-23 18:27 - 00000197 _____ () C:\WINDOWS\system32\2014-12-23-17-27-53.020-AvastVBoxSVC.exe-3032.log
2014-12-22 14:25 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-25-16.010-aswFe.exe-1316.log
2014-12-22 14:17 - 2014-12-22 14:25 - 00000247 _____ () C:\WINDOWS\system32\2014-12-22-13-17-47.025-aswFe.exe-3408.log
2014-12-22 14:17 - 2014-12-22 14:18 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-13-17-43.087-AvastVBoxSVC.exe-3024.log
2014-12-22 09:34 - 2014-12-22 09:36 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-34-42.055-AvastVBoxSVC.exe-2044.log
2014-12-22 09:28 - 2014-12-22 09:28 - 00000197 _____ () C:\WINDOWS\system32\2014-12-22-08-28-00.073-AvastVBoxSVC.exe-2448.log
2014-12-22 09:20 - 2014-12-22 09:27 - 00000000 ____D () C:\Program Files\Unlocker
2014-12-22 09:20 - 2014-12-22 09:20 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2014-12-22 04:41 - 2014-12-22 04:41 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\MassFaces
2014-12-21 21:11 - 2014-12-21 21:13 - 00000197 _____ () C:\WINDOWS\system32\2014-12-21-20-11-59.078-AvastVBoxSVC.exe-2488.log
2014-12-21 21:07 - 2014-12-21 21:07 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2014-12-21 21:05 - 2014-12-21 21:05 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll
2014-12-21 20:42 - 2014-12-21 21:04 - 00003344 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2968767656-935505287-1886515523-1001
2014-12-21 20:42 - 2014-12-21 21:04 - 00003290 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2968767656-935505287-1886515523-1001
2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\ProgramData\Real
2014-12-21 20:40 - 2014-12-21 21:07 - 00000000 ____D () C:\Program Files (x86)\Real
2014-12-21 20:39 - 2014-12-22 09:22 - 00000000 ____D () C:\Users\Anja xxx\AppData\Roaming\Real
2014-12-21 17:42 - 2015-01-11 19:07 - 00000000 ____D () C:\Users\Anja xxx\Basteln
2014-12-19 15:01 - 2014-12-19 15:01 - 00000197 _____ () C:\WINDOWS\system32\2014-12-19-14-01-04.093-AvastVBoxSVC.exe-2476.log
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-18 20:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-18 19:17 - 2014-11-21 07:49 - 01076888 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-18 17:16 - 2014-11-26 19:38 - 00000000 ___DO () C:\Users\Anja xxx\OneDrive
2015-01-18 17:12 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-17 07:26 - 2014-11-21 15:48 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2968767656-935505287-1886515523-1001
2015-01-17 06:40 - 2014-11-21 07:54 - 00000000 ____D () C:\Users\Anja xxx\AppData\Local\VirtualStore
2015-01-16 21:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2015-01-16 20:23 - 2013-10-07 06:32 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-16 20:23 - 2013-10-07 06:32 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-16 20:23 - 2013-10-07 06:11 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-16 20:19 - 2013-08-22 15:46 - 00072875 _____ () C:\WINDOWS\setupact.log
2015-01-16 12:26 - 2013-10-07 06:06 - 00043548 _____ () C:\WINDOWS\PFRO.log
2015-01-16 12:26 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-16 12:25 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-16 06:50 - 2014-11-24 06:13 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-01-16 06:46 - 2014-12-16 04:35 - 00000360 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job
2015-01-16 06:46 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\Offline Web Pages
2015-01-16 06:20 - 2014-11-21 06:42 - 00000000 ____D () C:\Users\Anja xxx
2015-01-16 05:14 - 2014-12-16 04:35 - 00003356 _____ () C:\WINDOWS\System32\Tasks\HP Photo Creations Communicator
2015-01-16 05:13 - 2014-11-21 07:53 - 00235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log
2015-01-15 19:17 - 2014-12-14 11:53 - 00000000 ____D () C:\WINDOWS\Minidump
2015-01-15 19:17 - 2013-10-07 08:24 - 00000000 ____D () C:\ProgramData\Temp
2015-01-15 19:17 - 2013-10-07 07:05 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-15 13:56 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-15 13:42 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-15 08:15 - 2014-12-16 04:38 - 00000000 ___RD () C:\Users\Anja xxx\Documents\HP Photo Creations
2015-01-15 08:15 - 2014-12-15 20:52 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2015-01-14 06:12 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-06 01:08 - 2014-11-23 23:42 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-06 01:08 - 2014-11-23 23:42 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-11-23 23:22 - 2014-11-23 23:22 - 0000044 _____ () C:\Users\Anja xxx\AppData\Roaming\WB.CFG
2014-11-21 07:53 - 2015-01-16 05:13 - 0235593 _____ () C:\Users\Anja xxx\AppData\Local\BTServer.log
2014-12-15 20:50 - 2014-12-15 20:50 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-10-08 10:56 - 2013-10-08 10:56 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-10-07 08:31 - 2013-10-07 08:31 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-10-07 08:31 - 2013-10-07 08:31 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-10-07 08:28 - 2013-10-07 08:28 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-10-07 08:30 - 2013-10-07 08:31 - 0000111 _____ () C:\ProgramData\{39337565-330E-4ab6-A9AE-AC81E0720B10}.log
2013-10-07 08:29 - 2013-10-07 08:29 - 0000032 _____ () C:\ProgramData\{551F492A-01B0-4DC4-866F-875EC4EDC0A8}.log
2013-10-07 08:27 - 2013-10-07 08:27 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-10-07 08:29 - 2013-10-07 08:30 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-10-07 08:27 - 2013-10-07 08:28 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-10-07 08:28 - 2013-10-07 08:28 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log
Some content of TEMP:
====================
C:\Users\Anja xxx\AppData\Local\Temp\obexpf.dll
C:\Users\Anja xxx\AppData\Local\Temp\Quarantine.exe
C:\Users\Anja xxx\AppData\Local\Temp\rnsetup0.exe
C:\Users\Anja xxx\AppData\Local\Temp\sqlite3.dll
C:\Users\Anja xxx\AppData\Local\Temp\stubhelper.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-12 13:50
==================== End Of Log ============================
|
|
19.01.2015, 10:53
| #10 |
| /// the machine /// TB-Ausbilder | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Fix durchgeführt?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.01.2015, 11:09
| #11 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Ich versuche es, aber er schreibt mir das er die Fixlist.txt nicht findet. Habe sie auf dem Deskop gespeichert. Gruß Anja |
|
21.01.2015, 15:49
| #12 |
| | Sicherheitswarnung zu meinem Internetzugang durch die TelekomCode:
ATTFilter # OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c6ba19ccf5d7194a8a64219db5b37533
# engine=22073
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-21 01:55:12
# local_time=2015-01-21 02:55:12 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 15700 12152831 0 0
# scanned=223211
# found=539
# cleaned=0
# scan_time=5241
sh=EDB6E1477166B32FE95301005E15A4EEB8BCF137 ft=1 fh=d29cf5027c7fc6c4 vn="Variante von MSIL/Adware.PullUpdate.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Browser\prompt.exe.vir"
sh=C0291FA8B4BF212D40322E152989120E5B309AD0 ft=1 fh=c71c001117fadf1b vn="Variante von Win32/Adware.MultiPlug.EG Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\topdeall\wdb8qXI8r4OBZK.dll.vir"
sh=9FF3042B3BC1AC3256934DE5CE162BFC3B591C06 ft=1 fh=7f32323435353b0c vn="Variante von Win64/Adware.MultiPlug.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\topdeall\wdb8qXI8r4OBZK.x64.dll.vir"
sh=F9F67A6E75A5053CB5FB436BBF762AC1ADDCEA51 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\CAZNd@v.org\content\bg.js.vir"
sh=382B389FE9DE0F54F1C3330FD1311B296E1FDA75 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\F@oxzo.net\content\bg.js.vir"
sh=EBE76420394A7545D6D0A97E126F946E2F8990F0 ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\g@9.co.uk\content\bg.js.vir"
sh=60B6CBD0C737FBC376708AB7361CD23471E6BC3D ft=0 fh=0000000000000000 vn="JS/Kryptik.ATB Trojaner" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\i@Mri86VdY.edu\content\bg.js.vir"
sh=BFA7F8511FF3D51E0606BC065F0C09902BB6E6FF ft=1 fh=c5b494ba53b97366 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\ProgramData\OqQeGinkA\dat\FTDKEgsb.dll"
sh=F3477DD97CF2D7579053B5DF73C184CBD99AC414 ft=1 fh=6ea5772ba487bdc4 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\ProgramData\OqQeGinkA\dat\hTXFJlWZJbc.dll"
sh=BFA7F8511FF3D51E0606BC065F0C09902BB6E6FF ft=1 fh=c5b494ba53b97366 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\Users\All Users\OqQeGinkA\dat\FTDKEgsb.dll"
sh=F3477DD97CF2D7579053B5DF73C184CBD99AC414 ft=1 fh=6ea5772ba487bdc4 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung" ac=I fn="C:\Users\All Users\OqQeGinkA\dat\hTXFJlWZJbc.dll"
sh=FDEC456186BB1B53CA715B0F45E56FD63E6EE18A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\007D60E9B48C26C7D91D0EDD09F9A493946615B5"
sh=98A4F1E41F2C433237B2B7A6A0469B75E283FCCF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0085085170513A939809A3D15C5A3DC1427BE5A0"
sh=B0E2EE664E4FAD7F30DDCB311B135692BC2D7982 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\00B4E21F8C86763BC1673709DFC75E9B3D70BFA2"
sh=F7347652C7B4F362F1424FD949E4D7ABA7D9E87B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\00C7EF19D9285CC4E500EB53EC7F4952E565B43C"
sh=8A774182B7011E730973EF8B3185C12BB99DE203 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\017B2F0A39638D191A0D477C1A743AF692C7D9BF"
sh=15454288325C40F98F56E89B601C45E7C9775D8B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\01CD67F5DC2D0D70E03FD878EDCE20A51DEA8D57"
sh=B904B6FFE3EB8E111C1EFFBAEEF3CDDEB057526C ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\029E128C491BA7001A6EC1677BFAED838B93A43E"
sh=E81FBC66871AE3685DB0A35F9EEC2351C1CE6D91 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\033E65593C9DF6D61453CFA2B01E2C6A7AFD5F04"
sh=18B72B4EB9C1774875F9F15D8C8CA19DD3A630BB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\039DB49338FFFACC1EE87FA2D2FA74C2B8F899D7"
sh=7E5B23021FD98736B8574DC667A36683CC3B54A0 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0515699FA709A0297EDF2BA68CABE2530C926146"
sh=732AC9C73ABBD079104C5274F215535EB0BCD0CE ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0543114483624B182A5100C11E366848E3FD4B19"
sh=3E2307C1602C36DC098BBC34217AE12893266B4C ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0557C9369D8268C6CD7406D02DB66D45D0D21F04"
sh=7EFECB1500ED6E220B14269ED9FED37A163D7854 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\068F8A0A098E02975CB452A2ED6C8CF6430C84EA"
sh=2C9B6E7D37C320780A5AB3B8D26096130F1E0A17 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\06BEE3A76DC4C60BF9147F8F0360EDEDE5486F9C"
sh=903F220174F45D0D62B4FB87CC22CAECDFCDC19B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\06D7F075623A4EF96DAD62FB89A72D2F3CCE0B51"
sh=8E297A0A85D4B282169972A3A28BD5A17F9BA7FA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\06E2811A415DA2418D2132D8DB931176977FE5CC"
sh=71BF1FA296982F1733CEF789955F173AD2E6D1D1 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0718201824309E616EBCB3FA6EE66B78A2D2B933"
sh=A0BFB52CD2A3D9266CD11E780C190BD3A1EDE66C ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\07AF1403C4C78742C6BE08309B214B6B1A8D8AC3"
sh=EF49E5B2DFCCB6A52E0B2F2BD559D4BDEC21DC60 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\088C0B54DE5E3FAA68072FE2DBF4623C9135F094"
sh=90BB31695B1B1287AA199AE38945444BAC46DC0F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\089DD1D801E118C3E34E824F14EC50618258358E"
sh=AEF55B297D6F2E321AA4094FB2B04389C5C302D1 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\09885047F658A478670D82441A0D426F7DEFAF1B"
sh=A13646DE857DFFFCE20AE930A09FFF40D5EF46AE ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\09F2471886641AFF09FD0A62015DDB5E202833AA"
sh=A24500BB498AABB2BEEE8B6FC0C70D9E5FA15FDC ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0A4AA7602CF3F3E8BA21CDE6B74860E69F4F17C3"
sh=EEE891C3BCB0DD11AD5BFEE0AE9CE4FDE5046E1E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0AAE8A582AB5A99E7D67C87C5FA491410CD41A77"
sh=932C23156B7BFAF6D95A64C847829A7D3566AA23 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0ACD4D559C2509DA92E3FB6F4DE5C5C4792030E4"
sh=24376607FCDB9548D82177C706AB4F38DAF256A3 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0AD64587B8BDD7D01E884990B642E324B0A6176B"
sh=F39B441795EF6AD4E119584D8CA23540704976B3 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0B19E9E6AD98F9DB70018D5F0554E6726FDC52E6"
sh=B2F1E1AE449B1BD5F93FA50EC3FC456F736CF126 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0D433B7D31C8778725F07F1CA10F71B6BC6EC014"
sh=017AD1FBA71D63738EB33D5373D792DA96640350 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0E1DCBA8491F3ED42D9D128CCD793050DA90B378"
sh=58B66FB56559CAF7E8D63B7CFD8F066B02C53CBD ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0E2ECF756D33D41D2B1F04D8E2B05CD0DEA98462"
sh=A537E5E7D98F2651E192611ABDF0668CA56DB692 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\0FA8F505545DAB373C7C2380973884EF9E8CFCDD"
sh=7897396F9AA07DC752E39647E076E38497A3FC46 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1059BBD9FE84E2DD91FDA2131FE63B4A7D40973E"
sh=FAD2D51C4DB6C459305A6257CEA1707C0FFDACA6 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\114B3DF2975055374A8DBBE29C46BEE834C8BAC0"
sh=6D2269841AC822BA0821D7070347F119613C405B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1198B828F9CF6CCDF925C42882ED59261267D656"
sh=289F0E8483A7558AD4F87573B0FE18BE5935E784 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\11A78ADF5D0F2D9ADA0A74C37F5D6279494F2357"
sh=25F5E7BB4ED0C2AA7202A397B88B39080626A14E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\11FA233D34069BDC8F281EC9BE63FD7AAF302D6F"
sh=6C875FCCA8AF81893E9AC9A19EE84FFAAE7BB903 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\12CBCF01D228372B2D3E4CA6F1B0108DA8B99C46"
sh=415BF199638E798038DEE7471E0C5E02830BA149 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\12EFFD6E04F8E776B9EE17F7CAB3440AB12A3B8F"
sh=42EE91C5370FEE66314404C0DD6E1261BCBD0C55 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1372D4AFA9F3911B788560B37A3B9EFD323DC471"
sh=377368CA6FE503EA96F76597041A3EE3619E88C6 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1458F7268A2464893CB7E3C62DBCB236676652D4"
sh=3CD9A6C7F7F82694DBFCBA0537B6B6E6159FB37A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\14BA69CB99820A6C73522D584E713EEFECA38BD6"
sh=D5600F2EFADBAD4AA09D4F745040716A02DEAF85 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\14EED579A61A82194A5DC1B6D684EBAF7CC01B1E"
sh=4C56AA1E737DEA62F8B5924C06A9AA0777937285 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\15B26218B316804C8F942389E662D8946C5F8186"
sh=3EB39FAC598A8EFC6514DC4256B9E4837F14C1E6 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\15E2F7922D9E5B27F0A1D5CF7ED2CD1385346EA5"
sh=D903D7D5C0CB90D30642AAD41622887818D65D4D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1611DA395455BA75E7D690AB2D613D099E6CE41C"
sh=E668EC9A89B105A211361992869B1EAB80B6E667 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1631B4E8EC37BA88BA88DE96EABF3CD031A20424"
sh=C28ED3C476684AE1ED2FD9C52B7881B55FA47BF8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\163466BC91C5D0BC01507E7CDE963A2E357008DA"
sh=B775700F9BB16198B4A304D88D1287C0A4E06834 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\164AAF1A99C501A00F3453695008321FC041F0EC"
sh=E3835D468DB3A6BB6C54D91AA2767A9DEF527894 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\16835B1454C59356A732A229E59C009943FDF1F3"
sh=44DF2DE905F87EB8AF8C1F260ED2BDE5AF19B085 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\16AA0515DE50661963708F53618033498D218103"
sh=B2ECA129B47AB6BE926727D66646786E0B7BF0C5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\16B9DB5998CE1B983F2816F71C9E1A768B570453"
Code:
ATTFilter sh=7E42EB512F78FEFE695BDA9178778324FC08760D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\177D8EBFE7DE817AC0D53D64E4E8E2F1F591D732"
sh=AE47D03E4616FF32B65D1C146B2C9CDF8F36478B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\17FDEDD43CD366F0C973E46C473996A6C719BA16"
sh=7F3104AFD9A171880E640129068979029B5213AA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1800E5B6B4630AAD2CB92354B63435DEBA8D949E"
sh=3E46EA68B12B04583E31B9A63A8D980B56CFE265 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\18125276954D2AEC4346C5D8A60305D9CF4020CD"
sh=5F35F4679EAC72018DE2B7E18FAC36969784D15B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\183093EC8962F9AA055266680526D39AC13270B9"
sh=7E87083F7CE417C20E35F1C7B4D83DA900F0B119 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\19FFB305462E597736674B30CF89F59E7415DA83"
sh=8D5871EF8E32DC92B455B084319315776C547E3D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1A3E21AFCDC416F10F9A9BC13FE43EB62F08F7E4"
sh=243B9566D8C1FA0D84F1F3947B709E743CA41A45 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1A91631559C7EBF7B4A1261E30A9A17CCE0D4F74"
sh=E5642D4F2238CF4D837DAE0C6906709BBE323D33 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1B475B255401316522F19A3FFC360D598EFEC40B"
sh=1660F8525908C2942EF0EF8F59EB10649CC19A51 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1B88B261FB8E7828422C0E2B6F2FDBD949DE7C3F"
sh=9AEF572D2D69149679CA89FC6133ED9B1DFC34EF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1CC65D77559F791000048886392BC519E85B68AC"
sh=DC740617B99919594E62C27F13C2791326A6240F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1D0A4A446A6F83BEA4F137D01C69E2584B1C2967"
sh=CE9AEE635E4EEFF096831AE159B89C99A6057F30 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1DDB3E9EAF83CBF59A929A675CC34805D237DFED"
sh=C68F40FA38C1B5A84C76BB142599A00C03BF6F56 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1E5B1D6DFF22104C03BA01E7C176604235F4D7E3"
sh=13DFDAC6CF85A0ED124B583DBD00B85A5B90F4BA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1EB62DBF5BB3A19D8CF21EF602E7BFFB672F4B76"
sh=25061F89FC3AD2D3E6B6277CD9EEEC5759C8306A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\1F356595D24D5B9C7D37B305285320B8F18F3B39"
sh=F37E90469901466732132052390574C4CC014A6B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\212778B161E14DB5CE6DFDA4CF7549F942584C0F"
sh=2ED2D8248A29F1F2A6BA0D9A6AF445DDE5EA8F88 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2171B1EBAD13FE4E414E3DA7DA1611295EABA4A7"
sh=2ECA4C795EE9A9135DD209663D0E56974C988195 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\21FF4FAD5162A1E6B9F8FD8B817A48D2D0C301CD"
sh=1311DFB529C44044C0B08AE5E9EC7B7CBE565DD5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2252EAF3D2533760D6DCA5ABE2E4C57037CFA0D9"
sh=F3CB33FA193DB39CDDD41A890373F4E114068F0B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2268BAA5A24CA21C1DB05C6543676D27673DABB5"
sh=33D7BB371B4FEE8899F0CCB0FC9EAA6C30386C66 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\234855CB41D7ACA4F993F577A7431D93EA80FEF2"
sh=EE7B4E8638F7231799D2BBB5785EB0AED2C8C00D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\23A1ADF0A1C31072F384048AAEAE8B9719F0604A"
sh=3EA3695513051C839A6D56ABAFE843C1F8D65D48 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\23CA7DEE2147102782466345682469E5280678AE"
sh=30B93917EE513A512B8F385FEFC9BA21E8B5EEC8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2433A44A7E5FFFE446FB4E1EA0C0542938F63F07"
sh=B721E83F317965CBD7E2AFBAE45BA3FAEF738146 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\246635FDCADC4AB47DE0C09D3744C221C449CB6D"
sh=27E5FA35EECB3AF59DFE867494C3F1AA59606B98 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\24CDD1C49BA8368395223669044FD2FBB33ACCB5"
sh=75FAC7375BE2B9852253A7ACC7C40A8F5A07A149 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\24DD106177566DE2CD967E965AF6D799F2A5204A"
sh=532AD51B4D25DD9CF48F47076B7F9882D59B6EE8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\25E20DA040A1200DB4F7F1126C2E0C94C4BE7E4C"
sh=8E9BC9275710E53E2BB75A0C0B54C9D8ACBF2369 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\26E9837EFF80B958E0E604C7D9242A2E535CAA92"
sh=D5713081B68C8F88CDF8F272E5A92A38CC94016C ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2757565D002031D58D3F846CD72D3ED070499C2B"
sh=9C47BC457163209E49F50E4C44DE04B073C356A9 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2772057B937B8E233B2B322D4BAAF9A758D53B32"
sh=8A7E028DD1700B1E4F0D2C9AC1F7D0EB37CE10D2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\277273E799B030CBD48C5473C80D7F4D7FEB8E51"
sh=8C4AC9C1CF32B06310FC4BECE09993351015B756 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2798BC1E89720C2E22557BDB898ED45B4E563606"
sh=FABE282AC538BF18E42C6B0AC399CE4F39BCDCF2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\280B5A5C5948A08CD59A84939B9FFAFFC174B86B"
sh=991A0FE1C9DA8361A28219757A6EB3467A281B87 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\283555C6731878B25C12A26A31A0AD9CC375938A"
sh=31238BDDD32E159E7BE4B6438F6438ACC03B6A93 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\286E248C07447012F1509C04FC17E165AB1D3971"
sh=3F654458F030934301E8F54BB24B981F8ABF9E3F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\28916F1E357EA229C87058EEADAF32935F299D9C"
sh=45F874B3B1BFEEE9E4AFEF62752E8D3FB0008D78 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\292C4CCEE1AFFC6C32E04AE6FCA871F2E1256AE5"
sh=24F11262057E77FAEAFD6F6D84CC832865740F2E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\297FC29F31B1457BD20A6F36A58C384C7C801602"
sh=0E956A98F7899FF638A517EFE0D222C4B7229540 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\29A30A0AA88C7DCC3D92CDE51E97FB6049F5E1A2"
sh=2CA9AC15D98F0B5CAC8FA8A2B6184B75EB448FAE ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\29F3DC9D328C1C4FC89B7476F4A9036EFDD14798"
sh=F862E6D3ABA8D23BA074951700DEE980B786CCF1 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2A7EC9506517C59961F0AF5E5487CF14A7B35721"
sh=0AA579B30470BF5660CD073718D2A3FA137A63C8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2ABAD093E31F64E1FC3EF2B2BED5CC40BD001B0F"
sh=5DA90CAED7DF8AFB4FEFE67DA8620F7861A20D84 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2AD770EC2277F058B4A9D5B960CFD6532795938E"
sh=63D571E87C9BD43A4E333633A589A25E744AA136 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2BAD84A1E31E77744475E4BA4C646D12316EE00D"
sh=44DE51139C8984FFD2BB4B292BE1B252FDE36B7D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2BDF0406B29FC6FC20400ED30B3151C18BC98649"
sh=55DE27BF328904066D25B779BE0B08445B233FB0 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2CA2D9436D084C7EB48A0CF09505AC1CD708F5B2"
sh=123A523D939297F387CE257543FA57185E6DCD5A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2CCDA214546F6441ED3EE082D3BAF08B1E131AD6"
sh=78D131FE5153A2C2CA3214119DDB2C8854441BCA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2D6BD9E817ADEC1C2718E3CE2E1950DFF3C0CF80"
sh=17ACFBD90BE054DDAB29E122255A0A8AE06EA9ED ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2D8B4B6F0F19D96459BCFC31391A858526E37610"
sh=B581C243227932C9602EF49A38683066341F33BE ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2D960AB963EC3634866A1627E6411F4A45A85BBB"
sh=0632DE93006DE6BFF2286745B8A6869222A79BAD ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2DEEA83C1D22B2FE9D089C12E52BD4DBFD7AB78E"
sh=958CF55EC36DD03C61E77C26C023285933384D04 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2E456B6092024CAD83FF1490B6B28A8D6083D2AF"
sh=AAAF37605AED5A9582694C3891659EF82850495F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2EB1DB62858E8944341ECE6B87F760C49B55500B"
sh=5CAEBF05C839D1055A0D03D8DB5789CBB3A601C2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\2FEBBAFA2D60024768EEC8F1833EC5360A722D4D"
sh=A9306C31018C7C1D64D6C9AEF28C6561914AFDEC ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\313D0F957A9D511427ED06538232E6834AA64D2C"
sh=F80DDD605D882EE5AEED593CBFFFF9580F9FE272 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3167B295CE6572D6F798EFBACB6D66E64716B292"
sh=BB0D73DCE8D07FF6F96F87F299C3CF35899C63ED ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\33DBA4A8BE1423DAE6B5F659E2C7AF110AAFE297"
sh=F51C549A0DD353379762E48B9F4F33525EA885DC ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\349691DC3E0A9758AC5821D9DF92E849E40B56B3"
sh=1B8A17C739E0FFD625020D67181BCE2F1D4D2176 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\34CF8CA844BBBB8ABDD4DD16F93865235FBEC447"
sh=2AC336B8A052E85EF2C9ED9A19C461E2961AFD1D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\35018E0C29C7A76D77A771B1EA77C7EEFC8C495D"
sh=4081B7BA217F445EA1A661F8A9C95E70C4556959 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\357FC1FB72BC5F7BB7623BA761A1947E17EF8CAB"
sh=2385A26F82BB55A25D2774FC6C4906FAE1B72670 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\36583CAEBC9345EDA6CC07BDD7B309B41BEBB838"
sh=7C0B5003164E19FB255AAA27842AD69FF7FEDAAB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3735C20CF4FE71D3E0F3AACC05280D136F4666DB"
sh=64D97BF278574B8DD0BBF969CC0E1771E55546AB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\375C1049475B3C44EFD1B427FDEE9BF92DE4C9FE"
sh=0F50314675C7466240052916224A53500EB73A3A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\389270ABE4DF866E69A9DD5102DD274F71268EF2"
sh=E3E55B8ADCB3B84900488B9ACF5964E50B50BBAB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\39134B593DD6F8FDFD34A0D2544F494B0F8B3D3A"
sh=2E20CD526A94F0FCC2E923E60A5E42DD5BDFDC73 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\393D84E62EECA3265F7A5957C1CC559A75999E39"
sh=306FA48FD27D120013F315B80E6ECAC2F222E1E6 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3975BCFCF5E2DC8A4ABBAF15A9E2B416725773A0"
sh=640106D76DFFE961F8BCB9CCB77B82052D848A17 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\397A795D2C962587FB418A69ECA21B62B4D477EE"
sh=CDEC201639BE2BA644AD62F3B96226AC80A936FF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3A1BC7719D596BF13F6870EB371AC56A56FFFE5E"
sh=E13776A803AF81F9466595A97C1AEDB7EAF307E6 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3A88770CA137D9A40E0F34497A2AD5351D4C1B4E"
sh=E3C019B4174572179F949C96571B8FBAAE942BBF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3AE0B18CE9FB18B4BEC91840A0466D63B882C2EF"
sh=A5920D7EAB1BFA164C519E934B6AD92E421CE349 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3AEEA26B79CF092AF3D38C214647EA007F736132"
sh=003E00A3F5C47DC3C3A13955CEB79CFAF1CDB1AF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3B846155C756098D0F267002A546957DCFBD0988"
sh=9579CCAA69DE2E3FBC29E3A9FF936229DBBDC14B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3BA547B0D2F9B9F8C38EC9573531E856A97ED25E"
sh=9A94B69B4D2E2AEA10FBAFBD0AE6AC08AAD5CB74 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3BC70605261A2BF29C447C5D036A14D4F2FCA2E1"
sh=2BD8B4DC88D12483B9C56C5993E1B4391A917C5E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3CC06073C5016D0AE4E1E5477C03B7D3E21E93F8"
sh=E49C1C36B9432743DF90B6A053F57652CA690FB5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3CC09B87F52C2D046400C610B97EA92896BA858D"
sh=8E73C3CF9CF7600021EDB9889199CE0C014A01C0 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3D7D2BF1F0D78789B3E3AAF4CF0025766CF61656"
sh=5C95EA342BB9BE0C17383C9EB69EA6A5DAEF1EC3 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3DF810AD61EB6529C08EDF2E5FEDD48C0453313D"
sh=72A8E0A5AA9F795D4A0DA11D8DAA3E8C2D251E1B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\3F06EFA0F75B3FE76DE02EA23A36DF6804BAB10E"
sh=CADCFED7A7E1CBEFF67B3C5F88BABD7F80369BFE ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\41A65DE6852BC46A5711DAB1C0A42EE812754521"
sh=35CE0112CD9D6AA64BDF154BE066ADA3913B695B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\41DD7E9161699E7935AFDB800714DC0E51E77DBA"
sh=483024F73AB6CE0881AB1783D545867A35F79510 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\421800C366C3DF89AFD9866044B0F31570D96574"
sh=99525592670B03E44BC52704863399A01C4BD1EB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\427BCD54F15768282C36D7EBBA7BBB11B7493DA4"
sh=B43A316B67A3E4EAFAE0E035ED34DDC7B2E1BEA8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\42C9EF4F3FEC65461D5C538AAEEFD6FD1A2BDE37"
sh=EC0A644E7F0C12AFD82F4E91D3C34472D695516B ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\43800A70CB97360969294EE7E283866E7EF0F910"
sh=1E558EA59A02AA4C8242812BC4B636CAF6E05BEB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4463F650A0CCA370753318F31E74FB77A82F8CA8"
sh=149A8A0E1FC6944BAA630996AB4D02DBC8FFE737 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\447FFF68764C86B14877F9C0C3C79516D6D482D2"
sh=5AA686371115A0532E79931A31E7AC51587AD796 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\457C568A8F730A0C1802A26CC564D315FD87F6EC"
sh=E396F31FCE2E8380DC99AF6564B067A8F187E361 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\45C35B4611B43F10DCC8A9A5F37655EA11B4561A"
sh=CDD27A5562015D22F8EB5EC9BA0D6E7E57BBAA74 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\45D78202B2FCD70BD7D39442AA15CC01859E7FC3"
sh=2CA5758A0D97EB962160FA4DA0D4063369FEF060 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\461944333D90432B7C5065DA191146F2ACDCD8CC"
sh=16F9514E53C6BA6321A6540D4B4BA7CD4D9FB62E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\463D8F2F464FDBA6F84D3103335C74AB5EA8F344"
sh=269CAAAFB6D877E7498C45F0E3FD5332321CF78E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\472A5F5242F9377120A2D96990E56C99F421C129"
sh=D29774E03F9D8BD098F19190AA661A395D5F443D ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\47FB6004E5A2D35BB4E80C384B93744FAC7E6915"
sh=7F3625E7BBBBA77BCCE919E8002A8F3B26BE1AC3 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4A1659F2A5C0478DBA39166112B8DC7C03724B1C"
sh=1E225D706EB83EF25F822668D05C164E4EC2602F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4BB842D4B36056FEFAE1E7A0F62AC18C2A9A22CC"
sh=438CC55747370BBC7D67022837603B6892395F54 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4BCA982F9D278F3E6A68AD16A319A386F4BEC9CE"
sh=E88CE4E7E387B1AB879331BA76A2597705B94F72 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4BD5DE24072EC982E90757C3B70DD6C3306B2731"
sh=0D93DC60AE3F3F8C1C93A0FA8ED94CFED4D1BFC7 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4CD1708658AD2E478BAE80996E47F2B712050EE6"
sh=53B720538C0AD4B9FC8C4403CD8A0734ED8794FF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4CEDE5BD84C5A3CE5D015F42FFFE283B94A80B8D"
sh=A4BC93CA8BFC1EB9E496D76E9675D927A08B75B5 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4D60620EF7111ED1F73355EF8A967931EFF64595"
sh=ED361305A112BBB3805A73E5319EFC9197E89BC0 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4E28938708801758522D2C2676B0E3D99D9A73FA"
sh=357F6217C657126BB0C38B501BBBCAACABE0634E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4E6CFB3F400EDE824552529F9656ABE8AE8E3293"
sh=5C18A53D0FB9105CEFFBD6108714DD0FAFE43C35 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4EA24238863C58A4C912CA985ED0506106C9FCE0"
sh=CE1B3A1BB47C0D8A9E8D1298AE2C136E4C3E8E72 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4ED17B5336C488B6CEC54414304887250919BF53"
sh=98102F4944C4E2F4B1DE33493B70E7AEF55CF08F ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4EE04272FF07B8370035CA639D7C636E74005324"
sh=5B4411AC13A34E8D932BBD3302A9DF660B6E30E7 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4FA6F6ABDD909F7E2068F5E6E4AB9887FC15E124"
sh=91EC861EBEB146E2B01345320B1A7C4266139935 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\4FF2C806AD0F6652CEDCBA29651E7A81F3E35F47"
sh=51BA357DB75770B2EE602A4B6016650C05B70EAA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\50B93E9983577F268864CAE839837551CA6446BD"
sh=2082254CE29ECEEC623D3C2A0EDE73D7B5580F24 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\50C799347F1015DAE961ADEE0231EA898E5676D2"
sh=F6D79D02AC069772481115DDE8ABED90D347138E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\527DB0BCCD97C366187855DBB6A92F3E84884C99"
sh=8B50DC65D9447AD9542644412156B35523F92611 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\52E1E6D6A1D1C777F720FC43167FC5636A17EE12"
sh=C67950B95246EACEF9A9358E0C0CDAB355491744 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\530BF413AB9B4D3E563494176BEC09137387FBD6"
sh=5ED0A961DF5EDBEFC2143131232F582B16A19ADC ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\55BC9CA52C39515B7C46349CA0B7CEF61D48B98F"
sh=127C588FD8F268B3FF92F83296DB519F67E9E149 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\562882AC2646640C04065E59E821C813E0E57EF0"
sh=081EA52C8FFB14C0EB385AFE0F2283A857183253 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5644FC42DFFE15DA8844719271683410A6585492"
sh=D5C8923AE72CFD69CAD41F0667EB616E83FA3276 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\567261101B2C6F4922F86F96179B04BB5E6DF41B"
sh=008B59AF4C0F1D94BFCC3B4971DE704664F187FF ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5687421A78D2F1560DFC8A0FEC1812B65375A9BD"
sh=DD282F4DF37629450766DDD8FC05B46AB9D7AD10 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\57487B6FC77AF3918F346052F39D0856E3352D6B"
sh=151C4E322D8AB9854DA45DFF005B613EC9D62241 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\58407B9359310A806522C56FD07143835C99B555"
sh=9A81C31F5FE702EE7A4796FC8AC253769E6FBF23 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\59D457912B45466DDCAB8217431E5454EB9D5284"
sh=B3429BC284D6D699723E5E9B376540CD2A4D85C0 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5A1C95AEB2797EFEAD8D545474A45D5A395F9A6B"
sh=9C0FE0B3C5EB6FDFBAEC0267B581687F8A2B4127 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5A9A0F013E4C573945BD865273EEE5ACE3A2756B"
sh=AA6C94A5352E4F539605E8C39F3491DFDF4602F8 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5A9F315FBE50D3F9EAF54535750023694416C55F"
sh=6CC44C7ADBB9551D10848AF4F54C5DCD6062AD4E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5AD901C8BBD1322C479E21AB711989838E4AB6AB"
sh=79085A989B19DC9206CF45B59F9F45F69F20300E ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5B3C8C9325E1D242C17792D52A3365EC43336521"
sh=836C2E609EA9B0F2E45D268BB144C9C57960787A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5C13C632985935AFDFD480DF60C10FEECB3B08E4"
sh=08A48EEC75E61C3E1214A96964D3C8C6D774AEC2 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5C32E7D59AD4E570E3C7BD6A3162A0DB9CD67C73"
sh=D2D3E7032B345D9D2024F63589A895C812FE3E10 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5C8F17D604B19824007C1FE3AFD947BE27FF49B3"
sh=EB0C0A10C866A61BA3C7AF70C3E694E7B6D86014 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5D1B9B8AD7C9E1818F3FC39E996CE396A6E8F55F"
sh=11CFFABD4D930F478216B7DE7CE7F3B4E7B135DB ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5D521E87A47F64A78703E149670D398DDCBB951F"
sh=66BE44B5482C43F4660037FC095E38AE9FF83DBA ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5D52FAED9DB01AB1E6D5AFAEF79DD4ADD5E461E0"
sh=55D7AEDDDF9F0A2116AECA797B4E9055DE89E500 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5DA2D3E2E8A893C33C7981753B0CF6173CD30C0D"
sh=4AF70D5903C1C892000CB2FFFFC16F93FD3FCB7A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5DB3653A3C9BCC133F39786CF79DE68AA90F3129"
sh=9A0277A5AF939611E6536E8AC00DF118D7F04869 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5DDD2C8E60D23234314EE8BC6A7C323AD149F720"
sh=22C5800BC12C1C5410C700E6841F7E837C45358C ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5E1DA627EB2DAAC16EF36F6938A36A7559DE226A"
sh=782764BE26D1AD964F3C5671AFFD6858BDB0766A ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5E28D5DC732762B269A3A668908C45C010E31973"
sh=B7B9C038A5CD6517672F0EA89361FA8B97920385 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen Virus" ac=I fn="C:\Users\Nick\AppData\Local\Mozilla\Firefox\Profiles\1fes414j.default\cache2\entries\5ECE2AE0E012957AC943ED1CB845CEF500FB2078"
|
|
23.01.2015, 06:03
| #13 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Moin schrauber, Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Nick at 2015-01-23 05:55:37 Run:3
Running from C:\Users\Nick\Downloads
Loaded Profiles: UpdatusUser & Nick (Available profiles: UpdatusUser & Nick)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKLM-x32\...\Run: [mbot_de_349] => [X]
HKLM-x32\...\Run: [rec_de_2] => [X]
IFEO\ContentExplorer.exe: [Debugger] TaskList.exe
IFEO\internetenhancer.exe: [Debugger] TaskList.exe
IFEO\internetenhancerservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancer.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerApp.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerAppservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancerservice.exe: [Debugger] TaskList.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52754;https=127.0.0.1:52754
ProxyServer: [S-1-5-21-4218249386-1005423115-940720447-1002] => http=127.0.0.1:58526;https=127.0.0.1:58526
S2 0001121418376984mcinstcleanup; C:\Windows\TEMP\000112~1.EXE -cleanup -nolog [X]
S2 FCUUjqwoLq; "C:\ProgramData\OqQeGinkA\FCUUjqwoLq.exe" [X]
S2 InfigoOperator; C:\Program Files (x86)\Infigo\InfigoOperator.exe [X]
2015-01-20 19:16 - 2015-01-20 19:16 - 00000000 ____D () C:\Program Files (x86)\shopndorop
2015-01-20 19:09 - 2015-01-20 19:09 - 00000000 ____D () C:\Program Files (x86)\leisss2pay
2015-01-20 19:05 - 2015-01-20 19:05 - 00000000 ____D () C:\Program Files (x86)\FineDealSSoft
2015-01-20 19:04 - 2015-01-20 19:04 - 00000000 ____D () C:\Program Files (x86)\DissccountLocator
2015-01-20 19:02 - 2015-01-20 19:02 - 00000000 ____D () C:\Program Files (x86)\DeallsFiNdeRRPro
Emptytemp:
*****************
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mbot_de_349 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\rec_de_2 => value deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ContentExplorer.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\internetenhancer.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\internetenhancerservice.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wajaminternetenhancer.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WajamInternetEnhancerApp.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WajamInternetEnhancerAppservice.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wajaminternetenhancerservice.exe" => Key deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk => Moved successfully.
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No File) not found.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-21-4218249386-1005423115-940720447-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
0001121418376984mcinstcleanup => Service deleted successfully.
FCUUjqwoLq => Service deleted successfully.
InfigoOperator => Service deleted successfully.
C:\Program Files (x86)\shopndorop => Moved successfully.
C:\Program Files (x86)\leisss2pay => Moved successfully.
C:\Program Files (x86)\FineDealSSoft => Moved successfully.
C:\Program Files (x86)\DissccountLocator => Moved successfully.
C:\Program Files (x86)\DeallsFiNdeRRPro => Moved successfully.
EmptyTemp: => Removed 157.6 MB temporary data.
The system needed a reboot.
==== End of Fixlog 05:55:44 ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015 Ran by Nick (administrator) on NICK on 23-01-2015 05:58:04 Running from C:\Users\Nick\Downloads Loaded Profiles: Nick (Available profiles: UpdatusUser & Nick) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Intel Corporation) C:\Windows\System32\igfxTray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe () C:\Users\Nick\AppData\Local\3c77ea22-6f8d-4996-b236-dc6fe42eecea\sysad.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe (Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerWinMonitor.exe () C:\Program Files (x86)\Acer\abDocs\abDocsDllLoaderMonitor.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-18] (Realtek Semiconductor) HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [62208 2014-12-19] (Acer Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM-x32\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe [90880 2014-12-19] () HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-02-25] ( (Atheros Communications)) HKLM\...\Policies\Explorer: [NoFolderOptions] 0 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-4218249386-1005423115-940720447-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-4218249386-1005423115-940720447-1002\...\Run: [Infigo] => C:\Program Files (x86)\Infigo\Infigo.exe onrun ShellIconOverlayIdentifiers: [ACloudSyncedRF] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated) ShellIconOverlayIdentifiers: [ACloudSyncedSF] -> {5D5F18B7-D59B-4B18-A3E9-0A4BDCCCB699} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated) ShellIconOverlayIdentifiers: [ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated) ShellIconOverlayIdentifiers: [ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll (Acer Incorporated) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1 SearchScopes: HKLM-x32 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1 SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-4218249386-1005423115-940720447-1002 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = SearchScopes: HKU\S-1-5-21-4218249386-1005423115-940720447-1002 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = BHO: CinPlus-1.0cV15.12 -> {11111111-1111-1111-1111-110611321185} -> C:\Program Files (x86)\CinPlus-1.0cV15.12\CinPlus-1.0cV15.12-bho64.dll No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default FF NewTab: FF SelectedSearchEngine: FF Keyword.URL: FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Extension: 9b9d2aaaae264447a7a1633a32b19ddd - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\{9b9d2aaa-ae26-4447-a7a1-633a32b19ddd} [2014-12-22] FF Extension: Locale Switcher - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2014-11-27] FF Extension: BrowseStudio 1.0.1 - C:\Users\Nick\AppData\Roaming\Mozilla\Firefox\Profiles\1fes414j.default\Extensions\{b4a69fee-d6ff-4bda-bdd9-f5dbbe57aa69}.xpi [2014-11-27] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-02-25] (Windows (R) Win 7 DDK provider) R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2713856 2014-12-19] (Acer Incorporated) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573032 2014-06-12] (Acer Incorporated) S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-18] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation) R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [466664 2014-06-10] (Acer Incorporate) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] () R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-06-26] (Acer Incorporate) S3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3888640 2014-02-14] (Qualcomm Atheros Communications, Inc.) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-02-25] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation) R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-03] (Intel Corporation) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-23] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated) R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [466136 2014-01-14] (Realsil Semiconductor Corporation) R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [42224 2014-02-19] (Synaptics Incorporated) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) S1 wpnfd_1_10_0_1; system32\drivers\wpnfd_1_10_0_1.sys [X] S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-23 05:58 - 2015-01-23 05:58 - 00014339 _____ () C:\Users\Nick\Downloads\FRST.txt 2015-01-21 20:37 - 2015-01-21 20:37 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-01-21 20:37 - 2015-01-21 20:37 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-01-21 20:37 - 2015-01-21 20:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-21 20:37 - 2015-01-21 20:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-21 15:27 - 2015-01-21 15:28 - 00033155 _____ () C:\Users\Nick\Downloads\Addition.txt 2015-01-21 15:25 - 2015-01-21 15:25 - 00852504 _____ () C:\Users\Nick\Downloads\SecurityCheck.exe 2015-01-21 13:22 - 2015-01-21 13:22 - 02347384 _____ (ESET) C:\Users\Nick\Downloads\esetsmartinstaller_deu(1).exe 2015-01-21 11:57 - 2015-01-21 11:57 - 00000000 ____D () C:\Program Files (x86)\ESET 2015-01-21 11:55 - 2015-01-21 11:56 - 02347384 _____ (ESET) C:\Users\Nick\Downloads\esetsmartinstaller_deu.exe 2015-01-21 11:42 - 2015-01-21 20:45 - 00000000 ____D () C:\Users\Nick\Desktop\Neuer Ordner 2015-01-20 20:46 - 2015-01-20 20:46 - 00000000 ____D () C:\Windows\ERUNT 2015-01-20 20:34 - 2015-01-20 20:42 - 00000000 ____D () C:\AdwCleaner 2015-01-20 20:16 - 2015-01-20 20:16 - 00003112 _____ () C:\Windows\System32\Tasks\{5EE2478D-F235-4D61-88B7-D5096E360D17} 2015-01-20 19:57 - 2015-01-23 05:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-20 19:57 - 2015-01-20 19:57 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-20 19:57 - 2015-01-20 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-20 19:56 - 2015-01-20 19:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-20 19:56 - 2015-01-20 19:56 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-20 19:56 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-20 19:56 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-01-20 19:56 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-01-20 19:54 - 2015-01-20 19:55 - 01707939 _____ (Thisisu) C:\Users\Nick\Downloads\JRT.exe 2015-01-20 19:53 - 2015-01-20 19:56 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Nick\Downloads\mbam-setup-2.0.4.1028.exe 2015-01-20 19:53 - 2015-01-20 19:54 - 02186752 _____ () C:\Users\Nick\Downloads\AdwCleaner_4.108.exe 2015-01-20 18:56 - 2015-01-20 18:56 - 00001284 _____ () C:\Users\Nick\Desktop\Revo Uninstaller.lnk 2015-01-20 18:56 - 2015-01-20 18:56 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-01-20 18:55 - 2015-01-20 18:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Nick\Downloads\revosetup95.exe 2015-01-19 22:20 - 2015-01-19 22:20 - 00000865 _____ () C:\Users\Nick\Desktop\Downloads - Verknüpfung.lnk 2015-01-19 21:47 - 2015-01-19 21:52 - 00862496 _____ (CoinisRevShare) C:\Users\Nick\Downloads\adobe_flash_setup.exe 2015-01-19 21:46 - 2015-01-19 21:47 - 02126848 _____ (Farbar) C:\Users\Nick\Downloads\FRST64.exe 2015-01-19 21:44 - 2015-01-19 21:44 - 00050477 _____ () C:\Users\Nick\Downloads\Defogger.exe 2015-01-19 21:35 - 2015-01-19 21:35 - 00001969 _____ () C:\Users\Public\Desktop\abDocs.lnk 2015-01-19 09:25 - 2015-01-19 09:25 - 00003334 _____ () C:\Windows\System32\Tasks\AcerCloud 2015-01-19 09:25 - 2015-01-19 09:25 - 00002030 _____ () C:\Users\Public\Desktop\Acer Portal.lnk 2015-01-19 09:17 - 2015-01-19 09:17 - 00002001 _____ () C:\Users\Public\Desktop\abMedia.lnk 2015-01-18 06:54 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-01-18 06:49 - 2015-01-18 06:49 - 00003754 _____ () C:\Windows\System32\Tasks\RunTool 2015-01-18 06:49 - 2015-01-18 06:49 - 00000000 ____D () C:\Users\Nick\AppData\Local\3c77ea22-6f8d-4996-b236-dc6fe42eecea 2015-01-18 06:48 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-01-18 06:48 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe 2015-01-18 06:48 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe 2015-01-18 06:48 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2015-01-18 06:48 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe 2015-01-18 06:48 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe 2015-01-18 06:48 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2015-01-18 06:48 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2015-01-18 06:48 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2015-01-18 06:48 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2015-01-18 06:48 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe 2015-01-18 06:48 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe 2015-01-18 06:48 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2015-01-18 06:48 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2015-01-18 06:48 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2015-01-18 06:48 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll 2015-01-18 06:48 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll 2015-01-18 06:48 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-01-18 06:45 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-18 06:45 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-18 06:45 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys 2015-01-18 06:45 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-18 06:44 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2015-01-18 06:44 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-18 06:44 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2015-01-18 06:44 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-16 21:01 - 2015-01-23 05:58 - 00000000 ____D () C:\FRST 2015-01-16 21:00 - 2015-01-16 21:00 - 00000000 _____ () C:\Users\Nick\defogger_reenable 2015-01-16 14:36 - 2015-01-16 14:36 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-15 22:24 - 2015-01-15 22:24 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\AVG 2015-01-15 22:23 - 2015-01-15 22:23 - 00000000 ____D () C:\Users\Nick\AppData\Local\Avg 2015-01-15 22:22 - 2015-01-15 22:24 - 00000000 ____D () C:\ProgramData\AVG 2015-01-15 15:03 - 2015-01-15 15:03 - 00000000 _____ () C:\autoexec.bat 2015-01-15 15:00 - 2015-01-15 15:01 - 00000000 ____D () C:\sh4ldr 2015-01-15 14:39 - 2015-01-15 14:39 - 00000000 ____D () C:\Program Files\Enigma Software Group 2015-01-15 14:06 - 2015-01-15 14:06 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\AVG2015 2015-01-15 14:05 - 2015-01-15 14:05 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\TuneUp Software 2015-01-15 14:04 - 2015-01-17 15:22 - 00000000 ____D () C:\ProgramData\AVG2015 2015-01-15 14:04 - 2015-01-15 14:04 - 00000000 ___HD () C:\$AVG 2015-01-15 14:03 - 2015-01-17 19:17 - 00000000 ____D () C:\Program Files (x86)\AVG 2015-01-15 14:02 - 2015-01-17 19:19 - 00000000 ____D () C:\ProgramData\MFAData 2015-01-15 14:02 - 2015-01-15 14:49 - 00000000 ____D () C:\Users\Nick\AppData\Local\Avg2015 2015-01-15 14:02 - 2015-01-15 14:02 - 00000000 ____D () C:\Users\Nick\AppData\Local\MFAData 2015-01-03 17:58 - 2015-01-03 17:58 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\WB Games 2015-01-03 17:38 - 2015-01-17 19:18 - 00000000 ____D () C:\Program Files (x86)\WB Games 2015-01-03 17:11 - 2015-01-03 17:11 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Rovio 2015-01-03 17:10 - 2015-01-17 19:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio 2015-01-03 17:10 - 2015-01-17 19:18 - 00000000 ____D () C:\Program Files (x86)\Rovio 2015-01-03 17:10 - 2015-01-03 17:10 - 00001094 _____ () C:\Users\Public\Desktop\Bad Piggies.lnk 2014-12-24 20:24 - 2014-12-24 20:24 - 00001270 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk 2014-12-24 20:24 - 2014-12-24 20:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2014-12-24 19:42 - 2015-01-17 19:18 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft 2014-12-24 18:25 - 2014-12-24 18:25 - 00000000 ____D () C:\Users\Nick\AppData\Local\Blizzard Entertainment 2014-12-24 18:24 - 2015-01-21 19:29 - 00000000 ____D () C:\Users\Nick\AppData\Local\Battle.net 2014-12-24 18:24 - 2015-01-17 19:44 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Battle.net 2014-12-24 18:24 - 2015-01-17 19:17 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-12-24 18:24 - 2014-12-24 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2014-12-24 18:24 - 2014-12-24 18:24 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-23 05:57 - 2014-11-27 18:57 - 00000000 ____D () C:\Users\Nick\OneDrive 2015-01-23 05:56 - 2014-12-05 08:31 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2015-01-23 05:56 - 2014-08-31 20:16 - 01519090 _____ () C:\Windows\WindowsUpdate.log 2015-01-23 05:56 - 2014-03-18 10:54 - 00041654 _____ () C:\Windows\PFRO.log 2015-01-23 05:56 - 2013-08-22 15:46 - 00023391 _____ () C:\Windows\setupact.log 2015-01-23 05:56 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-23 05:56 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2015-01-23 05:55 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\GroupPolicy 2015-01-23 05:51 - 2014-11-27 18:59 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{21898380-5491-4791-BB9B-793C6C26EEF0} 2015-01-23 05:49 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-01-23 05:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2015-01-22 19:49 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-01-21 20:49 - 2014-11-27 18:55 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4218249386-1005423115-940720447-1002 2015-01-21 19:34 - 2014-11-27 19:11 - 00000000 ____D () C:\Users\Nick\AppData\Local\Mozilla 2015-01-20 20:39 - 2014-11-27 19:09 - 00000000 ____D () C:\Users\Nick\AppData\Local\CrashDumps 2015-01-20 19:52 - 2014-11-27 18:49 - 00000000 ____D () C:\Users\Nick\AppData\Local\Pokki 2015-01-20 19:37 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF 2015-01-20 15:08 - 2014-11-27 20:08 - 00000193 _____ () C:\Users\Nick\AppData\Roaming\WB.CFG 2015-01-20 14:53 - 2014-11-30 08:12 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Skype 2015-01-19 21:36 - 2014-07-25 22:20 - 00000000 ____D () C:\Program Files (x86)\Acer 2015-01-19 21:35 - 2014-07-25 22:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer 2015-01-19 21:34 - 2014-11-27 18:52 - 00002293 _____ () C:\Users\Nick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk 2015-01-19 21:33 - 2014-11-27 18:50 - 00000000 ____D () C:\Users\Nick\AppData\Local\clear.fi 2015-01-19 08:55 - 2014-11-30 15:18 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-18 16:13 - 2014-11-30 15:18 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-17 20:02 - 2013-08-22 14:25 - 00000226 _____ () C:\Windows\win.ini 2015-01-17 19:54 - 2014-11-27 18:49 - 00000000 ____D () C:\Users\Nick 2015-01-17 19:49 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices 2015-01-17 19:47 - 2014-08-31 19:30 - 00000000 ____D () C:\ProgramData\{EB5F5A55-037A-4E47-806B-2C8AA9374701} 2015-01-17 19:47 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2015-01-17 19:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore 2015-01-17 19:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager 2015-01-17 19:47 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera 2015-01-17 19:44 - 2014-12-05 08:24 - 00000000 ___RD () C:\Windows\BrowserChoice 2015-01-17 19:44 - 2014-08-31 19:23 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2015-01-17 19:44 - 2014-07-25 22:28 - 00000000 ____D () C:\ProgramData\McAfee 2015-01-17 19:44 - 2014-07-25 22:28 - 00000000 ____D () C:\Program Files\mcafee 2015-01-17 19:44 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\Temp 2015-01-17 19:44 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\install_clap 2015-01-17 19:44 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2015-01-17 19:44 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Macromed 2015-01-17 19:44 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\Sysprep 2015-01-17 19:43 - 2014-07-25 22:28 - 00000000 ____D () C:\Program Files\mcafee.com 2015-01-17 19:43 - 2014-07-25 22:28 - 00000000 ____D () C:\Program Files\Common Files\mcafee 2015-01-17 19:43 - 2014-07-25 22:28 - 00000000 ____D () C:\Program Files (x86)\McAfee 2015-01-17 19:43 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\ELAMBKUP 2015-01-17 19:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\registration 2015-01-17 19:24 - 2014-09-01 04:36 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer 2015-01-17 19:24 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\SysWOW64\winrm 2015-01-17 19:24 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\SysWOW64\slmgr 2015-01-17 19:24 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\SysWOW64\Printing_Admin_Scripts 2015-01-17 19:24 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\system32\winrm 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Web 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Vss 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\vpnplugins 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\WindowsPowerShell 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\uk-UA 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\th-TH 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sr-Latn-RS 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\spp 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\Speech 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sk-SK 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\ro-RO 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\networklist 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\MUI 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\MsDtc 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\lv-LV 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\lt-LT 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\Licenses 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\InstallShield 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\InputMethod 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\IME 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\hr-HR 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\he-IL 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\et-EE 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\Com 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\bg-BG 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\ar-SA 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SystemResources 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\zh-HK 2015-01-17 19:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System 2015-01-17 19:24 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe 2015-01-17 19:24 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2015-01-17 19:23 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\system32\slmgr 2015-01-17 19:23 - 2014-03-18 10:32 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\WindowsPowerShell 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\WindowsInternal.Inbox.Shared 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\WindowsInternal.Inbox.Media.Shared 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\WinBioPlugIns 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\uk-UA 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\tr-TR 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\th-TH 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-RS 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\spp 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\spool 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Speech 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sl-SI 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sk-SK 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\ro-RO 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\networklist 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\MUI 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\MsDtc 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\migwiz 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\lv-LV 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\lt-LT 2015-01-17 19:23 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Licenses 2015-01-17 19:23 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\SMI 2015-01-17 19:23 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\oobe 2015-01-17 19:22 - 2014-12-05 08:24 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-01-17 19:22 - 2014-11-27 18:50 - 00000000 ____D () C:\Windows\oem 2015-01-17 19:22 - 2014-09-01 04:29 - 00000000 ____D () C:\Windows\NAPP_Dism_Log 2015-01-17 19:22 - 2014-03-18 10:45 - 00000000 ____D () C:\Windows\SKB 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ___SD () C:\Windows\system32\dsc 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ___SD () C:\Windows\system32\Configuration 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\InputMethod 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\IME 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\hr-HR 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\he-IL 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\et-EE 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\Com 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\bg-BG 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\ar-SA 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Speech 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\security 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\schemas 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Resources 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PLA 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Performance 2015-01-17 19:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\InputMethod 2015-01-17 19:22 - 2013-08-22 15:45 - 00000000 ____D () C:\Windows\Setup 2015-01-17 19:22 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\system32\Dism 2015-01-17 19:22 - 2013-08-22 14:36 - 00000000 ____D () C:\Windows\servicing 2015-01-17 19:21 - 2014-11-27 19:11 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\Mozilla 2015-01-17 19:21 - 2014-08-31 19:50 - 00000000 ____D () C:\Users\Public\CyberLink 2015-01-17 19:21 - 2014-07-25 22:28 - 00000000 ____D () C:\Users\Public\Foxit Software 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\DesktopTileResources 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\IME 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Help 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Globalization 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Branding 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppCompat 2015-01-17 19:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\ADFS 2015-01-17 19:20 - 2014-11-30 08:12 - 00000000 ____D () C:\Users\Nick\AppData\Local\Skype 2015-01-17 19:20 - 2014-11-27 18:49 - 00000000 ____D () C:\Users\Nick\AppData\Local\Packages 2015-01-17 19:19 - 2014-12-14 11:12 - 00000000 ____D () C:\ProgramData\Battle.net 2015-01-17 19:19 - 2014-11-30 18:18 - 00000000 ____D () C:\Users\Nick\AppData\Local\CyberLink 2015-01-17 19:19 - 2014-11-29 15:04 - 00000000 ____D () C:\ProgramData\Skype 2015-01-17 19:19 - 2014-11-27 19:36 - 00000000 ____D () C:\ProgramData\Oracle 2015-01-17 19:19 - 2014-08-31 19:50 - 00000000 ____D () C:\ProgramData\CLSK 2015-01-17 19:19 - 2014-08-31 19:34 - 00000000 ____D () C:\Program Files\Realtek 2015-01-17 19:19 - 2014-08-31 19:24 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-01-17 19:19 - 2014-08-31 19:21 - 00000000 ____D () C:\ProgramData\Intel 2015-01-17 19:19 - 2014-07-25 22:27 - 00000000 ____D () C:\Users\Default\AppData\Local\Pokki 2015-01-17 19:19 - 2014-07-25 22:27 - 00000000 ____D () C:\Users\Default User\AppData\Local\Pokki 2015-01-17 19:19 - 2014-07-25 22:23 - 00000000 ____D () C:\ProgramData\WildTangent 2015-01-17 19:19 - 2014-07-25 22:22 - 00000000 ____D () C:\ProgramData\CyberLink 2015-01-17 19:19 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\Package Cache 2015-01-17 19:19 - 2014-07-25 22:21 - 00000000 ____D () C:\ProgramData\OEM 2015-01-17 19:19 - 2014-07-25 22:20 - 00000000 ____D () C:\ProgramData\acer 2015-01-17 19:19 - 2014-07-25 22:00 - 00000000 ____D () C:\Program Files\Reference Assemblies 2015-01-17 19:19 - 2014-03-18 10:45 - 00000000 ____D () C:\Program Files\Windows Journal 2015-01-17 19:19 - 2013-08-22 16:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-01-17 19:19 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer 2015-01-17 19:19 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows NT 2015-01-17 19:19 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender 2015-01-17 19:19 - 2013-08-22 14:36 - 00000000 __RHD () C:\Users\Default 2015-01-17 19:18 - 2014-11-29 15:04 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-01-17 19:18 - 2014-11-27 19:36 - 00000000 ____D () C:\Program Files (x86)\Java 2015-01-17 19:18 - 2014-11-27 18:50 - 00000000 ____D () C:\Program Files (x86)\OEM 2015-01-17 19:18 - 2014-08-31 19:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-01-17 19:18 - 2014-08-31 19:46 - 00000000 ____D () C:\Program Files (x86)\Spotify 2015-01-17 19:18 - 2014-08-31 19:30 - 00000000 ____D () C:\Program Files (x86)\Qualcomm Atheros 2015-01-17 19:18 - 2014-08-31 19:24 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2015-01-17 19:18 - 2014-08-31 19:19 - 00000000 ____D () C:\Program Files (x86)\Realtek 2015-01-17 19:18 - 2014-08-31 18:50 - 00000000 ____D () C:\Program Files\Intel 2015-01-17 19:18 - 2014-08-31 18:50 - 00000000 ____D () C:\Program Files (x86)\Intel 2015-01-17 19:18 - 2014-07-25 22:28 - 00000000 ____D () C:\Program Files (x86)\Foxit PhantomPDF 2015-01-17 19:18 - 2014-07-25 22:26 - 00000000 ____D () C:\Program Files\Acer 2015-01-17 19:18 - 2014-07-25 22:24 - 00000000 ____D () C:\Program Files (x86)\WildGames 2015-01-17 19:18 - 2014-07-25 22:23 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games 2015-01-17 19:18 - 2014-07-25 22:21 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-17 19:18 - 2014-07-25 22:21 - 00000000 ____D () C:\Program Files (x86)\CyberLink 2015-01-17 19:18 - 2014-07-25 22:01 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies 2015-01-17 19:18 - 2014-07-25 22:01 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2015-01-17 19:18 - 2014-07-25 22:00 - 00000000 ____D () C:\Program Files\MSBuild 2015-01-17 19:18 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\System 2015-01-17 19:18 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2015-01-17 19:18 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer 2015-01-17 19:18 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows NT 2015-01-17 19:18 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2015-01-17 19:17 - 2014-11-28 17:16 - 00000000 ____D () C:\Program Files (x86)\Brick-Force 2015-01-17 19:17 - 2014-07-25 22:57 - 00000000 ___HD () C:\OEM 2015-01-16 05:19 - 2014-07-25 22:58 - 00000000 ____D () C:\Windows\Panther 2015-01-15 17:43 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2015-01-15 14:13 - 2014-11-27 19:10 - 00000000 ____D () C:\Users\Public\OEM 2015-01-15 13:59 - 2014-07-25 22:00 - 00000000 ____D () C:\Users\Administrator 2015-01-13 16:42 - 2014-11-28 17:08 - 00000000 ____D () C:\Users\Nick\AppData\Roaming\.minecraft 2015-01-06 01:08 - 2014-12-05 08:30 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-06 01:08 - 2014-12-05 08:30 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-03 17:10 - 2014-11-27 18:49 - 00000000 ____D () C:\Users\Nick\AppData\Local\VirtualStore ==================== Files in the root of some directories ======= 2014-12-15 14:08 - 2014-12-15 14:08 - 1545696 _____ () C:\Users\Nick\AppData\Roaming\EJSP.exe 2014-12-15 14:07 - 2014-12-15 14:07 - 2031584 _____ () C:\Users\Nick\AppData\Roaming\FYIKETTA.exe 2014-11-27 20:08 - 2015-01-20 15:08 - 0000193 _____ () C:\Users\Nick\AppData\Roaming\WB.CFG 2014-11-29 10:08 - 2014-12-17 10:08 - 0000001 _____ () C:\Users\Nick\AppData\Local\DSI.DAT 2014-11-29 10:08 - 2014-11-29 10:08 - 0022528 _____ () C:\Users\Nick\AppData\Local\dsisetup1444812342.exe 2014-12-02 14:08 - 2014-12-02 14:08 - 0022528 _____ () C:\Users\Nick\AppData\Local\dsisetup4180595462.exe 2014-12-17 10:08 - 2014-12-17 10:08 - 0022528 _____ () C:\Users\Nick\AppData\Local\dsisetup4535986252.exe 2014-08-31 19:34 - 2014-08-31 19:34 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2014-12-06 09:34 - 2014-12-06 09:34 - 0000199 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-21 11:40 ==================== End Of Log ============================ Gruß Anja |
|
19.01.2015, 15:38
| #14 |
| /// the machine /// TB-Ausbilder | Sicherheitswarnung zu meinem Internetzugang durch die Telekom Dann speicher die Fixlist mal im Download Ordner 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.01.2015, 17:57
| #15 |
| | Sicherheitswarnung zu meinem Internetzugang durch die Telekom hi schrauber Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
Ran by Anja xxx at 2015-01-19 17:48:47 Run:2
Running from C:\Users\Anja xxx\Downloads
Loaded Profiles: Anja xxx (Available profiles: Anja xxx & Administrator & Gast)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
*****************
HKLM\SOFTWARE\Policies\Google => Key not found.
EmptyTemp: => Removed 36.9 MB temporary data.
The system needed a reboot.
==== End of Fixlog 17:49:02 ====
|
|
| Themen zu Sicherheitswarnung zu meinem Internetzugang durch die Telekom |
| adware, antivirus, avast, avg, browser, cpu, defender, device driver, entfernen, esgscanner.sys, explorer, flash player, google, home, iexplore.exe, livecomm.exe, monitor, onedrive, programm, scan, security, server, services.exe, software, svchost.exe, tablet, trackid, trojaner, virus, windows, windowsapps, winlogon.exe |
dann auf 
und dann auf 
. 
Hybrid-Darstellung
