| |
| |||||||
Log-Analyse und Auswertung: Avast Meldung Win32:Evo-gen [susp]Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
30.01.2015, 10:51
| #1 |
| | ![Avast Meldung Win32:Evo-gen [susp] - Standard](images/icons/icon1.gif){kind=icon} Avast Meldung Win32:Evo-gen [susp] Hallo, Bekomme seit heute Morgen öfter die Meldung von Avast: Win32:Evo-gen [susp]. Hab das löschen lassen, aber nach dem Neustart kam das wieder. Jetzt mal Malwarebytes drüberlaufen lassen: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 30.01.2015 Scan Time: 10:39:28 Logfile: Administrator: Yes Version: 2.00.4.1028 Malware Database: v2015.01.30.03 Rootkit Database: v2015.01.14.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Kalle Scan Type: Threat Scan Result: Completed Objects Scanned: 333736 Time Elapsed: 4 min, 22 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 9 PUP.Optional.WindowsProtectManger.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, , [6a21d22b573263d3670420a7847d629e], PUP.Optional.ClickCaption.A, HKLM\SOFTWARE\WOW6432NODE\ClickCaption_1.10.0.4, , [7e0d8776dbae4beb548a6f1a9e6514ec], PUP.Optional.MyStart.A, HKLM\SOFTWARE\WOW6432NODE\mystarttb, , [6a216f8ed7b268ceeea0f1a7f80bf808], PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, , [0b8037c64247f343c42c3bc030d458a8], PUP.Optional.ViView.A, HKLM\SOFTWARE\WOW6432NODE\vi-viewSoftware, , [6229fc019aefa98db7085230fb08639d], PUP.Optional.ClickCaption.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ccnfd_1_10_0_4, , [1a71db225138ad8946961b6e25de47b9], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, , [c5c61ae320697db9e72e5834f01345bb], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1820279603-2735648936-400300262-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [880315e80386c175a7598046020129d7], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1820279603-2735648936-400300262-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [55366796a2e7cb6baa6ab8241be98a76], Registry Values: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-1820279603-2735648936-400300262-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0V1D1S1R1D0V1O, , [55366796a2e7cb6baa6ab8241be98a76] Registry Data: 4 PUP.Optional.ViView.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}),,[02893fbeb7d277bf189d3a64cd38c838] PUP.Optional.ViView.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}),,[47443ac32f5a1f1721927b23f213c739] PUP.Optional.ViView.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}),,[127955a85c2d1a1ca411a8f608fd8a76] PUP.Optional.ViView.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms}),,[eaa13ebf92f763d39e15edb14cb9f30d] Folders: 4 PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [593298654f3a0432c2950d508e759a66], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [593298654f3a0432c2950d508e759a66], PUP.Optional.ViView.A, C:\Users\Kalle\AppData\Roaming\vi-view, , [6625a855cfba9a9c408f23560cf7dc24], PUP.Optional.ViView.A, C:\Users\Kalle\AppData\Roaming\vi-view\log, , [6625a855cfba9a9c408f23560cf7dc24], Files: 15 PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, , [6a21d22b573263d3670420a7847d629e], PUP.Optional.Bunndle, C:\Program Files\CamStudio 2.7\BunndleOfferManager.exe, , [bbd013ea9ced4cea3c2b3a2318e8768a], PUP.Optional.WindowsProtectManger.A, C:\Users\Kalle\AppData\Local\Temp\~dl827A\~dljyb\tmp\wpm_v20.0.0.1277_.exe, , [a5e64cb155340f27e487c6011be60ef2], PUP.Optional.ClickCaption.A, C:\Users\Kalle\AppData\Local\Temp\is1901864539\5C7BB6F5_stp\clickcaption-setup-1.10.0.4.exe, , [ec9f54a93158f442552126c7748d41bf], PUP.Optional.MyStart.A, C:\Users\Kalle\AppData\Local\Temp\mystart-manifest.xml, , [bfcc0af34346bf77a3fa0b850bf822de], PUP.Optional.MyStart.A, C:\Users\Kalle\AppData\Local\Temp\mystart-toolbar.xml, , [62298a733b4e50e6ced0e2ae33d0de22], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-install-v0003, , [4c3f3dc098f1999d6adff70e907514ec], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-processes-v0002, , [7d0e20dd3d4cbd79fe4b48bdd134649c], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, , [bfcc78851f6a1d194ffa9c69f51046ba], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, , [96f5e91405841d194405798c19ecb947], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-uninstall-v0002, , [404b807d3b4e0d2949008d787a8bef11], PUP.Optional.Vitruvian.A, C:\Users\Kalle\AppData\Local\Temp\vitruvian-installer-vmdetect-v0001, , [c1ca07f6791079bdd2779e67858002fe], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [593298654f3a0432c2950d508e759a66], PUP.Optional.ViView.A, C:\Users\Kalle\AppData\Roaming\vi-view\UninstallManager.exe, , [6625a855cfba9a9c408f23560cf7dc24], PUP.Optional.ViView.A, C:\Users\Kalle\AppData\Roaming\vi-view\log\UninstallManager_2014-12-12[17-15-21-694].log, , [6625a855cfba9a9c408f23560cf7dc24], Physical Sectors: 0 (No malicious items detected) (end) |
|
30.01.2015, 10:53
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Avast Meldung Win32:Evo-gen [susp] Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
30.01.2015, 10:58
| #3 |
| | Avast Meldung Win32:Evo-gen [susp] Nein, ich hab leider keine anderen Logs. Hier der Scan mit Farbar's Recovery Scan Tool (FRST):
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015 Ran by Kalle (administrator) on KALLE-PC on 30-01-2015 10:55:32 Running from D:\ Loaded Profiles: Kalle (Available profiles: Kalle) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Windows\vVX3000.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Spotify Ltd) C:\Users\Kalle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Akamai Technologies, Inc.) C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (Akamai Technologies, Inc.) C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (CamStudio Group) C:\Program Files\CamStudio 2.7\Recorder.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403288 2014-08-09] (NVIDIA Corporation) HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [281312 2014-05-19] (Samsung Electronics Co., Ltd.) HKLM\...\Run: [EPSON Stylus DX3800 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIACE.EXE [98304 2005-02-08] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation) HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [Spotify Web Helper] => C:\Users\Kalle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-09] (Spotify Ltd) HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\MountPoints2: M - M:\setup.exe HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\MountPoints2: {7d4be02e-4714-11e4-a570-f80f41155235} - L:\HTC_Sync_Manager_PC.exe HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-28] (Microsoft Corporation) Startup: C:\Users\Kalle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://myhome.vi-view.com/web/?type=ds&ts=1418394890&from=cor&uid=WDCXWD10EADX-22TDHB0_WD-WCAV5T78794487944&q={searchTerms} HKU\S-1-5-21-1820279603-2735648936-400300262-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 80.69.102.158 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default FF Homepage: www.bild.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1820279603-2735648936-400300262-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Kalle\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF user.js: detected! => C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\user.js FF Extension: {26718ee7-b5c7-48bf-8235-3faf57dce69f} - C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\Extensions\{26718ee7-b5c7-48bf-8235-3faf57dce69f}.xpi [2014-12-11] FF Extension: Adblock Plus - C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-26] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-26] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-14] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-14] (Avast Software) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720792 2014-08-09] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18973144 2014-08-09] (NVIDIA Corporation) S3 Origin Client Service; C:\Origin\OriginClientService.exe [1910128 2015-01-27] (Electronic Arts) R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27872 2014-05-19] (Samsung Electronics Co., Ltd.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S4 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [485888 2014-12-12] (Fuyu LIMITED) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-14] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-14] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-14] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-14] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-14] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-14] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-14] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-14] () R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-26] (Disc Soft Ltd) R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-15] (Visicom Media Inc.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-30] (Malwarebytes Corporation) R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-15] (Visicom Media Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20440 2014-08-09] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation) R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [265952 2014-05-19] (Samsung Electronics Co., Ltd.) R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2014-05-19] (Samsung Electronics Co., Ltd.) R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-14] (Avast Software) S1 ccnfd_1_10_0_4; system32\drivers\ccnfd_1_10_0_4.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-30 10:55 - 2015-01-30 10:55 - 00000000 ____D () C:\FRST 2015-01-30 10:37 - 2015-01-30 10:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-30 10:37 - 2015-01-30 10:37 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-01-30 10:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-01-30 10:37 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-01-30 10:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-01-30 10:26 - 2015-01-30 10:26 - 00000197 _____ () C:\Windows\system32\2015-01-30-09-26-12.039-AvastVBoxSVC.exe-3248.log 2015-01-30 10:02 - 2015-01-30 10:02 - 00000197 _____ () C:\Windows\system32\2015-01-30-09-02-03.031-AvastVBoxSVC.exe-3044.log 2015-01-30 09:52 - 2015-01-30 09:52 - 00000197 _____ () C:\Windows\system32\2015-01-30-08-52-28.095-AvastVBoxSVC.exe-2992.log 2015-01-29 23:07 - 2015-01-29 23:07 - 00000000 ____D () C:\Users\Kalle\Documents\DyingLight 2015-01-29 22:56 - 2015-01-29 23:06 - 00000000 ____D () C:\Program Files (x86)\Dying Light 2015-01-29 22:56 - 2015-01-29 22:56 - 00000852 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light.lnk 2015-01-29 22:56 - 2015-01-29 22:56 - 00000840 _____ () C:\Users\Public\Desktop\Dying Light.lnk 2015-01-29 14:45 - 2015-01-29 14:46 - 00000197 _____ () C:\Windows\system32\2015-01-29-13-45-59.032-AvastVBoxSVC.exe-3748.log 2015-01-29 08:42 - 2015-01-29 08:43 - 00000197 _____ () C:\Windows\system32\2015-01-29-07-42-58.034-AvastVBoxSVC.exe-3800.log 2015-01-28 16:03 - 2015-01-28 16:03 - 00000197 _____ () C:\Windows\system32\2015-01-28-15-03-25.013-AvastVBoxSVC.exe-3580.log 2015-01-28 10:09 - 2015-01-28 10:10 - 00000197 _____ () C:\Windows\system32\2015-01-28-09-09-45.045-AvastVBoxSVC.exe-3064.log 2015-01-27 22:31 - 2015-01-27 22:31 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Unity 2015-01-27 15:20 - 2015-01-27 15:20 - 00000197 _____ () C:\Windows\system32\2015-01-27-14-20-51.057-AvastVBoxSVC.exe-3048.log 2015-01-27 09:40 - 2015-01-27 09:40 - 00000197 _____ () C:\Windows\system32\2015-01-27-08-40-20.093-AvastVBoxSVC.exe-3296.log 2015-01-26 22:15 - 2015-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-26 21:08 - 2015-01-26 21:09 - 00000998 _____ () C:\Users\Kalle\Desktop\SSC Service Utility.lnk 2015-01-26 21:08 - 2015-01-26 21:08 - 00003050 _____ () C:\Windows\System32\Tasks\{AE14BA3F-5FE5-45BA-87C8-248F2F9CFA51} 2015-01-26 09:58 - 2015-01-26 09:59 - 00000197 _____ () C:\Windows\system32\2015-01-26-08-58-24.023-AvastVBoxSVC.exe-3628.log 2015-01-25 17:43 - 2015-01-25 17:43 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-43-22.003-AvastVBoxSVC.exe-3556.log 2015-01-25 14:46 - 2015-01-25 14:46 - 00000197 _____ () C:\Windows\system32\2015-01-25-13-46-06.043-AvastVBoxSVC.exe-3444.log 2015-01-25 00:55 - 2015-01-25 00:55 - 00001374 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2015-01-25 00:55 - 2015-01-25 00:55 - 00001305 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Windows\PCHEALTH 2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Windows\de 2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Program Files (x86)\Windows Live 2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2015-01-25 00:55 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll 2015-01-25 00:55 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2015-01-25 00:55 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2015-01-25 00:55 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll 2015-01-25 00:54 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2015-01-25 00:54 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll 2015-01-25 00:54 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2015-01-25 00:54 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2015-01-25 00:54 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll 2015-01-25 00:54 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll 2015-01-25 00:52 - 2015-01-25 00:57 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Windows Live 2015-01-24 11:23 - 2015-01-24 11:24 - 00000197 _____ () C:\Windows\system32\2015-01-24-10-23-52.078-AvastVBoxSVC.exe-2284.log 2015-01-23 09:53 - 2015-01-23 09:53 - 00000197 _____ () C:\Windows\system32\2015-01-23-08-53-44.092-AvastVBoxSVC.exe-3008.log 2015-01-22 22:09 - 2015-01-22 22:09 - 00000000 ____D () C:\Users\Kalle\AppData\Local\CAPCOM 2015-01-22 09:54 - 2015-01-22 09:55 - 00000197 _____ () C:\Windows\system32\2015-01-22-08-54-57.083-AvastVBoxSVC.exe-3580.log 2015-01-21 09:48 - 2015-01-21 09:48 - 00000197 _____ () C:\Windows\system32\2015-01-21-08-48-27.069-AvastVBoxSVC.exe-3024.log 2015-01-20 10:20 - 2015-01-20 10:21 - 00000197 _____ () C:\Windows\system32\2015-01-20-09-20-48.017-AvastVBoxSVC.exe-3224.log 2015-01-19 09:58 - 2015-01-19 09:58 - 00000197 _____ () C:\Windows\system32\2015-01-19-08-58-16.063-AvastVBoxSVC.exe-2940.log 2015-01-18 12:40 - 2015-01-18 12:40 - 00000197 _____ () C:\Windows\system32\2015-01-18-11-40-19.060-AvastVBoxSVC.exe-2964.log 2015-01-17 18:35 - 2015-01-17 18:35 - 00000197 _____ () C:\Windows\system32\2015-01-17-17-35-38.038-AvastVBoxSVC.exe-2988.log 2015-01-17 09:38 - 2015-01-17 09:38 - 00000197 _____ () C:\Windows\system32\2015-01-17-08-38-03.049-AvastVBoxSVC.exe-3024.log 2015-01-16 10:28 - 2015-01-16 10:29 - 00000197 _____ () C:\Windows\system32\2015-01-16-09-28-16.045-AvastVBoxSVC.exe-3056.log 2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Traffic Shaper XP 2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\Program Files (x86)\Traffic Shaper XP Server 2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\Program Files (x86)\Traffic Shaper XP Client 2015-01-15 19:01 - 2015-01-15 19:00 - 00001536 _____ () C:\Windows\SysWOW64\bcevent.dll 2015-01-15 13:32 - 2015-01-15 13:32 - 00000197 _____ () C:\Windows\system32\2015-01-15-12-32-35.047-AvastVBoxSVC.exe-2900.log 2015-01-15 12:58 - 2015-01-15 12:58 - 00000197 _____ () C:\Windows\system32\2015-01-15-11-58-45.037-AvastVBoxSVC.exe-2960.log 2015-01-15 11:14 - 2015-01-15 11:14 - 00000197 _____ () C:\Windows\system32\2015-01-15-10-14-27.033-AvastVBoxSVC.exe-2384.log 2015-01-15 11:04 - 2015-01-15 11:05 - 00000197 _____ () C:\Windows\system32\2015-01-15-10-04-59.077-AvastVBoxSVC.exe-2900.log 2015-01-15 10:31 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-15 10:31 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-15 10:31 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-15 10:27 - 2015-01-15 10:28 - 00000197 _____ () C:\Windows\system32\2015-01-15-09-27-30.030-AvastVBoxSVC.exe-2104.log 2015-01-14 14:57 - 2015-01-14 14:57 - 00000197 _____ () C:\Windows\system32\2015-01-14-13-57-14.072-AvastVBoxSVC.exe-2428.log 2015-01-14 13:44 - 2015-01-14 13:44 - 00000247 _____ () C:\Windows\system32\2015-01-14-12-44-10.056-aswFe.exe-4756.log 2015-01-14 13:42 - 2015-01-14 13:44 - 00000247 _____ () C:\Windows\system32\2015-01-14-12-42-18.064-aswFe.exe-4016.log 2015-01-14 13:42 - 2015-01-14 13:42 - 00000197 _____ () C:\Windows\system32\2015-01-14-12-42-16.082-AvastVBoxSVC.exe-744.log 2015-01-14 13:35 - 2015-01-14 13:40 - 00000000 ____D () C:\Windows\SysWOW64\vbox 2015-01-14 13:35 - 2015-01-14 13:40 - 00000000 ____D () C:\Windows\system32\vbox 2015-01-14 13:31 - 2015-01-14 13:31 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2015-01-14 13:31 - 2015-01-14 13:31 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2015-01-14 13:31 - 2015-01-14 13:31 - 00001924 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2015-01-14 10:27 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 10:27 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 10:27 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 10:27 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-14 10:27 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-14 10:27 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-14 10:27 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 10:27 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 10:27 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 10:27 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-13 19:35 - 2015-01-13 19:39 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\TrafficMonitor 2015-01-13 19:35 - 2015-01-13 19:35 - 00000000 ____D () C:\ProgramData\TrafficMonitor 2015-01-11 02:40 - 2015-01-15 14:16 - 00000000 ____D () C:\Users\Kalle\Downloads\dream 2015-01-07 17:57 - 2015-01-07 17:57 - 00000000 ____D () C:\Users\Kalle\AppData\Local\.elfohilfe 2015-01-03 21:43 - 2015-01-25 03:40 - 00000000 ____D () C:\Users\Kalle\AppData\Local\ManyCam 2015-01-03 21:43 - 2015-01-03 21:43 - 00001021 _____ () C:\Users\Public\Desktop\ManyCam.lnk 2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\ManyCam 2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManyCam 2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\ManyCam 2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\EmailNotifier 2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\Program Files (x86)\ManyCam 2015-01-02 19:04 - 2015-01-02 19:04 - 00001179 _____ () C:\Users\Kalle\Desktop\Leviathan The Last Day of the Decade.lnk 2015-01-02 19:04 - 2015-01-02 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leviathan The Last Day of the Decade 2015-01-02 19:03 - 2015-01-02 19:04 - 00000000 ____D () C:\Program Files (x86)\Leviathan The Last Day of the Decade 2015-01-01 16:37 - 2015-01-03 18:25 - 00000012 _____ () C:\Users\Kalle\Desktop\Filme.txt ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-30 10:31 - 2009-07-14 05:45 - 00023728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-30 10:31 - 2009-07-14 05:45 - 00023728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-30 10:30 - 2009-07-14 18:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2015-01-30 10:30 - 2009-07-14 18:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2015-01-30 10:30 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-30 10:27 - 2014-05-26 17:29 - 01686428 _____ () C:\Windows\WindowsUpdate.log 2015-01-30 10:24 - 2014-05-28 12:10 - 00000096 _____ () C:\Users\Kalle\AppData\Roaming\version2.xml 2015-01-30 10:24 - 2014-05-26 18:26 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-01-30 10:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-30 10:24 - 2009-07-14 05:51 - 00093280 _____ () C:\Windows\setupact.log 2015-01-30 10:04 - 2014-05-26 18:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-30 09:59 - 2014-05-26 20:53 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Skype 2015-01-29 22:21 - 2014-08-10 12:02 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\vlc 2015-01-29 21:58 - 2014-05-28 12:15 - 00004546 _____ () C:\Users\Kalle\AppData\Roaming\CamStudio.cfg 2015-01-29 21:58 - 2014-05-28 12:15 - 00000408 _____ () C:\Users\Kalle\AppData\Roaming\CamShapes.ini 2015-01-29 21:58 - 2014-05-28 12:15 - 00000408 _____ () C:\Users\Kalle\AppData\Roaming\CamLayout.ini 2015-01-29 21:58 - 2014-05-28 12:15 - 00000103 _____ () C:\Users\Kalle\AppData\Roaming\Camdata.ini 2015-01-29 21:46 - 2014-05-28 12:12 - 00000000 ____D () C:\Users\Kalle\Documents\My CamStudio Temp Files 2015-01-29 18:12 - 2014-08-19 22:21 - 00000224 _____ () C:\Users\Kalle\BullseyeCoverageError.txt 2015-01-27 15:20 - 2014-10-21 16:30 - 00000000 ____D () C:\Origin 2015-01-27 15:20 - 2014-07-10 13:25 - 00000000 ____D () C:\ProgramData\Origin 2015-01-27 15:18 - 2014-05-26 20:52 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-01-27 15:16 - 2014-05-26 18:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-27 15:16 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-27 12:49 - 2014-05-26 17:29 - 00000000 ____D () C:\Users\Kalle 2015-01-26 21:09 - 2014-09-24 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSC Service Utility 2015-01-26 21:09 - 2014-09-24 17:54 - 00000000 ____D () C:\Program Files (x86)\SSC Service Utility 2015-01-25 17:40 - 2014-05-27 10:27 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\foobar2000 2015-01-25 17:28 - 2014-06-11 16:19 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Spotify 2015-01-25 17:23 - 2014-06-11 16:19 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Spotify 2015-01-25 17:01 - 2014-06-11 16:16 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Last.fm 2015-01-25 01:04 - 2014-05-26 18:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-25 01:04 - 2014-05-26 18:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-25 01:04 - 2014-05-26 18:54 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-25 00:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2015-01-25 00:54 - 2014-05-26 21:08 - 00053811 _____ () C:\Windows\DirectX.log 2015-01-24 17:48 - 2014-12-12 15:34 - 00000000 ____D () C:\Users\Kalle\AppData\Local\JDownloader v2.0 2015-01-16 01:13 - 2014-05-26 18:25 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2015-01-15 14:38 - 2014-05-27 09:33 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\MPC-HC 2015-01-15 11:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-01-14 13:46 - 2014-05-26 18:38 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-14 13:44 - 2014-05-26 18:38 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-14 13:32 - 2014-05-26 18:14 - 00093804 _____ () C:\Windows\PFRO.log 2015-01-14 13:31 - 2014-05-26 20:52 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-01-14 13:31 - 2014-05-26 20:52 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-01-11 02:36 - 2014-05-27 09:08 - 00000000 ____D () C:\Program Files (x86)\JDownloader 2015-01-06 04:36 - 2014-05-26 18:53 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-01-03 18:46 - 2014-10-22 17:48 - 00000868 _____ () C:\Users\Kalle\Desktop\kk.txt 2015-01-02 20:52 - 2014-07-30 21:23 - 00000000 ____D () C:\Users\Kalle\Documents\ArcheAge 2015-01-02 20:41 - 2014-07-30 20:08 - 00000000 ____D () C:\Program Files (x86)\Glyph 2015-01-01 17:25 - 2014-05-18 09:23 - 00000000 ____D () C:\Users\Kalle\Desktop\SFDL.NET 2.2.9.2 2014-12-31 00:37 - 2014-12-30 23:24 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin 2014-12-31 00:37 - 2014-12-30 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AeriaGames ==================== Files in the root of some directories ======= 2014-05-28 12:15 - 2015-01-29 21:58 - 0000103 _____ () C:\Users\Kalle\AppData\Roaming\Camdata.ini 2014-05-28 12:15 - 2015-01-29 21:58 - 0000408 _____ () C:\Users\Kalle\AppData\Roaming\CamLayout.ini 2014-05-28 12:15 - 2015-01-29 21:58 - 0000408 _____ () C:\Users\Kalle\AppData\Roaming\CamShapes.ini 2014-05-28 12:15 - 2015-01-29 21:58 - 0004546 _____ () C:\Users\Kalle\AppData\Roaming\CamStudio.cfg 2014-05-28 12:10 - 2015-01-30 10:24 - 0000096 _____ () C:\Users\Kalle\AppData\Roaming\version2.xml 2014-10-20 13:56 - 2014-10-20 13:56 - 0023147 _____ () C:\Users\Kalle\AppData\Local\recently-used.xbel 2008-02-05 12:28 - 2008-02-05 12:28 - 0000051 _____ () C:\Users\Kalle\AppData\Local\setup.txt Some content of TEMP: ==================== C:\Users\Kalle\AppData\Local\Temp\130628684657154330.exe C:\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe C:\Users\Kalle\AppData\Local\Temp\BullseyeCoverage-2-x86.dll C:\Users\Kalle\AppData\Local\Temp\guninst.exe C:\Users\Kalle\AppData\Local\Temp\proxy_vole2177688362422398821.dll C:\Users\Kalle\AppData\Local\Temp\Samsung_Magician_Setup_v45.exe C:\Users\Kalle\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-24 16:49 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by Kalle at 2015-01-30 10:55:49
Running from D:\
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\uTorrent) (Version: 3.4.2.34727 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Activision(R) (x32 Version: 1.00.0000 - Activision) Hidden
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIDA64 Extreme v4.30 (HKLM-x32\...\AIDA64 Extreme_is1) (Version: 4.30 - FinalWire Ltd.)
Akamai NetSession Interface (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
ANSTOSS 3 (HKLM-x32\...\ANSTOSS 3_is1) (Version: - )
Archeage Beta (HKLM-x32\...\Glyph Archeage Beta) (Version: - Trion Worlds, Inc.)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.0.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version: - Cheat Engine)
Combined Community Codec Pack 2014-04-20 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2014.04.20.0 - CCCP Project)
CPUID HWMonitor 1.25 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
CrystalDiskInfo 5.0.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.0.0 - Crystal Dew World)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.732.20 - Electronic Arts Inc.)
Dying Light (HKLM-x32\...\RHlpbmdMaWdodA==_is1) (Version: 1 - )
EA SPORTS™ FIFA 15 Demo (HKLM-x32\...\{108C0C19-6316-4944-A62F-C744488F8639}) (Version: 1.0.0.0 - Electronic Arts)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.3.20141106 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - )
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
foobar2000 v1.3.2 (HKLM-x32\...\foobar2000) (Version: 1.3.2 - Peter Pawlowski)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)
HexChat (HKLM\...\HexChat_is1) (Version: 2.10.1 - HexChat)
Intel(R) Network Connections 15.6.25.0 (HKLM\...\PROSetDX) (Version: 15.6.25.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Last.fm Scrobbler 2.1.36 (HKLM-x32\...\LastFM_is1) (Version: - Last.fm)
Leviathan The Last Day of the Decade (HKLM-x32\...\Leviathan The Last Day of the Decade_is1) (Version: - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
ManyCam 4.1.0 (HKLM-x32\...\ManyCam) (Version: 4.1.0 - Visicom Media Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Pro Evolution Soccer 2015 (HKLM-x32\...\UHJvRXZvbHV0aW9uU29jY2VyMjAxNQ==_is1) (Version: 1 - )
RAPID Mode (Version: 1.0.1.68 - Samsung Electronics Co., Ltd.) Hidden
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RollerCoaster Tycoon Deluxe (HKLM-x32\...\{924EAD66-F854-4605-8493-696DD59A113B}) (Version: 1.00.000 - )
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
SSC Service Utility v3.10 (HKLM-x32\...\SSC Service Utility_is1) (Version: - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
System Requirements Lab CYRI (HKLM-x32\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
The Sims 4 (HKLM-x32\...\VGhlU2ltczQ=_is1) (Version: 1 - )
Unity Web Player (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VueScan x64 (HKLM\...\VueScan x64) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.3) (Version: 1.3.3 - Xvid Team)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
26-12-2014 18:27:09 Removed blueMSX
30-12-2014 11:21:08 Windows Update
30-12-2014 23:08:23 Installed Install(US)2
30-12-2014 23:10:59 Removed Install(US)2
31-12-2014 00:36:57 Removed Aeria Ignite
03-01-2015 21:43:26 Gerätetreiber-Paketinstallation: Visicom Media Inc. Bildverarbeitungsgeräte
03-01-2015 21:43:34 Gerätetreiber-Paketinstallation: Visicom Media Inc. Audio-, Video- und Gamecontroller
06-01-2015 10:19:16 Windows Update
09-01-2015 10:28:34 Windows Update
14-01-2015 10:27:08 Windows Update
14-01-2015 13:27:49 avast! antivirus system restore point
14-01-2015 13:44:26 Windows Update
15-01-2015 11:11:24 Windows Update
15-01-2015 19:01:12 Gerätetreiber-Paketinstallation: Bandwidth Controller Netzwerkdienst
15-01-2015 19:01:20 Gerätetreiber-Paketinstallation: Bandwidth Controller Netzwerkadapter
16-01-2015 01:12:34 Windows Update
20-01-2015 10:24:40 Windows Update
25-01-2015 00:52:55 Windows Live Essentials
25-01-2015 00:54:27 DirectX wurde installiert
25-01-2015 00:54:41 DirectX wurde installiert
25-01-2015 00:54:51 DirectX wurde installiert
25-01-2015 00:55:22 WLSetup
27-01-2015 09:42:18 Windows Update
30-01-2015 09:54:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {3479E88B-7B86-4901-94E8-A4413378ED78} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {5B70AAD0-E50A-4249-99CA-DD2ED8A986B1} - System32\Tasks\{54C0989D-8919-425D-96C3-2E4721D2218A} => pcalua.exe -a C:\Users\Kalle\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {7B573B87-373F-4D2B-AD9E-18AEF380A8ED} - System32\Tasks\{AE14BA3F-5FE5-45BA-87C8-248F2F9CFA51} => pcalua.exe -a D:\epson-resetter.exe -d D:\
Task: {80DCD21C-6605-4E64-BB32-4E04EE7441BF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {82A0D857-39EE-4F57-8C99-BA4FC1BA2377} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-14] (AVAST Software)
Task: {8FFC5279-9CF8-4E0A-9821-B33D6728B02F} - System32\Tasks\{79CDEE95-7B47-41C5-9709-BF4D6AB3799C} => pcalua.exe -a "C:\Program Files (x86)\ANSTOSS 3\SGLSetup.exe" -d "C:\Program Files (x86)\ANSTOSS 3"
Task: {E07B6CBB-F96A-449D-B16F-341CC17F910D} - System32\Tasks\{3A2A5706-6749-424E-92CB-8B4CF09F98F5} => pcalua.exe -a "C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\bin\addoninstaller.exe" -d "C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2" -c /register
Task: {FAA0757D-8C8E-4D7C-8D30-1A88B6C2C5EF} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-05-26 18:25 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-01-29 22:46 - 2015-01-29 22:46 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012901\algo.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-05-26 18:11 - 2014-05-06 10:24 - 00013824 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00103424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\PAL.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00039424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SATA.dll
2014-05-26 18:11 - 2014-05-19 19:19 - 00038400 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAT.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00031232 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SMINI.dll
2014-05-26 18:11 - 2014-05-19 19:19 - 00029696 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAS.dll
2015-01-26 22:15 - 2015-01-26 22:15 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-28 12:07 - 2013-10-17 22:06 - 00074752 _____ () C:\Program Files\CamStudio 2.7\libconfig++.dll
2014-10-16 14:26 - 2014-10-16 14:26 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2014-06-04 22:06 - 2010-11-05 22:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-25 01:04 - 2015-01-25 01:04 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1820279603-2735648936-400300262-500 - Administrator - Disabled)
Gast (S-1-5-21-1820279603-2735648936-400300262-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1820279603-2735648936-400300262-1002 - Limited - Enabled)
Kalle (S-1-5-21-1820279603-2735648936-400300262-1000 - Administrator - Enabled) => C:\Users\Kalle
==================== Faulty Device Manager Devices =============
Name: ccnfd_1_10_0_4
Description: ccnfd_1_10_0_4
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ccnfd_1_10_0_4
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]
Error: (01/26/2015 09:09:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ssc_serv.exe, Version: 3.1.0.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7efde000
ID des fehlerhaften Prozesses: 0x1cd8
Startzeit der fehlerhaften Anwendung: 0xssc_serv.exe0
Pfad der fehlerhaften Anwendung: ssc_serv.exe1
Pfad des fehlerhaften Moduls: ssc_serv.exe2
Berichtskennung: ssc_serv.exe3
Error: (01/26/2015 09:08:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ssc_serv.exe, Version: 3.1.0.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7efde000
ID des fehlerhaften Prozesses: 0x3390
Startzeit der fehlerhaften Anwendung: 0xssc_serv.exe0
Pfad der fehlerhaften Anwendung: ssc_serv.exe1
Pfad des fehlerhaften Moduls: ssc_serv.exe2
Berichtskennung: ssc_serv.exe3
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]
Error: (01/24/2015 03:50:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpc-hc.exe, Version: 1.7.4.2, Zeitstempel: 0x5352f87c
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x2018
Startzeit der fehlerhaften Anwendung: 0xmpc-hc.exe0
Pfad der fehlerhaften Anwendung: mpc-hc.exe1
Pfad des fehlerhaften Moduls: mpc-hc.exe2
Berichtskennung: mpc-hc.exe3
Error: (01/24/2015 11:23:45 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
System errors:
=============
Error: (01/30/2015 10:24:50 AM) (Source: DCOM) (EventID: 10016) (User: Kalle-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}Kalle-PCKalleS-1-5-21-1820279603-2735648936-400300262-1000LocalHost (unter Verwendung von LRPC)
Error: (01/30/2015 10:24:12 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ccnfd_1_10_0_4
Error: (01/30/2015 10:00:03 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ccnfd_1_10_0_4
Error: (01/30/2015 09:58:58 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "avast! Antivirus" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/30/2015 09:50:28 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ccnfd_1_10_0_4
Error: (01/29/2015 05:50:42 PM) (Source: DCOM) (EventID: 10016) (User: Kalle-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}Kalle-PCKalleS-1-5-21-1820279603-2735648936-400300262-1000LocalHost (unter Verwendung von LRPC)
Error: (01/29/2015 04:19:58 PM) (Source: DCOM) (EventID: 10016) (User: Kalle-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}Kalle-PCKalleS-1-5-21-1820279603-2735648936-400300262-1000LocalHost (unter Verwendung von LRPC)
Error: (01/29/2015 02:45:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ccnfd_1_10_0_4
Error: (01/29/2015 08:54:35 AM) (Source: DCOM) (EventID: 10016) (User: Kalle-PC)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}Kalle-PCKalleS-1-5-21-1820279603-2735648936-400300262-1000LocalHost (unter Verwendung von LRPC)
Error: (01/29/2015 08:40:57 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ccnfd_1_10_0_4
Microsoft Office Sessions:
=========================
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
Error: (01/27/2015 09:38:21 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]
Error: (01/26/2015 09:09:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ssc_serv.exe3.1.0.02a425e19unknown0.0.0.000000000c00000057efde0001cd801d039a3eff2d323C:\Program Files (x86)\SSC Service Utility\ssc_serv.exeunknown2dcbd583-a597-11e4-9116-f80f41155235
Error: (01/26/2015 09:08:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ssc_serv.exe3.1.0.02a425e19unknown0.0.0.000000000c00000057efde000339001d039a3e2179052C:\Program Files (x86)\SSC Service Utility\ssc_serv.exeunknown207fdc7b-a597-11e4-9116-f80f41155235
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]
Error: (01/25/2015 02:45:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]
Error: (01/24/2015 03:50:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpc-hc.exe1.7.4.25352f87cKERNELBASE.dll6.1.7601.1840953159a86e06d73630000c42d201801d037e27092ba57C:\Program Files (x86)\Combined Community Codec Pack\MPC\mpc-hc.exeC:\Windows\syswow64\KERNELBASE.dll56c4c986-a3d8-11e4-af7e-f80f41155235
Error: (01/24/2015 11:23:45 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
CodeIntegrity Errors:
===================================
Date: 2014-12-16 12:30:53.450
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Users\Kalle\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.353
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Users\Kalle\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.241
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.143
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 42%
Total physical RAM: 8174 MB
Available physical RAM: 4699.21 MB
Total Pagefile: 16346.18 MB
Available Pagefile: 12555.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:49.96 GB) NTFS
Drive d: () (Fixed) (Total:465.76 GB) (Free:158.85 GB) NTFS
Drive e: (Musik) (Fixed) (Total:465.75 GB) (Free:462.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D78CB2D0)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 46E6BF93)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
30.01.2015, 11:32
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp] Wo genau hat Avast denn den 'Win32:Evo-gen' gefunden? Geht so aus deinem Posting nicht hervor. Schau bitte bei Avast nach, notiere die Meldung und poste das hier. Außerdem: Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
30.01.2015, 12:07
| #5 |
| | Avast Meldung Win32:Evo-gen [susp] Oh sorry. Der lädt die Dateien automatisch auf D: runter, deshalb von da gestartet. Gefunden in: C:\ProgrammData\WindowsMangerProtect\ProtectWindowsManager.exe |
|
30.01.2015, 12:20
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp] Hat MBAM schon gelöscht...aber da wird sicher noch was sein: Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Avast Meldung Win32:Evo-gen [susp] |
|
30.01.2015, 12:37
| #7 |
| | Avast Meldung Win32:Evo-gen [susp]Code:
ATTFilter # AdwCleaner v4.109 - Bericht erstellt am 30/01/2015 um 12:28:19
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-26.1 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Kalle - KALLE-PC
# Gestartet von : C:\Users\Kalle\Desktop\AdwCleaner_4.109.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : WindowsMangerProtect
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Kalle\AppData\Roaming\vi-view
Datei Gelöscht : C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Email Notifier
Schlüssel Gelöscht : HKLM\SOFTWARE\mystarttb
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\ClickCaption_1.10.0.4
Schlüssel Gelöscht : HKLM\SOFTWARE\vi-viewSoftware
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\myhome.vi-view.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\vi-view.com
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17496
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v35.0.1 (x86 de)
[lemkyszm.default\prefs.js] - Zeile gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[lemkyszm.default\prefs.js] - Zeile gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
AdwCleaner[R0].txt - [7240 octets] - [09/09/2014 20:55:37]
AdwCleaner[R1].txt - [3038 octets] - [30/01/2015 12:27:34]
AdwCleaner[S0].txt - [6359 octets] - [09/09/2014 20:56:15]
AdwCleaner[S1].txt - [2451 octets] - [30/01/2015 12:28:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2511 octets] ##########
Code:
ATTFilter Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Kalle on 30.01.2015 at 12:30:31,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update webget
~~~ Files
Successfully deleted: [File] C:\Windows\prefetch\DRIVERUPDATERSETUP-2.0.0.7614-C4FA78D5.pf
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Kalle\appdata\local\tempdir"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\Kalle\AppData\Roaming\mozilla\firefox\profiles\lemkyszm.default\minidumps [70 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.01.2015 at 12:33:08,97
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by Kalle (administrator) on KALLE-PC on 30-01-2015 12:34:24
Running from C:\Users\Kalle\Desktop
Loaded Profiles: Kalle (Available profiles: Kalle)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\RAPID\SamsungRapidSvc.exe
(Spotify Ltd) C:\Users\Kalle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Thisisu) D:\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403288 2014-08-09] (NVIDIA Corporation)
HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [SamsungRapidApp] => C:\Program Files (x86)\Samsung\RAPID\CacheFilter\SamsungRapidApp.exe [281312 2014-05-19] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [EPSON Stylus DX3800 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIACE.EXE [98304 2005-02-08] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [Spotify Web Helper] => C:\Users\Kalle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-09] (Spotify Ltd)
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Kalle\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\MountPoints2: M - M:\setup.exe
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\MountPoints2: {7d4be02e-4714-11e4-a570-f80f41155235} - L:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-28] (Microsoft Corporation)
Startup: C:\Users\Kalle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1820279603-2735648936-400300262-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 80.69.102.158 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default
FF Homepage: www.bild.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1820279603-2735648936-400300262-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Kalle\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: {26718ee7-b5c7-48bf-8235-3faf57dce69f} - C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\Extensions\{26718ee7-b5c7-48bf-8235-3faf57dce69f}.xpi [2014-12-11]
FF Extension: Adblock Plus - C:\Users\Kalle\AppData\Roaming\Mozilla\Firefox\Profiles\lemkyszm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-26]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-26]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-14] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-14] (Avast Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720792 2014-08-09] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18973144 2014-08-09] (NVIDIA Corporation)
S3 Origin Client Service; C:\Origin\OriginClientService.exe [1910128 2015-01-27] (Electronic Arts)
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27872 2014-05-19] (Samsung Electronics Co., Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-14] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-14] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-14] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-14] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-14] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-26] (Disc Soft Ltd)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-15] (Visicom Media Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-30] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-15] (Visicom Media Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20440 2014-08-09] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [265952 2014-05-19] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2014-05-19] (Samsung Electronics Co., Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-14] (Avast Software)
S1 ccnfd_1_10_0_4; system32\drivers\ccnfd_1_10_0_4.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-30 12:34 - 2015-01-30 12:34 - 00014093 _____ () C:\Users\Kalle\Desktop\FRST.txt
2015-01-30 12:33 - 2015-01-30 12:33 - 00001120 _____ () C:\Users\Kalle\Desktop\JRT.txt
2015-01-30 12:30 - 2015-01-30 12:30 - 00000000 ____D () C:\Windows\ERUNT
2015-01-30 12:29 - 2015-01-30 12:29 - 00000197 _____ () C:\Windows\system32\2015-01-30-11-29-05.036-AvastVBoxSVC.exe-3640.log
2015-01-30 10:55 - 2015-01-30 12:34 - 00000000 ____D () C:\FRST
2015-01-30 10:55 - 2015-01-30 10:55 - 02130432 _____ (Farbar) C:\Users\Kalle\Desktop\FRST64.exe
2015-01-30 10:37 - 2015-01-30 10:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-30 10:37 - 2015-01-30 10:37 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-30 10:37 - 2015-01-30 10:37 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-30 10:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-30 10:37 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-30 10:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-30 10:26 - 2015-01-30 10:26 - 00000197 _____ () C:\Windows\system32\2015-01-30-09-26-12.039-AvastVBoxSVC.exe-3248.log
2015-01-30 10:02 - 2015-01-30 10:02 - 00000197 _____ () C:\Windows\system32\2015-01-30-09-02-03.031-AvastVBoxSVC.exe-3044.log
2015-01-30 09:52 - 2015-01-30 09:52 - 00000197 _____ () C:\Windows\system32\2015-01-30-08-52-28.095-AvastVBoxSVC.exe-2992.log
2015-01-29 23:07 - 2015-01-29 23:07 - 00000000 ____D () C:\Users\Kalle\Documents\DyingLight
2015-01-29 22:56 - 2015-01-29 23:06 - 00000000 ____D () C:\Program Files (x86)\Dying Light
2015-01-29 22:56 - 2015-01-29 22:56 - 00000852 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dying Light.lnk
2015-01-29 22:56 - 2015-01-29 22:56 - 00000840 _____ () C:\Users\Public\Desktop\Dying Light.lnk
2015-01-29 14:45 - 2015-01-29 14:46 - 00000197 _____ () C:\Windows\system32\2015-01-29-13-45-59.032-AvastVBoxSVC.exe-3748.log
2015-01-29 08:42 - 2015-01-29 08:43 - 00000197 _____ () C:\Windows\system32\2015-01-29-07-42-58.034-AvastVBoxSVC.exe-3800.log
2015-01-28 16:03 - 2015-01-28 16:03 - 00000197 _____ () C:\Windows\system32\2015-01-28-15-03-25.013-AvastVBoxSVC.exe-3580.log
2015-01-28 10:09 - 2015-01-28 10:10 - 00000197 _____ () C:\Windows\system32\2015-01-28-09-09-45.045-AvastVBoxSVC.exe-3064.log
2015-01-27 22:31 - 2015-01-27 22:31 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Unity
2015-01-27 15:20 - 2015-01-27 15:20 - 00000197 _____ () C:\Windows\system32\2015-01-27-14-20-51.057-AvastVBoxSVC.exe-3048.log
2015-01-27 09:40 - 2015-01-27 09:40 - 00000197 _____ () C:\Windows\system32\2015-01-27-08-40-20.093-AvastVBoxSVC.exe-3296.log
2015-01-26 22:15 - 2015-01-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 21:08 - 2015-01-26 21:09 - 00000998 _____ () C:\Users\Kalle\Desktop\SSC Service Utility.lnk
2015-01-26 21:08 - 2015-01-26 21:08 - 00003050 _____ () C:\Windows\System32\Tasks\{AE14BA3F-5FE5-45BA-87C8-248F2F9CFA51}
2015-01-26 09:58 - 2015-01-26 09:59 - 00000197 _____ () C:\Windows\system32\2015-01-26-08-58-24.023-AvastVBoxSVC.exe-3628.log
2015-01-25 17:43 - 2015-01-25 17:43 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-43-22.003-AvastVBoxSVC.exe-3556.log
2015-01-25 14:46 - 2015-01-25 14:46 - 00000197 _____ () C:\Windows\system32\2015-01-25-13-46-06.043-AvastVBoxSVC.exe-3444.log
2015-01-25 00:55 - 2015-01-25 00:55 - 00001374 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-01-25 00:55 - 2015-01-25 00:55 - 00001305 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Windows\PCHEALTH
2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Windows\de
2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-01-25 00:55 - 2015-01-25 00:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2015-01-25 00:55 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-01-25 00:55 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-01-25 00:55 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-01-25 00:55 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-01-25 00:54 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-01-25 00:54 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-01-25 00:54 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-01-25 00:54 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-01-25 00:54 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-01-25 00:54 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-01-25 00:52 - 2015-01-25 00:57 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Windows Live
2015-01-24 11:23 - 2015-01-24 11:24 - 00000197 _____ () C:\Windows\system32\2015-01-24-10-23-52.078-AvastVBoxSVC.exe-2284.log
2015-01-23 09:53 - 2015-01-23 09:53 - 00000197 _____ () C:\Windows\system32\2015-01-23-08-53-44.092-AvastVBoxSVC.exe-3008.log
2015-01-22 22:09 - 2015-01-22 22:09 - 00000000 ____D () C:\Users\Kalle\AppData\Local\CAPCOM
2015-01-22 09:54 - 2015-01-22 09:55 - 00000197 _____ () C:\Windows\system32\2015-01-22-08-54-57.083-AvastVBoxSVC.exe-3580.log
2015-01-21 09:48 - 2015-01-21 09:48 - 00000197 _____ () C:\Windows\system32\2015-01-21-08-48-27.069-AvastVBoxSVC.exe-3024.log
2015-01-20 10:20 - 2015-01-20 10:21 - 00000197 _____ () C:\Windows\system32\2015-01-20-09-20-48.017-AvastVBoxSVC.exe-3224.log
2015-01-19 09:58 - 2015-01-19 09:58 - 00000197 _____ () C:\Windows\system32\2015-01-19-08-58-16.063-AvastVBoxSVC.exe-2940.log
2015-01-18 12:40 - 2015-01-18 12:40 - 00000197 _____ () C:\Windows\system32\2015-01-18-11-40-19.060-AvastVBoxSVC.exe-2964.log
2015-01-17 18:35 - 2015-01-17 18:35 - 00000197 _____ () C:\Windows\system32\2015-01-17-17-35-38.038-AvastVBoxSVC.exe-2988.log
2015-01-17 09:38 - 2015-01-17 09:38 - 00000197 _____ () C:\Windows\system32\2015-01-17-08-38-03.049-AvastVBoxSVC.exe-3024.log
2015-01-16 10:28 - 2015-01-16 10:29 - 00000197 _____ () C:\Windows\system32\2015-01-16-09-28-16.045-AvastVBoxSVC.exe-3056.log
2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Traffic Shaper XP
2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\Program Files (x86)\Traffic Shaper XP Server
2015-01-15 19:01 - 2015-01-15 19:01 - 00000000 ____D () C:\Program Files (x86)\Traffic Shaper XP Client
2015-01-15 19:01 - 2015-01-15 19:00 - 00001536 _____ () C:\Windows\SysWOW64\bcevent.dll
2015-01-15 13:32 - 2015-01-15 13:32 - 00000197 _____ () C:\Windows\system32\2015-01-15-12-32-35.047-AvastVBoxSVC.exe-2900.log
2015-01-15 12:58 - 2015-01-15 12:58 - 00000197 _____ () C:\Windows\system32\2015-01-15-11-58-45.037-AvastVBoxSVC.exe-2960.log
2015-01-15 11:14 - 2015-01-15 11:14 - 00000197 _____ () C:\Windows\system32\2015-01-15-10-14-27.033-AvastVBoxSVC.exe-2384.log
2015-01-15 11:04 - 2015-01-15 11:05 - 00000197 _____ () C:\Windows\system32\2015-01-15-10-04-59.077-AvastVBoxSVC.exe-2900.log
2015-01-15 10:31 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-15 10:31 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-15 10:31 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-15 10:27 - 2015-01-15 10:28 - 00000197 _____ () C:\Windows\system32\2015-01-15-09-27-30.030-AvastVBoxSVC.exe-2104.log
2015-01-14 14:57 - 2015-01-14 14:57 - 00000197 _____ () C:\Windows\system32\2015-01-14-13-57-14.072-AvastVBoxSVC.exe-2428.log
2015-01-14 13:44 - 2015-01-14 13:44 - 00000247 _____ () C:\Windows\system32\2015-01-14-12-44-10.056-aswFe.exe-4756.log
2015-01-14 13:42 - 2015-01-14 13:44 - 00000247 _____ () C:\Windows\system32\2015-01-14-12-42-18.064-aswFe.exe-4016.log
2015-01-14 13:42 - 2015-01-14 13:42 - 00000197 _____ () C:\Windows\system32\2015-01-14-12-42-16.082-AvastVBoxSVC.exe-744.log
2015-01-14 13:35 - 2015-01-14 13:40 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-01-14 13:35 - 2015-01-14 13:40 - 00000000 ____D () C:\Windows\system32\vbox
2015-01-14 13:31 - 2015-01-14 13:31 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-14 13:31 - 2015-01-14 13:31 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-14 13:31 - 2015-01-14 13:31 - 00001924 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-01-14 10:27 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 10:27 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 10:27 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 10:27 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 10:27 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 10:27 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 10:27 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 10:27 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 10:27 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 10:27 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 19:35 - 2015-01-13 19:39 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\TrafficMonitor
2015-01-13 19:35 - 2015-01-13 19:35 - 00000000 ____D () C:\ProgramData\TrafficMonitor
2015-01-11 02:40 - 2015-01-15 14:16 - 00000000 ____D () C:\Users\Kalle\Downloads\dream
2015-01-07 17:57 - 2015-01-07 17:57 - 00000000 ____D () C:\Users\Kalle\AppData\Local\.elfohilfe
2015-01-03 21:43 - 2015-01-25 03:40 - 00000000 ____D () C:\Users\Kalle\AppData\Local\ManyCam
2015-01-03 21:43 - 2015-01-03 21:43 - 00001021 _____ () C:\Users\Public\Desktop\ManyCam.lnk
2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\ManyCam
2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManyCam
2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\ManyCam
2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\ProgramData\EmailNotifier
2015-01-03 21:43 - 2015-01-03 21:43 - 00000000 ____D () C:\Program Files (x86)\ManyCam
2015-01-02 19:04 - 2015-01-02 19:04 - 00001179 _____ () C:\Users\Kalle\Desktop\Leviathan The Last Day of the Decade.lnk
2015-01-02 19:04 - 2015-01-02 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leviathan The Last Day of the Decade
2015-01-02 19:03 - 2015-01-02 19:04 - 00000000 ____D () C:\Program Files (x86)\Leviathan The Last Day of the Decade
2015-01-01 16:37 - 2015-01-03 18:25 - 00000012 _____ () C:\Users\Kalle\Desktop\Filme.txt
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-30 12:32 - 2014-05-26 17:29 - 01693458 _____ () C:\Windows\WindowsUpdate.log
2015-01-30 12:28 - 2014-09-09 20:55 - 00000000 ____D () C:\AdwCleaner
2015-01-30 12:28 - 2014-05-26 18:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-30 12:28 - 2014-05-26 18:14 - 00094388 _____ () C:\Windows\PFRO.log
2015-01-30 12:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-30 12:28 - 2009-07-14 05:51 - 00093448 _____ () C:\Windows\setupact.log
2015-01-30 12:04 - 2014-05-26 18:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-30 10:59 - 2009-07-14 05:45 - 00023728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-30 10:59 - 2009-07-14 05:45 - 00023728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-30 10:30 - 2009-07-14 18:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-01-30 10:30 - 2009-07-14 18:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-01-30 10:30 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-30 10:24 - 2014-05-28 12:10 - 00000096 _____ () C:\Users\Kalle\AppData\Roaming\version2.xml
2015-01-30 09:59 - 2014-05-26 20:53 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Skype
2015-01-29 22:21 - 2014-08-10 12:02 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\vlc
2015-01-29 21:58 - 2014-05-28 12:15 - 00004546 _____ () C:\Users\Kalle\AppData\Roaming\CamStudio.cfg
2015-01-29 21:58 - 2014-05-28 12:15 - 00000408 _____ () C:\Users\Kalle\AppData\Roaming\CamShapes.ini
2015-01-29 21:58 - 2014-05-28 12:15 - 00000408 _____ () C:\Users\Kalle\AppData\Roaming\CamLayout.ini
2015-01-29 21:58 - 2014-05-28 12:15 - 00000103 _____ () C:\Users\Kalle\AppData\Roaming\Camdata.ini
2015-01-29 21:46 - 2014-05-28 12:12 - 00000000 ____D () C:\Users\Kalle\Documents\My CamStudio Temp Files
2015-01-29 18:12 - 2014-08-19 22:21 - 00000224 _____ () C:\Users\Kalle\BullseyeCoverageError.txt
2015-01-27 15:20 - 2014-10-21 16:30 - 00000000 ____D () C:\Origin
2015-01-27 15:20 - 2014-07-10 13:25 - 00000000 ____D () C:\ProgramData\Origin
2015-01-27 15:18 - 2014-05-26 20:52 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-27 15:16 - 2014-05-26 18:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 15:16 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-27 12:49 - 2014-05-26 17:29 - 00000000 ____D () C:\Users\Kalle
2015-01-26 21:09 - 2014-09-24 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSC Service Utility
2015-01-26 21:09 - 2014-09-24 17:54 - 00000000 ____D () C:\Program Files (x86)\SSC Service Utility
2015-01-25 17:40 - 2014-05-27 10:27 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\foobar2000
2015-01-25 17:28 - 2014-06-11 16:19 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\Spotify
2015-01-25 17:23 - 2014-06-11 16:19 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Spotify
2015-01-25 17:01 - 2014-06-11 16:16 - 00000000 ____D () C:\Users\Kalle\AppData\Local\Last.fm
2015-01-25 01:04 - 2014-05-26 18:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 01:04 - 2014-05-26 18:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 01:04 - 2014-05-26 18:54 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 00:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-01-25 00:54 - 2014-05-26 21:08 - 00053811 _____ () C:\Windows\DirectX.log
2015-01-24 17:48 - 2014-12-12 15:34 - 00000000 ____D () C:\Users\Kalle\AppData\Local\JDownloader v2.0
2015-01-16 01:13 - 2014-05-26 18:25 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-15 14:38 - 2014-05-27 09:33 - 00000000 ____D () C:\Users\Kalle\AppData\Roaming\MPC-HC
2015-01-15 11:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-14 13:46 - 2014-05-26 18:38 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 13:44 - 2014-05-26 18:38 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 13:31 - 2014-05-26 20:52 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-14 13:31 - 2014-05-26 20:52 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-11 02:36 - 2014-05-27 09:08 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2015-01-06 04:36 - 2014-05-26 18:53 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-03 18:46 - 2014-10-22 17:48 - 00000868 _____ () C:\Users\Kalle\Desktop\kk.txt
2015-01-02 20:52 - 2014-07-30 21:23 - 00000000 ____D () C:\Users\Kalle\Documents\ArcheAge
2015-01-02 20:41 - 2014-07-30 20:08 - 00000000 ____D () C:\Program Files (x86)\Glyph
2015-01-01 17:25 - 2014-05-18 09:23 - 00000000 ____D () C:\Users\Kalle\Desktop\SFDL.NET 2.2.9.2
2014-12-31 00:37 - 2014-12-30 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AeriaGames
==================== Files in the root of some directories =======
2014-05-28 12:15 - 2015-01-29 21:58 - 0000103 _____ () C:\Users\Kalle\AppData\Roaming\Camdata.ini
2014-05-28 12:15 - 2015-01-29 21:58 - 0000408 _____ () C:\Users\Kalle\AppData\Roaming\CamLayout.ini
2014-05-28 12:15 - 2015-01-29 21:58 - 0000408 _____ () C:\Users\Kalle\AppData\Roaming\CamShapes.ini
2014-05-28 12:15 - 2015-01-29 21:58 - 0004546 _____ () C:\Users\Kalle\AppData\Roaming\CamStudio.cfg
2014-05-28 12:10 - 2015-01-30 10:24 - 0000096 _____ () C:\Users\Kalle\AppData\Roaming\version2.xml
2014-10-20 13:56 - 2014-10-20 13:56 - 0023147 _____ () C:\Users\Kalle\AppData\Local\recently-used.xbel
2008-02-05 12:28 - 2008-02-05 12:28 - 0000051 _____ () C:\Users\Kalle\AppData\Local\setup.txt
Some content of TEMP:
====================
C:\Users\Kalle\AppData\Local\Temp\130628684657154330.exe
C:\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe
C:\Users\Kalle\AppData\Local\Temp\BullseyeCoverage-2-x86.dll
C:\Users\Kalle\AppData\Local\Temp\guninst.exe
C:\Users\Kalle\AppData\Local\Temp\proxy_vole2177688362422398821.dll
C:\Users\Kalle\AppData\Local\Temp\Quarantine.exe
C:\Users\Kalle\AppData\Local\Temp\Samsung_Magician_Setup_v45.exe
C:\Users\Kalle\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kalle\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 16:49
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by Kalle at 2015-01-30 12:34:41
Running from C:\Users\Kalle\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\uTorrent) (Version: 3.4.2.34727 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Activision(R) (x32 Version: 1.00.0000 - Activision) Hidden
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIDA64 Extreme v4.30 (HKLM-x32\...\AIDA64 Extreme_is1) (Version: 4.30 - FinalWire Ltd.)
Akamai NetSession Interface (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
ANSTOSS 3 (HKLM-x32\...\ANSTOSS 3_is1) (Version: - )
Archeage Beta (HKLM-x32\...\Glyph Archeage Beta) (Version: - Trion Worlds, Inc.)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.0.0.0 - Auslogics Labs Pty Ltd)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)
Cheat Engine 6.4 (HKLM-x32\...\Cheat Engine 6.4_is1) (Version: - Cheat Engine)
Combined Community Codec Pack 2014-04-20 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2014.04.20.0 - CCCP Project)
CPUID HWMonitor 1.25 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
CrystalDiskInfo 5.0.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.0.0 - Crystal Dew World)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.732.20 - Electronic Arts Inc.)
Dying Light (HKLM-x32\...\RHlpbmdMaWdodA==_is1) (Version: 1 - )
EA SPORTS™ FIFA 15 Demo (HKLM-x32\...\{108C0C19-6316-4944-A62F-C744488F8639}) (Version: 1.0.0.0 - Electronic Arts)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.3.20141106 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - )
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
foobar2000 v1.3.2 (HKLM-x32\...\foobar2000) (Version: 1.3.2 - Peter Pawlowski)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)
HexChat (HKLM\...\HexChat_is1) (Version: 2.10.1 - HexChat)
Intel(R) Network Connections 15.6.25.0 (HKLM\...\PROSetDX) (Version: 15.6.25.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Last.fm Scrobbler 2.1.36 (HKLM-x32\...\LastFM_is1) (Version: - Last.fm)
Leviathan The Last Day of the Decade (HKLM-x32\...\Leviathan The Last Day of the Decade_is1) (Version: - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
ManyCam 4.1.0 (HKLM-x32\...\ManyCam) (Version: 4.1.0 - Visicom Media Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Pro Evolution Soccer 2015 (HKLM-x32\...\UHJvRXZvbHV0aW9uU29jY2VyMjAxNQ==_is1) (Version: 1 - )
RAPID Mode (Version: 1.0.1.68 - Samsung Electronics Co., Ltd.) Hidden
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
RollerCoaster Tycoon Deluxe (HKLM-x32\...\{924EAD66-F854-4605-8493-696DD59A113B}) (Version: 1.00.000 - )
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
SSC Service Utility v3.10 (HKLM-x32\...\SSC Service Utility_is1) (Version: - SSC Localization Group)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
System Requirements Lab CYRI (HKLM-x32\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
The Sims 4 (HKLM-x32\...\VGhlU2ltczQ=_is1) (Version: 1 - )
Unity Web Player (HKU\S-1-5-21-1820279603-2735648936-400300262-1000\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VueScan x64 (HKLM\...\VueScan x64) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.10 Beta 4 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.3) (Version: 1.3.3 - Xvid Team)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
26-12-2014 18:27:09 Removed blueMSX
30-12-2014 11:21:08 Windows Update
30-12-2014 23:08:23 Installed Install(US)2
30-12-2014 23:10:59 Removed Install(US)2
31-12-2014 00:36:57 Removed Aeria Ignite
03-01-2015 21:43:26 Gerätetreiber-Paketinstallation: Visicom Media Inc. Bildverarbeitungsgeräte
03-01-2015 21:43:34 Gerätetreiber-Paketinstallation: Visicom Media Inc. Audio-, Video- und Gamecontroller
06-01-2015 10:19:16 Windows Update
09-01-2015 10:28:34 Windows Update
14-01-2015 10:27:08 Windows Update
14-01-2015 13:27:49 avast! antivirus system restore point
14-01-2015 13:44:26 Windows Update
15-01-2015 11:11:24 Windows Update
15-01-2015 19:01:12 Gerätetreiber-Paketinstallation: Bandwidth Controller Netzwerkdienst
15-01-2015 19:01:20 Gerätetreiber-Paketinstallation: Bandwidth Controller Netzwerkadapter
16-01-2015 01:12:34 Windows Update
20-01-2015 10:24:40 Windows Update
25-01-2015 00:52:55 Windows Live Essentials
25-01-2015 00:54:27 DirectX wurde installiert
25-01-2015 00:54:41 DirectX wurde installiert
25-01-2015 00:54:51 DirectX wurde installiert
25-01-2015 00:55:22 WLSetup
27-01-2015 09:42:18 Windows Update
30-01-2015 09:54:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {3479E88B-7B86-4901-94E8-A4413378ED78} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {5B70AAD0-E50A-4249-99CA-DD2ED8A986B1} - System32\Tasks\{54C0989D-8919-425D-96C3-2E4721D2218A} => pcalua.exe -a C:\Users\Kalle\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {7B573B87-373F-4D2B-AD9E-18AEF380A8ED} - System32\Tasks\{AE14BA3F-5FE5-45BA-87C8-248F2F9CFA51} => pcalua.exe -a D:\epson-resetter.exe -d D:\
Task: {80DCD21C-6605-4E64-BB32-4E04EE7441BF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {82A0D857-39EE-4F57-8C99-BA4FC1BA2377} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-14] (AVAST Software)
Task: {8FFC5279-9CF8-4E0A-9821-B33D6728B02F} - System32\Tasks\{79CDEE95-7B47-41C5-9709-BF4D6AB3799C} => pcalua.exe -a "C:\Program Files (x86)\ANSTOSS 3\SGLSetup.exe" -d "C:\Program Files (x86)\ANSTOSS 3"
Task: {E07B6CBB-F96A-449D-B16F-341CC17F910D} - System32\Tasks\{3A2A5706-6749-424E-92CB-8B4CF09F98F5} => pcalua.exe -a "C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2\bin\addoninstaller.exe" -d "C:\Program Files (x86)\Steam\steamapps\common\Left 4 Dead 2" -c /register
Task: {FAA0757D-8C8E-4D7C-8D30-1A88B6C2C5EF} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-05-26 18:25 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-01-29 22:46 - 2015-01-29 22:46 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012901\algo.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-14 13:31 - 2015-01-14 13:31 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-05-26 18:11 - 2014-05-06 10:24 - 00013824 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAMSUNG_SSD.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00103424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\PAL.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00039424 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SATA.dll
2014-05-26 18:11 - 2014-05-19 19:19 - 00038400 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAT.dll
2014-05-26 18:11 - 2014-05-19 19:20 - 00031232 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SMINI.dll
2014-05-26 18:11 - 2014-05-19 19:19 - 00029696 _____ () C:\Program Files (x86)\Samsung\Samsung Magician\SAS.dll
2014-10-16 14:26 - 2014-10-16 14:26 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2014-06-04 22:06 - 2010-11-05 22:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-01-26 22:15 - 2015-01-26 22:15 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1820279603-2735648936-400300262-500 - Administrator - Disabled)
Gast (S-1-5-21-1820279603-2735648936-400300262-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1820279603-2735648936-400300262-1002 - Limited - Enabled)
Kalle (S-1-5-21-1820279603-2735648936-400300262-1000 - Administrator - Enabled) => C:\Users\Kalle
==================== Faulty Device Manager Devices =============
Name: ccnfd_1_10_0_4
Description: ccnfd_1_10_0_4
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ccnfd_1_10_0_4
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-12-16 12:30:53.450
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Users\Kalle\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.353
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Users\Kalle\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.241
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-12-16 12:30:53.143
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
Percentage of memory in use: 41%
Total physical RAM: 8174 MB
Available physical RAM: 4785.16 MB
Total Pagefile: 16346.18 MB
Available Pagefile: 12988.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:50 GB) NTFS
Drive d: () (Fixed) (Total:465.76 GB) (Free:158.85 GB) NTFS
Drive e: (Musik) (Fixed) (Total:465.75 GB) (Free:462.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: D78CB2D0)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 46E6BF93)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
30.01.2015, 12:42
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp] Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
C:\Users\Kalle\AppData\Local\Temp\130628684657154330.exe
C:\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe
C:\Users\Kalle\AppData\Local\Temp\BullseyeCoverage-2-x86.dll
C:\Users\Kalle\AppData\Local\Temp\guninst.exe
C:\Users\Kalle\AppData\Local\Temp\proxy_vole2177688362422398821.dll
C:\Users\Kalle\AppData\Local\Temp\Quarantine.exe
C:\Users\Kalle\AppData\Local\Temp\Samsung_Magician_Setup_v45.exe
C:\Users\Kalle\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kalle\AppData\Local\Temp\sqlite3.dll
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.01.2015, 12:48
| #9 |
| | Avast Meldung Win32:Evo-gen [susp]Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-01-2015
Ran by Kalle at 2015-01-30 12:46:26 Run:1
Running from C:\Users\Kalle\Desktop
Loaded Profiles: Kalle (Available profiles: Kalle)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
C:\Users\Kalle\AppData\Local\Temp\130628684657154330.exe
C:\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe
C:\Users\Kalle\AppData\Local\Temp\BullseyeCoverage-2-x86.dll
C:\Users\Kalle\AppData\Local\Temp\guninst.exe
C:\Users\Kalle\AppData\Local\Temp\proxy_vole2177688362422398821.dll
C:\Users\Kalle\AppData\Local\Temp\Quarantine.exe
C:\Users\Kalle\AppData\Local\Temp\Samsung_Magician_Setup_v45.exe
C:\Users\Kalle\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kalle\AppData\Local\Temp\sqlite3.dll
EmptyTemp:
Hosts:
*****************
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
C:\Users\Kalle\AppData\Local\Temp\130628684657154330.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\BullseyeCoverage-2-x86.dll => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\guninst.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\proxy_vole2177688362422398821.dll => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\Samsung_Magician_Setup_v45.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Kalle\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 967.7 MB temporary data.
The system needed a reboot.
==== End of Fixlog 12:46:39 ====
|
|
30.01.2015, 12:49
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp] Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.01.2015, 13:28
| #11 |
| | Avast Meldung Win32:Evo-gen [susp]Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 30.01.2015 Suchlauf-Zeit: 12:52:49 Logdatei: log.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.30.04 Rootkit Datenbank: v2015.01.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Kalle Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 332684 Verstrichene Zeit: 4 Min, 0 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 1 PUP.Optional.ClickCaption.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ccnfd_1_10_0_4, In Quarantäne, [3f4df30a4f3ae551e15b4842b05342be], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 1 PUP.Optional.Bunndle, C:\Program Files\CamStudio 2.7\BunndleOfferManager.exe, In Quarantäne, [652700fdc7c262d42245f865fb05ef11], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e85e23b8085d164781882f0e3607e8d6
# engine=22224
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-30 12:24:53
# local_time=2015-01-30 01:24:53 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 95 252516 21486753 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 3386 174250543 0 0
# scanned=160982
# found=14
# cleaned=14
# scan_time=1179
sh=B026E8522BA4CA95973384325C5BAFCF85719708 ft=1 fh=8f2fd0faac42df06 vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\SmarterPower.FirstRun.exe.vir"
sh=8F5535C1340D139049CDD3C2B6E6E87AFE944E41 ft=1 fh=c947b2fdfcf2f737 vn="Win64/BrowseFox.C evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\5eeb83d096ea4249942c64.dll.vir"
sh=ECF046F8F3B782BCF81292746475E8787A4C7DE2 ft=1 fh=cf616f4652b4430e vn="Win64/BrowseFox.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\SmarterPower.BrowserAdapter64.exe.vir"
sh=1C3765A2D52238839CCB3C7EEE8B695D4F45F4CB ft=1 fh=e5a020effc9626e7 vn="Win64/BrowseFox.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\{5eeb83d0-96ea-4249-942c-beead6847053}64.dll.vir"
sh=148C8CCA24FB53D0A2833B434D3B2C9DA3E0DEC9 ft=1 fh=a9466544da6fef82 vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.Bromon.dll.vir"
sh=01B0A9E385F1EF4448605F44B623E4184075FE6D ft=1 fh=8bbeb7232c072c21 vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.BroStats.dll.vir"
sh=B23A4DC8B504ADE8874ECF7DCE0D2661BE99A6B0 ft=1 fh=9c8727b0cf563d36 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.BrowserAdapter.dll.vir"
sh=6526BDD9620A75A3887BEB3D663BC065AFD23B7A ft=1 fh=1d2adcfaa503ca3e vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.CompatibilityChecker.dll.vir"
sh=3BEB28F6DEC47BC1950E8F42F367EDF5284FC063 ft=1 fh=da960ab887e037b3 vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.FeSvc.dll.vir"
sh=B969B8D6362474E36E80567A45FEB4F9FBD311E6 ft=1 fh=070e00dc9e64b160 vn="Variante von Win64/BrowseFox.T evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SmarterPower\bin\plugins\SmarterPower.PurBrowse.dll.vir"
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=D9264B6C5B1AA384DB38AEAA87B710BA0BF9D9AF ft=1 fh=d8ba1f5c6d41d334 vn="Variante von Win32/InstallCore.TS evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\FRST\Quarantine\C\Users\Kalle\AppData\Local\Temp\13062868466866498963.exe.xBAD"
sh=860EFD5893E4DD4E820227B7DEAD144F974456AC ft=1 fh=c0b9ed8dfe12ffb8 vn="Variante von Win32/HackTool.CheatEngine.AF potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Cheat Engine 6.4\standalonephase1.dat"
sh=924A4B2AD759FFE3EF93992AB14F47B14362A38F ft=1 fh=f7a4fdf78c8b5d8e vn="Win32/HackTool.Crack.CS potenziell unsichere Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Pro Evolution Soccer 2015\steam_api.dll"
|
|
30.01.2015, 13:44
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp]Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.01.2015, 14:48
| #13 | |
| | Avast Meldung Win32:Evo-gen [susp]Zitat:
|
|
30.01.2015, 15:00
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avast Meldung Win32:Evo-gen [susp] Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.01.2015, 15:25
| #15 |
| | Avast Meldung Win32:Evo-gen [susp] Ghostery gleich mal installiert. Alles soweit in Ordnung. Keine Probleme mehr. Ich danke dir für deine Hilfe! |
|
| Themen zu Avast Meldung Win32:Evo-gen [susp] |
| appdata, avast, detected, explorer, ics, installmanager.exe, internet, internet explorer, löschen, malwarebytes, meldung, microsoft, neustart, protectwindowsmanager.exe, roaming, search, service, services, software, system, temp, tmp, update, win, win32, windows, windows 7 |
![Avast Meldung Win32:Evo-gen [susp]](iconimages/log-analyse-auswertung/avast-meldung-win32-evo-gen-susp_ltr.gif)
Linear-Darstellung
