Hallo liebe User,

Ich habefolgendes Problem:

Seit ca 1 Woche zeigt mein Virusprogramm (Kaspersky) an, dass ich einen Virus namens Sysad.exe auf dem Pc habe. Zu finden ist die exe in meinem Temp ordner. Ich kann die datei auch nicht loeschen und das Virusprogramm schafft es auch nicht diesen komplett zu beseitigen. Ich benutze immer Unlocker und lasse sie durch ein Neustart loeschen, jedoch kommt diese datei dann am naechsten Tag gleich wieder.

Ich habe schon alles moegliche versucht .. bin in die registry rein und habs daraus geloescht, bin in den Abgesichertenmodus gegangen, konnte die datei jedoch nicht mehr loeschen, weil se geloescht war. Mal ist sie da und mal nicht. Ein Programm womit ich die datei töten kann, kenn ich nicht, bzw. Nur Spyhunter und noch nen anderes, allerdings beide kostenpflichtig.

Ich hoffe ihr koennt mir Helfen. Danke im vorraus

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke fuer die schnelle Rueckantwort, ich bin gerade noch auf Arbeit und werde deine Schritte, sobald ich zuhause bin, befolgen. Ansich hatte mir nur Kaspersky den Fund angezigt ( ist allerdings auch mein einziges Virusprogramm auf dem Pc)

Soll ich nochmal mit den von dir genannten programmen durchsuchen lassen?

Beiträge bitte komplett lesen

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

So wie versprochen meine Logfile

Kaspersky :
21.01.2015 13.01.11 Gefundenes Objekt (Datei) wurde nicht verarbeitet C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$RDDUDP1.exe Datei: C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$RDDUDP1.exe Objektname: not-a-virus:AdWare.Win32.iBryte.jkc Objekttyp: Adware Zeitpunkt: 21.01.2015, 13:01
21.01.2015 15.02.43 Gefundenes Objekt (Datei) wurde gelöscht c:\users\nyuvegas\appdata\local\cead6232-7ce0-413f-9307-f64838e40c52\sysad.exe Datei: c:\users\nyuvegas\appdata\local\cead6232-7ce0-413f-9307-f64838e40c52\sysad.exe Objektname: UDSangerousObject.Multi.Generic Objekttyp: Unbekannte Bedrohung Zeitpunkt: 21.01.2015, 15:02
21.01.2015 15.17.56 Gefundenes Objekt (Datei) wurde gelöscht C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$RRHMDW5.exe Datei: C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$RRHMDW5.exe Objektname: not-a-virus:AdWare.Win32.iBryte.jkc Objekttyp: Adware Zeitpunkt: 21.01.2015, 15:17
21.01.2015 13.19.07 Gefundenes Objekt (Datei) ist nicht mehr verfügbar F:\Sims 4\The.Sims.4.Update.3.and.Crack.v7\Crack\Game\Bin\3dmgame.dll Datei: F:\Sims 4\The.Sims.4.Update.3.and.Crack.v7\Crack\Game\Bin\3dmgame.dll Objektname: HEUR:VirTool.Win32.Generic Objekttyp: Unbekannte Bedrohung Zeitpunkt: 21.01.2015, 13:19
21.01.2015 15.10.28 Gefundenes Objekt (Datei) wurde nicht verarbeitet c:\users\nyuvegas\appdata\local\temp\sysad.exe Datei: c:\users\nyuvegas\appdata\local\temp\sysad.exe Objektname: not-a-virus:AdWare.Win32.iBryte.jkc Objekttyp: Adware Zeitpunkt: 21.01.2015, 15:10
20.01.2015 11.07.20 Gefundenes Objekt (Datei) ist nicht aktiv hxxp://d2so5y5xnc4mxe.cloudfront.net/release/sysad.exe Datei: hxxp://d2so5y5xnc4mxe.cloudfront.net/release/sysad.exe Objektname: not-a-virus:AdWare.Win32.iBryte.jkc Objekttyp: Adware Zeitpunkt: 20.01.2015, 11:07
21.01.2015 10.27.55 Gefundenes Objekt (Datei) wurde nicht verarbeitet C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$R135SLR.exe Datei: C:\$Recycle.Bin\S-1-5-21-2042513989-445520445-2244660697-1000\$R135SLR.exe Objektname: not-a-virus:AdWare.Win32.iBryte.jkc Objekttyp: Adware Zeitpunkt: 21.01.2015, 10:27
12.01.2015 17.23.40 Gefundenes Objekt (Datei) wurde gelöscht C:\Documents and Settings\Nyuvegas\AppData\Local\cead6232-7ce0-413f-9307-f64838e40c52\sysad.exe Datei: C:\Documents and Settings\Nyuvegas\AppData\Local\cead6232-7ce0-413f-9307-f64838e40c52\sysad.exe Objektname: not-a-virus:AdWare.MSIL.iBryte.y Objekttyp: Adware Zeitpunkt: 12.01.2015, 17:23



FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015
Ran by Nyuvegas (administrator) on NYUVEGAS-PC on 21-01-2015 15:07:50
Running from C:\Users\Nyuvegas\Desktop
Loaded Profiles: Nyuvegas (Available profiles: Nyuvegas)
Platform: Windows Seven Black Edition (X64) OS Language: Englisch (USA)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Windows\SysWOW64\ASGT.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Windows\System32\PnkBstrA.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files (x86)\RocketTab\Client.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ROCCAT GmbH Co., Ltd.) C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RoccatIskuFX] => C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\IskuFXMonitor.exe [540672 2014-10-19] (ROCCAT GmbH)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.)
HKU\S-1-5-21-2042513989-445520445-2244660697-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [Welcome Center] => C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut
HKU\S-1-5-18\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-18\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMBalloonTip] 1
IFEO\ContentExplorer.exe: [Debugger] TaskList.exe
IFEO\internetenhancer.exe: [Debugger] TaskList.exe
IFEO\internetenhancerservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancer.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerApp.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerAppservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancerservice.exe: [Debugger] TaskList.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Roccat Talk.lnk
ShortcutTarget: Roccat Talk.lnk -> C:\Program Files (x86)\ROCCAT\Roccat Talk\Roccat Talk.exe (ROCCAT GmbH Co., Ltd.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION 
==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [S-1-5-21-2042513989-445520445-2244660697-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-2042513989-445520445-2244660697-1000] => http=127.0.0.1:49255;https=127.0.0.1:49255;
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1413570370&from=cor&uid=ST1000DM003-1ER162_S4Y0B92VXXXXS4Y0B92V&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1413570370&from=cor&uid=ST1000DM003-1ER162_S4Y0B92VXXXXS4Y0B92V&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1413570370&from=cor&uid=ST1000DM003-1ER162_S4Y0B92VXXXXS4Y0B92V&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1413570370&from=cor&uid=ST1000DM003-1ER162_S4Y0B92VXXXXS4Y0B92V&q={searchTerms}
HKU\S-1-5-21-2042513989-445520445-2244660697-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2042513989-445520445-2244660697-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413570370&from=cor&uid=ST1000DM003-1ER162_S4Y0B92VXXXXS4Y0B92V
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
FireFox:
========
FF ProfilePath: C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Windows\system32\C2MP\npdivx32.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=1.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF user.js: detected! => C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\user.js
FF SearchPlugin: C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\searchplugins\google-maps.xml
FF Extension: NoScript - C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-10-19]
FF Extension: Adblock Plus - C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25]
FF HKU\S-1-5-21-2042513989-445520445-2244660697-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Nyuvegas\AppData\Roaming\Mozilla\Firefox\Profiles\2s1vgjce.default\extensions\cliqz@cliqz.com
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR Profile: C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-01]
CHR Extension: (Google Docs) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-01]
CHR Extension: (Google Drive) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-01]
CHR Extension: (YouTube) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-01]
CHR Extension: (Google-Suche) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-01]
CHR Extension: (Kaspersky Protection) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-01-01]
CHR Extension: (Google Tabellen) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-01]
CHR Extension: (Google Wallet) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-01]
CHR Extension: (Google Mail) - C:\Users\Nyuvegas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-01]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () [File not signed]
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [240584 2012-10-02] (DTS, Inc)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-10-17] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-10-14] ()
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2009-07-18] (Microsoft Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-10-14] (Duplex Secure Ltd.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R1 {02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64; C:\Windows\System32\drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys [48784 2014-10-17] (StdLib)
R1 {4530e639-76ab-4435-889d-a5e81ae090a4}Gw64; C:\Windows\System32\drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys [48784 2014-10-20] (StdLib)
R1 {67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64; C:\Windows\System32\drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys [48784 2014-10-20] (StdLib)
R1 {733fb217-c049-41ba-9504-3f2045e61977}Gw64; C:\Windows\System32\drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys [48784 2014-10-21] (StdLib)
R1 {db1293a0-85fd-418d-b0d6-c79faa7c8ace}Gw64; C:\Windows\System32\drivers\{db1293a0-85fd-418d-b0d6-c79faa7c8ace}Gw64.sys [48784 2014-10-20] (StdLib)
R1 {dc592624-f532-4311-9fc7-6920126fc404}Gw64; C:\Windows\System32\drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys [48784 2014-10-22] (StdLib)
R1 {f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64; C:\Windows\System32\drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys [48784 2014-10-23] (StdLib)
R1 {fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64; C:\Windows\System32\drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys [48784 2014-10-18] (StdLib)
U3 a0k9j368; C:\Windows\System32\Drivers\a0k9j368.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-21 15:07 - 2015-01-21 15:08 - 00020696 _____ () C:\Users\Nyuvegas\Desktop\FRST.txt
2015-01-21 15:07 - 2015-01-21 15:07 - 00000000 ____D () C:\FRST
2015-01-21 15:06 - 2015-01-21 15:08 - 02126848 ____N (Farbar) C:\Users\Nyuvegas\Desktop\FRST64.exe
2015-01-19 17:57 - 2015-01-19 18:05 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\.minecraft
2015-01-19 17:57 - 2015-01-19 17:57 - 01294088 _____ (Mojang) C:\Users\Nyuvegas\Desktop\Minecraft (1).exe
2015-01-19 17:57 - 2015-01-19 17:57 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\runtime
2015-01-19 17:57 - 2015-01-19 17:57 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\game
2015-01-19 17:33 - 2015-01-19 17:33 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Vault
2015-01-19 16:59 - 2015-01-19 16:59 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-01-19 16:53 - 2015-01-19 16:53 - 01294088 _____ (Mojang) C:\Users\Nyuvegas\Downloads\Minecraft.exe
2015-01-19 16:52 - 2015-01-19 16:52 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\für multiplayer
2015-01-19 16:39 - 2014-12-30 21:29 - 00016847 _____ () C:\Users\Nyuvegas\Desktop\EssentialsSpawn.jar
2015-01-19 16:39 - 2014-12-10 23:56 - 00296044 _____ () C:\Users\Nyuvegas\Desktop\Vault.jar
2015-01-19 15:56 - 2015-01-19 17:32 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Bukkit Server (Premade)
2015-01-19 15:55 - 2015-01-19 15:56 - 24734598 _____ () C:\Users\Nyuvegas\Downloads\Bukkit Server (Premade).rar
2015-01-19 11:20 - 2015-01-19 11:20 - 08297745 _____ () C:\Users\Nyuvegas\Downloads\minecraft_server.1.8.1.exe
2015-01-18 19:58 - 2015-01-21 15:03 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\cead6232-7ce0-413f-9307-f64838e40c52
2015-01-18 19:56 - 2015-01-18 19:56 - 701572999 _____ () C:\Windows\MEMORY.DMP
2015-01-18 19:56 - 2015-01-18 19:56 - 00300808 _____ () C:\Windows\Minidump\011815-23134-01.dmp
2015-01-18 19:56 - 2015-01-18 19:56 - 00000000 ____D () C:\Windows\Minidump
2015-01-18 15:39 - 2015-01-18 15:40 - 01568433 _____ () C:\Users\Nyuvegas\Downloads\worldedit-bukkit-6.0.jar
2015-01-18 15:34 - 2015-01-18 15:34 - 00001199 _____ () C:\Users\Nyuvegas\Desktop\start.bat - Verknüpfung.lnk
2015-01-18 15:33 - 2015-01-18 15:33 - 00324043 _____ () C:\Users\Nyuvegas\Downloads\worldguard-5.9.zip
2015-01-18 12:24 - 2015-01-18 15:38 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\AdminCmd
2015-01-18 11:18 - 2015-01-18 11:49 - 00000924 _____ () C:\Windows\PFRO.log
2015-01-18 10:57 - 2015-01-18 10:57 - 00000000 ____D () C:\Windows\SysWOW64\%Data%
2015-01-18 10:57 - 2015-01-18 10:57 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\ParetoLogic
2015-01-18 10:53 - 2015-01-18 10:53 - 00000000 _____ () C:\autoexec.bat
2015-01-18 10:51 - 2015-01-18 11:20 - 00000000 ____D () C:\ProgramData\ParetoLogic
2015-01-18 10:49 - 2015-01-21 15:05 - 00093807 _____ () C:\Windows\WindowsUpdate.log
2015-01-18 10:47 - 2015-01-21 15:02 - 00001120 _____ () C:\Windows\setupact.log
2015-01-18 10:47 - 2015-01-18 10:47 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-17 23:21 - 2015-01-17 23:21 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\Notepad++
2015-01-17 23:21 - 2015-01-17 23:21 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2015-01-17 23:21 - 2015-01-17 23:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2015-01-17 23:21 - 2015-01-17 23:21 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2015-01-17 23:20 - 2015-01-17 23:21 - 07965917 _____ () C:\Users\Nyuvegas\Downloads\npp.6.7.4.Installer.exe
2015-01-17 23:09 - 2015-01-17 23:09 - 00990670 _____ () C:\Users\Nyuvegas\Downloads\Essentials.zip
2015-01-17 22:53 - 2015-01-21 15:02 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\LogMeIn Hamachi
2015-01-17 22:53 - 2015-01-17 22:53 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\LogMeIn
2015-01-17 22:53 - 2015-01-17 22:53 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-01-17 22:52 - 2015-01-17 22:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-01-17 22:52 - 2015-01-17 22:52 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2015-01-17 22:51 - 2015-01-17 22:51 - 08536064 _____ () C:\Users\Nyuvegas\Downloads\hamachi291.msi
2015-01-17 22:43 - 2015-01-17 22:43 - 02318336 _____ () C:\Users\Nyuvegas\Downloads\MinecraftInstaller.msi
2015-01-17 22:39 - 2015-01-18 15:34 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Minecraft Server 1.8
2015-01-17 22:39 - 2015-01-17 22:45 - 18378157 _____ () C:\Users\Nyuvegas\Downloads\Minecraft Server 1.8.rar
2015-01-17 22:19 - 2015-01-17 22:19 - 00000000 ____D () C:\Users\Nyuvegas\Downloads\runtime
2015-01-17 22:19 - 2015-01-17 22:19 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\java
2015-01-17 22:18 - 2015-01-17 22:19 - 00000000 ____D () C:\Users\Nyuvegas\Downloads\game
2015-01-17 22:13 - 2015-01-17 22:13 - 00000000 ____D () C:\Users\Nyuvegas\.appwork
2015-01-12 17:09 - 2015-01-12 17:09 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\2015_01_12
2015-01-12 17:09 - 2015-01-12 17:09 - 00000000 _____ () C:\Users\Nyuvegas\Sti_Trace.log
2015-01-12 17:08 - 2015-01-12 17:08 - 46722640 _____ () C:\Users\Nyuvegas\Downloads\mpnx_1_0-win-1_08-ea23_2.exe
2015-01-12 17:08 - 2015-01-12 17:08 - 00002101 _____ () C:\Users\Public\Desktop\MP Navigator EX 1.0.lnk
2015-01-01 19:58 - 2015-01-01 19:58 - 01968243 _____ () C:\Users\Nyuvegas\Downloads\DBM-Core (1).zip
2015-01-01 19:58 - 2015-01-01 19:58 - 01179180 _____ () C:\Users\Nyuvegas\Downloads\HealBot (1).zip
2015-01-01 13:43 - 2015-01-21 15:02 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-01 13:43 - 2015-01-21 12:48 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-01 13:43 - 2015-01-18 15:49 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-01 13:43 - 2015-01-01 13:43 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-01 13:43 - 2015-01-01 13:43 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-01 13:43 - 2015-01-01 13:43 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\Google
2015-01-01 13:43 - 2015-01-01 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-01 13:43 - 2015-01-01 13:43 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-01 13:42 - 2015-01-01 13:42 - 00880784 _____ (Google Inc.) C:\Users\Nyuvegas\Downloads\ChromeSetup.exe
2014-12-26 21:33 - 2015-01-12 17:09 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\Canon
2014-12-25 23:57 - 2014-12-26 00:20 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Bilder für Bilder rahmen
2014-12-25 20:24 - 2014-12-25 20:24 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\musik handy
2014-12-25 20:19 - 2014-12-25 20:58 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Neuer Ordner
2014-12-24 21:47 - 2014-12-24 21:47 - 00000000 ____D () C:\ProgramData\ROCCAT
2014-12-24 21:45 - 2014-12-24 21:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT
2014-12-24 21:45 - 2014-12-24 21:45 - 00000000 ____D () C:\Program Files\Alienware
2014-12-24 21:45 - 2014-12-24 21:45 - 00000000 ____D () C:\Program Files (x86)\ROCCAT
2014-12-24 21:43 - 2014-12-24 21:44 - 47139660 _____ () C:\Users\Nyuvegas\Downloads\ROCCAT_Isku_FX_DRV1.10_FW1.06.zip
2014-12-22 10:28 - 2014-12-22 10:28 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\AMD
2014-12-22 10:24 - 2014-12-22 10:24 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\DivX
2014-12-22 10:23 - 2014-12-22 10:23 - 00000000 ____D () C:\ProgramData\ATI
2014-12-22 10:19 - 2015-01-16 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-12-22 10:19 - 2015-01-16 19:05 - 00000000 ____D () C:\Program Files (x86)\Raptr
2014-12-22 10:19 - 2014-12-22 10:19 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\library_dir
2014-12-22 10:19 - 2014-12-22 10:19 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-12-22 10:18 - 2014-12-22 10:18 - 00058610 _____ () C:\Windows\SysWOW64\CCCInstall_201412221018550126.log
2014-12-22 10:18 - 2014-12-22 10:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-12-22 10:17 - 2014-12-22 10:17 - 00000060 _____ () C:\Users\Nyuvegas\Downloads\playlist.m3u

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-21 15:02 - 2014-10-25 19:02 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-01-21 15:02 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-21 13:20 - 2009-07-14 05:45 - 00013120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-21 13:20 - 2009-07-14 05:45 - 00013120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-21 12:58 - 2014-10-18 21:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 17:03 - 2014-10-14 09:46 - 00696528 _____ () C:\Windows\system32\perfh007.dat
2015-01-19 17:03 - 2014-10-14 09:46 - 00148496 _____ () C:\Windows\system32\perfc007.dat
2015-01-19 17:03 - 2009-07-14 06:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-19 11:26 - 2014-10-19 17:34 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\Battle.net
2015-01-18 12:17 - 2014-10-19 17:43 - 62125574 _____ () C:\Users\Nyuvegas\Downloads\DBM-Core.zip
2015-01-18 11:10 - 2014-12-19 17:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-17 22:13 - 2014-10-17 19:34 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\JDownloader v2.0
2015-01-17 22:13 - 2014-10-13 21:12 - 00000000 ____D () C:\Users\Nyuvegas
2015-01-17 21:43 - 2014-10-19 11:38 - 00000000 ____D () C:\Program Files\Unlocker
2015-01-16 18:58 - 2014-10-18 21:43 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-16 18:58 - 2014-10-18 21:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-16 18:58 - 2014-10-18 21:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 15:52 - 2014-10-14 09:33 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 15:50 - 2009-10-14 13:51 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-12 17:08 - 2014-12-02 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2015-01-12 17:08 - 2014-12-02 20:54 - 00000000 ____D () C:\Program Files (x86)\Canon
2015-01-12 17:05 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-28 13:00 - 2009-07-14 06:08 - 00032564 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-26 21:53 - 2014-12-02 20:55 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Local\Canon Easy-PhotoPrint EX
2014-12-24 21:45 - 2014-10-13 21:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-23 15:59 - 2014-10-14 20:34 - 00000000 ____D () C:\Users\Nyuvegas\Desktop\Programme icon
2014-12-22 10:27 - 2014-10-14 20:15 - 00000000 ____D () C:\Users\Nyuvegas\AppData\Roaming\vlc
2014-12-22 10:19 - 2014-10-13 21:23 - 00000000 ____D () C:\ProgramData\AMD
2014-12-22 10:18 - 2014-10-13 21:52 - 00000000 ____D () C:\Program Files\AMD
2014-12-22 10:17 - 2014-10-13 21:18 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-12-22 10:15 - 2014-10-13 21:54 - 00000000 ____D () C:\Program Files (x86)\AMD
2014-12-22 10:15 - 2014-10-13 21:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-22 10:12 - 2014-10-13 21:22 - 00000000 ____D () C:\AMD

==================== Files in the root of some directories =======
2015-01-18 10:57 - 2015-01-18 11:19 - 0000115 _____ () C:\Users\Nyuvegas\AppData\Roaming\LogFile.txt
2014-10-13 21:41 - 2014-10-13 21:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-1172700596971052706.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-1613061262999495945.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-2298748894996855453.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-2439003136187162065.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-2643324177289332876.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-2824050804485454917.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-3567533504956460443.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-3630415450621146523.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-557185544672286219.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-5631170378608302012.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-5799391240954616588.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-601958773741176133.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-6035370937126583826.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-667782006633585382.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-7239150724522047269.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-786829877808293672.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-8420734611301503973.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-13716d9-0899683-8444832226599749644.dll
C:\Users\Nyuvegas\AppData\Local\Temp\jansi-32-git-Spigot-1642.dll
C:\Users\Nyuvegas\AppData\Local\Temp\sysad.exe
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite27649.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite36858.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite51903.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite52006.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite69131.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite80687.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite82131.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite82470.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite91321.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite99598.dll
C:\Users\Nyuvegas\AppData\Local\Temp\System.Data.SQLite99773.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-18 16:56

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015
Ran by Nyuvegas at 2015-01-21 15:08:23
Running from C:\Users\Nyuvegas\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.09 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0909-000001000000}) (Version: 9.09.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)
AlienFX for IskuFX (HKLM-x32\...\InstallShield_{2C3FC2CC-0A8B-409E-B487-8CD54F4DC1D4}) (Version: 1.02 - Roccat GmbH)
AlienFX for IskuFX (Version: 1.02 - Roccat GmbH) Hidden
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.12.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
ASUS GPU Tweak (HKLM-x32\...\InstallShield_{532F6E8A-AF97-41C3-915F-39F718EC07D1}) (Version: 2.4.9.2 - ASUSTek COMPUTER INC.)
ASUS GPU Tweak (x32 Version: 2.4.9.2 - ASUSTek COMPUTER INC.) Hidden
ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.025 - ASUSTek Computer Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.3.2.15221 - Electronic Arts)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version:  - Infinity Ward)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version:  - Infinity Ward)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: 4.5.0 - Canon Inc.)
Canon MP Navigator EX 1.0 (HKLM-x32\...\MP Navigator EX 1.0) (Version:  - )
Canon MP610 series (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
Cole2k Media - Codec Pack (Advanced) 7.9.0 (HKLM-x32\...\Cole2k Media - Codec Pack) (Version:  - Cole2k Media)
Combined Community Codec Pack 2009-09-09 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2009.09.09.0 - CCCP Project)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.05.0.0 - Electronic Arts)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GPUTweakStreaming (HKLM-x32\...\InstallShield_{D2A41AA7-4313-43D5-AA39-7E3FBBE0556D}) (Version: 1.0.3.5 - ASUS)
GPUTweakStreaming (x32 Version: 1.0.3.5 - ASUS) Hidden
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.291 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.291 - LogMeIn, Inc.) Hidden
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.4 - Notepad++ Team)
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.3.6.4639 - Electronic Arts, Inc.)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7023 - Realtek Semiconductor Corp.)
Risen 3 - Titan Lords (HKLM-x32\...\Risen 3 - Titan Lords_is1) (Version:  - Deep Silver)
ROCCAT Isku FX Keyboard Driver (HKLM-x32\...\{DC69933C-E7B0-455D-8E54-FAC1EEF046FF}) (Version:  - Roccat GmbH)
Roccat Talk (HKLM-x32\...\{605D671E-1D1E-4840-84D9-BFACE17F160D}) (Version: 1.00.0013 - Roccat GmbH)
RocketTab (HKLM-x32\...\RocketTab) (Version:  - RocketTab) <==== ATTENTION!
Software (web controller) (HKLM-x32\...\Software) (Version: 3.0.0.5 - Inquiro SA)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Sims 4 Version 1.0 (HKLM-x32\...\{A4DD0B0B-029A-4F77-BF7B-FBE6A849974D}_is1) (Version: 1.0 - ZKY)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Uplay (HKLM-x32\...\Uplay) (Version: 4.7 - Ubisoft)
VLC media player 1.0.3 (HKLM-x32\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
WinRAR arkivering (HKLM\...\WinRAR archiver) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

11-01-2015 16:41:00 Scheduled Checkpoint
14-01-2015 15:50:28 Windows Update
17-01-2015 22:44:43 Installed Minecraft
17-01-2015 22:52:26 Installed LogMeIn Hamachi
19-01-2015 16:58:42 Removed Minecraft

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-10-13 22:01 - 00000921 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 genuine.microsoft.com
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {4FCDB6C2-36B0-4B4E-9776-09C4EE10DAA8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {7AFFAA07-1996-4E21-A7FF-96C0108A8EA6} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-08-27] (ASUSTek Computer Inc.)
Task: {88C7C764-5F52-42FE-9859-596A587191C3} - \RunTool No Task File <==== ATTENTION
Task: {9FC5CF9E-1C62-48CB-B5CD-21D2AC97399D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01] (Google Inc.)
Task: {A403A96B-B2D8-47DD-98EB-F7E8AE90219B} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\RocketTab\Client.exe" /Preferred=true <==== ATTENTION
Task: {BBA4C337-E89F-4FDA-9163-8EDCDDD38F52} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe [2014-10-14] () <==== ATTENTION
Task: {BE325DA6-2228-4E32-96F5-E03A91780B87} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-16] (Adobe Systems Incorporated)
Task: {C4FB0F0B-BB70-4573-8489-318DFA9B2318} - System32\Tasks\ASP => C:\Program Files (x86)\RCP\systweakasp.exe
Task: {D98B6445-2B00-4572-AF27-620340F03D9B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-11-20 21:23 - 2014-11-20 21:23 - 00214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 00817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 03650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2012-01-17 10:24 - 2012-01-17 10:24 - 00055296 _____ () C:\Windows\SysWOW64\ASGT.exe
2014-10-13 21:12 - 2009-08-16 16:06 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2014-10-17 22:37 - 2014-10-17 22:37 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2014-09-25 19:44 - 2014-09-25 19:44 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-10-14 10:07 - 2014-10-14 10:07 - 01420512 _____ () C:\Program Files (x86)\rockettab\client.exe
2014-11-20 21:23 - 2014-11-20 21:23 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-12-24 21:45 - 2012-07-08 16:31 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Isku FX Keyboard\hiddriver.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: RGSC => D:\Rockstar Games Social Club\RGSCLauncher.exe /silent

========================= Accounts: ==========================

Administrator (S-1-5-21-2042513989-445520445-2244660697-500 - Administrator - Disabled)
Guest (S-1-5-21-2042513989-445520445-2244660697-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2042513989-445520445-2244660697-1004 - Limited - Enabled)
Nyuvegas (S-1-5-21-2042513989-445520445-2244660697-1000 - Administrator - Enabled) => C:\Users\Nyuvegas

==================== Faulty Device Manager Devices =============

Name: Microsoft-Teredo-Tunneling-Adapter
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: AODDriver4.2.0
Description: AODDriver4.2.0
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: AODDriver4.2.0
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/21/2015 03:02:09 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

Error: (01/21/2015 03:02:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x800401F9

Error: (01/21/2015 10:36:03 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

Error: (01/21/2015 10:36:03 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x800401F9

Error: (01/21/2015 10:29:58 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

Error: (01/21/2015 10:29:58 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x800401F9

Error: (01/21/2015 07:59:47 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

Error: (01/21/2015 07:59:47 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x800401F9

Error: (01/20/2015 11:44:17 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x00000000.

Error: (01/20/2015 11:44:17 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x800401F9


System errors:
=============
Error: (01/21/2015 03:02:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (01/21/2015 01:13:12 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "TOSHIBA EXT" den Befehl "chkdsk" aus.

Error: (01/21/2015 10:37:40 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "TOSHIBA EXT" den Befehl "chkdsk" aus.

Error: (01/21/2015 10:36:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (01/21/2015 10:32:05 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Security Center" wurde mit folgendem Fehler beendet: 
%%5

Error: (01/21/2015 10:32:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (01/21/2015 10:29:58 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (01/21/2015 08:00:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/21/2015 08:00:25 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (01/21/2015 07:59:51 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{22279AF5-03AE-4CAF-989D-2530918B2F1C}{0773CCD6-59A2-4D26-B235-19247767E645}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)


Microsoft Office Sessions:
=========================
Error: (01/21/2015 03:02:09 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x000000000x00000001

Error: (01/21/2015 03:02:09 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: 0x800401F9

Error: (01/21/2015 10:36:03 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x000000000x00000001

Error: (01/21/2015 10:36:03 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: 0x800401F9

Error: (01/21/2015 10:29:58 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x000000000x00000001

Error: (01/21/2015 10:29:58 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: 0x800401F9

Error: (01/21/2015 07:59:47 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x000000000x00000001

Error: (01/21/2015 07:59:47 AM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: 0x800401F9

Error: (01/20/2015 11:44:17 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x000000000x00000001

Error: (01/20/2015 11:44:17 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: 0x800401F9


CodeIntegrity Errors:
===================================
  Date: 2015-01-21 15:02:05.996
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 13:20:00.513
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 10:36:02.123
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 10:29:57.123
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 10:28:03.704
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 07:59:42.973
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-21 01:26:16.948
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-20 23:44:15.667
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-20 13:19:21.975
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-01-20 09:17:59.060
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: AMD FX(tm)-9590 Eight-Core Processor 
Percentage of memory in use: 11%
Total physical RAM: 16283.5 MB
Available physical RAM: 14335.89 MB
Total Pagefile: 32565.14 MB
Available Pagefile: 30224.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:97.56 GB) (Free:41.72 GB) NTFS
Drive d: (Spiele) (Fixed) (Total:833.86 GB) (Free:592.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 524DC064)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=833.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

F:\Sims 4\The.Sims.4.Update.3.and.Crack.v7\Crack\Game\Bin\3dmgame.dll

Du hast dein System selbst vorsätzlich(grobfahrlässig verhunzt. Da muss man sich auch nicht mehr Schädlinge wundern!

Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

das wird dann wohl ne andere Festplatte sein, da ich keine besitze mit dem namen F. Ich habe nur C und D als Festplatten. Einmal für Windows und einmal für Spiele und meine Spiele die ich drauf habe sind alle Original! Das sind nämlich BF, WOW, Minecraft und far cry 4, the vannisching, risen 3 und archage. und davon Spiele ich gerade mal zwei momentan und das sind Wow und Minecraft!

Platform: Windows Seven Black Edition

LOL => http://praxistipps.chip.de/windows-7...s-ist-das_1445

Soviel zum Thema "alles Original"

21.01.2015 13.19.07 Gefundenes Objekt (Datei) ist nicht mehr verfügbar F:\Sims 4\The.Sims.4.Update.3.and.Crack.v7\Crack\Game\Bin\3dmgame.dll Datei: F:\Sims 4\The.Sims.4.Update.3.and.Crack.v7\Crack\Game\Bin\3dmgame.dll Objektname: HEUR:VirTool.Win32.Generic Objekttyp: Unbekannte Bedrohung Zeitpunkt: 21.01.2015, 13:19

Kein Laufwerk F? Aber heute um 13:19 war es da dran...

Ist aber alles schnurz, deine Installation ist eh nicht zu retten, da illegale nicht supporte Version von Windows. Sieht man ja auch schön am Patchstand. Kein SP1, IE nur in Version 8, quasi die Windows-7-Ursuppe in illegaler Form

Besorg dir ne richtige legale/lizenzierte Version von Windows. Damit machst du ne saubere Neuinstallation.

Also den Pc hab ich mir von nem kumpel komplett zusammen bauen lassen, ich hab davon keine Ahnung, er meinte nur das es nicht das standard win7 ist, aber gut dann weiß ich ja bescheid ^^. Also installiere ich mir einfach windows 7 neu und hoffe das sowas nicht mehr passiert.

Dann danke ich dir für deine hilfe und werde mein windows neu LEGAL kaufen und installieren!