| |
| |||||||
Log-Analyse und Auswertung: Pop Up System32 beim starten des PC verschwindet sofort wieder PC ist sehr langsam geworden.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
01.02.2015, 13:34
| #1 |
 |  Pop Up System32 beim starten des PC verschwindet sofort wieder PC ist sehr langsam geworden. Hallo Ich hab das Problem wie oben beschrieben das Fenster schließt sich so schnell das ich bisher den weiteren Datei Namen noch nicht lesen konnte. Avast findet gar nichts und Malwarebytes hat 3 Sachen gefunden die ich in Quarantäne verschoben habe. Das Problem besteht aber immer noch. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015 Ran by Bina (administrator) on BINA-PC on 01-02-2015 12:33:55 Running from C:\Users\Bina\Downloads Loaded Profiles: Bina (Available profiles: Bina & krizz) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Group) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe (Chicony) C:\Program Files (x86)\Video Web Camera\traybar.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-29] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [206208 2010-06-10] () HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated) HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.) HKLM\...\Run: [Cm106Sound] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cm106.dll,CMICtrlWnd HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [263936 2010-06-28] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-11] (Dritek System Inc.) HKLM-x32\...\Run: [Camera Assistant Software] => C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-12-22] (Chicony) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-01] (AVAST Software) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642304 2013-04-30] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] () HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2015-01-07] (Adobe Systems Incorporated) HKU\S-1-5-21-2174489219-974603214-2956640213-1000\...\Run: [GoogleChromeAutoLaunch_FC3C7AFF6FA05DEB76F42E512273B035] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [854344 2014-10-22] (Google Inc.) AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found Startup: C:\Users\Bina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\krizz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKU\S-1-5-21-2174489219-974603214-2956640213-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2174489219-974603214-2956640213-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=avastbcl HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2174489219-974603214-2956640213-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=avastbcl HKU\S-1-5-21-2174489219-974603214-2956640213-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} HKU\S-1-5-21-2174489219-974603214-2956640213-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=avastbcl SearchScopes: HKLM -> DefaultScope value is missing. SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKU\S-1-5-21-2174489219-974603214-2956640213-1000 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKU\S-1-5-21-2174489219-974603214-2956640213-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2174489219-974603214-2956640213-1000 -> {933FDD10-2DE0-4D3C-8241-DDF8CEAD24B2} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647 SearchScopes: HKU\S-1-5-21-2174489219-974603214-2956640213-1000 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKU\S-1-5-21-2174489219-974603214-2956640213-1000 -> No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - No File DPF: HKLM-x32 {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.127.0.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Bina\AppData\Roaming\Mozilla\Firefox\Profiles\kz5jdsbx.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll No File FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin HKU\S-1-5-21-2174489219-974603214-2956640213-1000: @soe.sony.com/installer,version=1.0.3 -> C:\Users\Bina\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\npsoe.dll No File FF Plugin HKU\S-1-5-21-2174489219-974603214-2956640213-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Bina\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-09-03] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-26] Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://search.conduit.com/?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPDB258463-4080-48BE-B4A6-DA827DF08E43&SSPV=" CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll () CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File CHR Plugin: (Unity Player) - C:\Users\Bina\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Profile: C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-17] CHR Extension: (Avast Online Security) - C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-03] CHR Extension: (Google Wallet) - C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-29] CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2014-11-13] CHR HKLM-x32\...\Chrome\Extension: [aacbndibbcpajfgnkdkaakeiojmmgmnk] - C:\Users\Bina\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-01] CHR HKLM-x32\...\Chrome\Extension: [jpihmmhdcobmllpcnpfbhnipmhamldje] - C:\Users\Bina\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-04-29] (Advanced Micro Devices, Inc.) [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-01] (AVAST Software) R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated) R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] S4 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-06-28] (NewTech Infosystems, Inc.) R2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-01] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-01] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-01] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-01] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-22] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-01] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-01] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-01] () S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-09-06] (Devguru Co., Ltd) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-01] (Malwarebytes Corporation) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [53760 2012-09-28] (Apple, Inc.) [File not signed] S3 USBMULCD; C:\Windows\System32\drivers\CM10664.sys [1307648 2009-10-01] (C-Media Electronics Inc) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 k57nd60a; system32\DRIVERS\k57nd60a.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-01 12:33 - 2015-02-01 12:34 - 00021993 _____ () C:\Users\Bina\Downloads\FRST.txt 2015-02-01 12:33 - 2015-02-01 12:34 - 00000000 ____D () C:\FRST 2015-02-01 12:32 - 2015-02-01 12:32 - 02131456 _____ (Farbar) C:\Users\Bina\Downloads\FRST64.exe 2015-02-01 12:30 - 2015-02-01 12:30 - 00000470 _____ () C:\Users\Bina\Downloads\defogger_disable.log 2015-02-01 12:30 - 2015-02-01 12:30 - 00000000 _____ () C:\Users\Bina\defogger_reenable 2015-02-01 12:29 - 2015-02-01 12:29 - 00050477 _____ () C:\Users\Bina\Downloads\Defogger.exe 2015-02-01 11:50 - 2015-02-01 11:51 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Bina\Downloads\mbam-setup-2.0.4.1028 (1).exe 2015-01-28 11:09 - 2015-01-27 17:39 - 00015321 _____ () C:\Users\krizz\Documents\untitled_0.odt 2015-01-25 21:52 - 2015-01-25 21:52 - 00003500 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Bina-PC-krizz 2015-01-25 21:37 - 2015-01-25 21:37 - 00001012 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2014.lnk 2015-01-25 21:34 - 2015-01-25 21:34 - 00000000 ____D () C:\Program Files\Adobe 2015-01-25 21:33 - 2015-01-25 21:50 - 00000000 ____D () C:\Users\krizz\Documents\FW-Sim 2015-01-25 21:33 - 2015-01-25 21:33 - 00000000 ____D () C:\ProgramData\IsolatedStorage 2015-01-25 21:25 - 2015-01-25 21:25 - 00001025 _____ () C:\Users\Public\Desktop\FWsim.lnk 2015-01-25 21:25 - 2015-01-25 21:25 - 00000000 ____D () C:\Users\Public\Documents\FW-Sim 2015-01-25 21:25 - 2015-01-25 21:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FWsim 2015-01-25 21:24 - 2015-01-25 21:29 - 00000000 ____D () C:\Program Files (x86)\FWsim 2015-01-25 21:23 - 2015-01-25 21:37 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-01-25 21:09 - 2015-01-25 21:15 - 64564080 _____ () C:\Users\krizz\Downloads\fwsim.exe 2015-01-25 21:03 - 2015-01-25 21:03 - 00000000 ___RD () C:\Users\krizz\Creative Cloud Files 2015-01-25 20:58 - 2015-01-25 20:58 - 00001281 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk 2015-01-25 20:58 - 2015-01-25 20:58 - 00001269 _____ () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2015-01-25 20:52 - 2015-01-25 20:56 - 00000000 ____D () C:\ProgramData\Package Cache 2015-01-25 20:45 - 2015-01-25 20:45 - 00672944 _____ (Adobe Systems Incorporated) C:\Users\krizz\Downloads\CreativeCloudSet-Up.exe 2015-01-25 20:42 - 2015-01-25 21:15 - 04070576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2015-01-17 21:09 - 2015-01-17 21:09 - 03980734 _____ () C:\Users\krizz\Downloads\powder-90.2-win32 (1).zip 2015-01-17 21:09 - 2014-08-30 20:09 - 00004718 _____ () C:\Users\krizz\Desktop\README.txt 2015-01-17 20:21 - 2015-01-17 20:21 - 00001998 _____ () C:\Users\Bina\Downloads\cannabislogo.lsp 2015-01-17 20:01 - 2015-01-17 20:01 - 00003064 _____ () C:\Windows\System32\Tasks\{544F2744-B9FD-4DE5-8B2D-E34D76DE8258} 2015-01-17 19:58 - 2015-01-17 19:58 - 00001937 _____ () C:\Users\Public\Desktop\TrialLogoSmartz.lnk 2015-01-17 19:58 - 2015-01-17 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trial LogoSmartz 2015-01-17 19:56 - 2010-02-23 17:00 - 02267368 _____ (Adobe Systems, Inc.) C:\Windows\SysWOW64\Flash9d.ocx 2015-01-17 19:56 - 1996-11-08 02:48 - 00368912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbar332.dll 2015-01-17 19:55 - 2015-01-17 19:59 - 00000000 ____D () C:\Program Files (x86)\LogoSmartz Trial 2015-01-17 19:53 - 2015-01-17 19:53 - 00000000 ____D () C:\Users\Bina\AppData\Roaming\Opera Software 2015-01-17 19:53 - 2015-01-17 19:53 - 00000000 ____D () C:\Users\Bina\AppData\Local\Opera Software 2015-01-17 19:52 - 2015-01-17 19:52 - 21381235 _____ () C:\Users\Bina\Downloads\ML_TrialLogoSmartz_CB-DL-Manager [1].exe 2015-01-17 19:50 - 2015-01-17 20:00 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-01-17 19:50 - 2015-01-17 19:50 - 00000000 ____D () C:\Users\Bina\AppData\Roaming\WorldofTanks 2015-01-17 19:50 - 2015-01-17 19:50 - 00000000 ____D () C:\Users\Bina\AppData\Local\WorldofTanks 2015-01-17 19:49 - 2015-01-17 19:49 - 00823792 _____ ( ) C:\Users\Bina\Downloads\ML_TrialLogoSmartz_CB-DL-Manager.exe 2015-01-14 11:39 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 11:39 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 11:39 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 11:39 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-14 11:39 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-14 11:39 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-14 11:39 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 11:39 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 11:39 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 11:39 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 11:39 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-14 11:39 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-14 11:39 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-13 17:07 - 2015-01-13 17:41 - 31639060 _____ () C:\Users\Bina\Downloads\fsxas350.zip 2015-01-13 16:31 - 2015-01-13 16:31 - 23231664 _____ () C:\Users\Bina\Downloads\Nicht bestätigt 746985.crdownload 2015-01-13 16:28 - 2015-01-13 16:35 - 20626325 _____ () C:\Users\Bina\Downloads\Sikorsky_CH-3Jolly_Green_Giant-1.zip 2015-01-13 16:25 - 2015-01-13 16:28 - 227341208 _____ (Microsoft Corporation) C:\Users\Bina\Downloads\fsx_sp1_DEU.exe 2015-01-12 14:55 - 2015-01-12 14:55 - 00086064 _____ () C:\Users\Bina\Downloads\EDXK_Leck-AB_V1.zip 2015-01-12 14:52 - 2015-01-12 14:57 - 45031920 _____ () C:\Users\Bina\Downloads\HC075DI_AS332L2_FSX_ACCELERATION (1).zip 2015-01-12 11:59 - 2015-01-12 11:59 - 00000172 _____ () C:\Windows\wininit.ini ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-01 12:30 - 2011-08-30 13:24 - 00000000 ____D () C:\Users\Bina 2015-02-01 12:12 - 2014-03-29 15:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-01 11:53 - 2014-12-16 10:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-01 11:52 - 2014-12-16 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-01 11:52 - 2014-12-16 10:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-01 11:52 - 2014-02-12 16:26 - 00001074 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-01 11:50 - 2012-02-28 22:28 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-01 11:43 - 2009-07-14 05:45 - 00025616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-01 11:43 - 2009-07-14 05:45 - 00025616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-01 11:42 - 2013-02-26 13:12 - 01482439 _____ () C:\Windows\WindowsUpdate.log 2015-02-01 11:36 - 2013-02-26 19:46 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-02-01 11:34 - 2012-02-28 22:28 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-01 11:33 - 2013-07-29 07:19 - 00079868 _____ () C:\Windows\setupact.log 2015-02-01 11:33 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-31 21:00 - 2013-06-13 08:29 - 00000000 ____D () C:\Users\krizz\AppData\Local\Adobe 2015-01-27 20:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-01-26 13:49 - 2014-08-28 13:04 - 00000000 ____D () C:\Users\Bina\Desktop\Aktuelle Bewerbungen 2015-01-26 13:48 - 2011-08-30 13:38 - 00000000 ____D () C:\Users\Bina\AppData\Roaming\Adobe 2015-01-26 11:27 - 2013-02-07 16:25 - 00000000 ____D () C:\Users\krizz 2015-01-25 21:53 - 2013-02-07 16:26 - 00000000 ____D () C:\Users\krizz\AppData\Roaming\Adobe 2015-01-25 21:52 - 2013-06-13 12:27 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2015-01-25 21:27 - 2014-10-28 21:22 - 00098040 _____ () C:\Windows\DirectX.log 2015-01-25 21:15 - 2014-03-29 15:46 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-25 21:15 - 2014-03-29 15:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-25 21:15 - 2014-03-29 15:46 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-25 21:00 - 2010-09-09 03:41 - 00000000 ____D () C:\ProgramData\Adobe 2015-01-25 20:48 - 2013-06-13 10:35 - 00000000 ____D () C:\Program Files (x86)\Adobe 2015-01-22 23:44 - 2011-09-13 07:00 - 01594964 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2015-01-22 23:44 - 2011-02-13 12:00 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2015-01-22 23:44 - 2011-02-13 12:00 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2015-01-22 23:44 - 2009-07-14 06:13 - 01594964 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-17 21:23 - 2014-10-03 10:55 - 00000557 _____ () C:\Users\krizz\Desktop\powder.pref 2015-01-17 21:23 - 2014-10-03 10:39 - 00000798 _____ () C:\Users\krizz\Desktop\stdout.txt 2015-01-17 20:00 - 2011-08-30 13:24 - 00001433 _____ () C:\Users\Bina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-01-15 11:01 - 2013-08-15 16:32 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-15 10:47 - 2012-06-28 19:26 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-13 17:17 - 2014-10-28 21:23 - 00000000 ____D () C:\Users\Bina\Documents\Flight Simulator X Demo-Dateien 2015-01-13 17:07 - 2014-10-28 21:32 - 00000000 ____D () C:\Users\Bina\Desktop\fs 2015-01-12 21:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-01-12 14:57 - 2011-09-06 20:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games 2015-01-12 11:59 - 2011-08-30 13:53 - 00000000 ____D () C:\Users\Bina\AppData\Local\Deployment 2015-01-12 11:59 - 2011-08-30 13:53 - 00000000 ____D () C:\Users\Bina\AppData\Local\Apps\2.0 2015-01-12 11:22 - 2011-09-08 12:16 - 00000000 ____D () C:\Users\Bina\AppData\Local\Adobe 2015-01-09 12:04 - 2013-06-21 09:58 - 00000000 ____D () C:\Users\Bina\Documents\VirtualDJ 2015-01-09 11:12 - 2013-06-21 09:58 - 00000000 ____D () C:\Program Files (x86)\VirtualDJ 2015-01-05 18:54 - 2013-11-24 11:25 - 00014871 _____ () C:\Users\Bina\Desktop\Monatsaufstellung.odt ==================== Files in the root of some directories ======= 2011-11-04 15:54 - 2011-11-16 16:23 - 0000144 _____ () C:\Users\Bina\AppData\Roaming\blckdom.res 2012-05-10 12:24 - 2012-05-10 12:32 - 0004608 _____ () C:\Users\Bina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-02-06 16:40 - 2013-02-06 16:40 - 0000079 _____ () C:\ProgramData\UnhJWFY.bat 2013-02-06 16:40 - 2013-02-06 16:40 - 0000153 _____ () C:\ProgramData\UnhJWFY.reg Files to move or delete: ==================== C:\ProgramData\UnhJWFY.bat C:\ProgramData\UnhJWFY.reg Some content of TEMP: ==================== C:\Users\Bina\AppData\Local\Temp\DseShExt-x64.dll C:\Users\Bina\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Bina\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Bina\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Bina\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Bina\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\Bina\AppData\Local\Temp\VirtualDJ New Version.exe C:\Users\krizz\AppData\Local\Temp\3merxyyg.dll C:\Users\krizz\AppData\Local\Temp\AAMHelper.exe C:\Users\krizz\AppData\Local\Temp\drm_dyndata_7390006.dll C:\Users\krizz\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\krizz\AppData\Local\Temp\i4jdel0.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 19:57 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by Bina at 2015-02-01 12:36:03
Running from C:\Users\Bina\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.9.0.465 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.95 - WildTangent) Hidden
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DD89CE29-BC88-40C6-A845-E2548682C5D6}) (Version: 1.9.17.06019 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.9.17.06019 - Alcor Micro Corp.) Hidden
AMD Catalyst Install Manager (HKLM\...\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)
Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden
Battlefield Vietnam(TM) (HKLM-x32\...\{E35B3C63-E958-4E31-A178-95D22024109A}) (Version: - )
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Die*Sims™*3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.0.615 - Electronic Arts)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.0.34 - DivX, LLC)
DVS Guitar v1.04 (HKLM-x32\...\DVS Guitar_is1) (Version: - Dream Vortex Studio)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
FL Studio 5 (HKLM-x32\...\FL Studio 5) (Version: - Image-Line bvba)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )
FsX Project BO-105 ADAC (HKLM-x32\...\FsX Project BO-105 ADAC) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Packard Bell)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 4.0.14 - Packard Bell)
LogoSmartz Trial 7.0 (HKLM-x32\...\LogoSmartz Trial 7.0) (Version: - )
MAGIX Speed burnR (MSI) (HKLM-x32\...\MX.{F6E484FB-BC48-4A63-8186-E25DF4607B3B}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MEDUSA NX USB 5.1 Gaming Headset (HKLM\...\C-Media CM106 Like Sound Driver) (Version: - )
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Flight Simulator X Demo (HKLM-x32\...\InstallShield_{B98A34C0-A6A2-4087-B272-557C1C6D0A07}) (Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
N.I Pro-53 v3.0-OxYGeN (HKLM-x32\...\N.I Pro-53 v3.0-OxYGeN) (Version: - )
Native Instruments FM7 VSTi DXI RTAS v1.1.3.4 (HKLM-x32\...\Native Instruments FM7 VSTi DXI RTAS v1.1.3.4) (Version: - )
NVIDIA GAME System Software 2.8.1 (HKLM-x32\...\{4F0C7CCF-5666-474B-B02E-AC514A95EC93}) (Version: 2.8.1 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{DEA314C4-0929-4250-BC92-98E4C105F28D}) (Version: 9.10.0129 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Opticon USB Drivers Installer (HKLM-x32\...\Opticon USB Installer) (Version: - )
Packard Bell Games (HKLM-x32\...\WildTangent packardbell Master Uninstall) (Version: 1.0.1.3 - WildTangent)
Packard Bell InfoCentre (HKLM-x32\...\Packard Bell InfoCentre) (Version: 3.02.3000 - Packard Bell)
Packard Bell MyBackup (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)
Packard Bell Power Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Packard Bell)
Packard Bell Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3015 - Packard Bell)
Packard Bell Registration (HKLM-x32\...\Packard Bell Registration) (Version: 1.03.3003 - Packard Bell)
Packard Bell ScreenSaver (HKLM-x32\...\Packard Bell Screensaver) (Version: 1.1.0915.2010 - Packard Bell )
Packard Bell Social Networks (HKLM-x32\...\InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}) (Version: 1.0.1901 - CyberLink Corp.)
Packard Bell Social Networks (x32 Version: 1.0.1901 - CyberLink Corp.) Hidden
Packard Bell Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Packard Bell)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.950.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SlimDX Redistributable (June 2010) (HKLM-x32\...\{354D00E0-C7C9-4BC1-BC12-08C4977AA827}) (Version: 2.0.10.43 - SlimDX Group)
Spicy Guitar 1.2.0.1 (HKLM-x32\...\KeolabSpicyGuitar_is1) (Version: 1.2.0.1 - Keolab)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
Synthesia (HKLM-x32\...\Synthesia) (Version: 8.6 - Synthesia LLC)
Unity Web Player (HKU\S-1-5-21-2174489219-974603214-2956640213-1000\...\UnityWebPlayer) (Version: 4.6.1f1 - Unity Technologies ApS)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Video Web Camera (HKLM-x32\...\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.146.1222 - Chicony Electronics Co.,Ltd.)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
VirtualDJ 8 (HKLM-x32\...\{A5BE332D-FF14-42E5-ADB3-FAC10AAE8D68}) (Version: 8.0.2031.0 - Atomix Productions)
VirtualDJ Home FREE (HKLM-x32\...\{A6AC699F-8315-40CA-8F70-E917494978AB}) (Version: 7.4 - Atomix Productions)
Welcome Center (HKLM-x32\...\Packard Bell Welcome Center) (Version: 1.02.3005 - Packard Bell)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
13-12-2014 10:54:45 Windows Update
19-12-2014 07:45:31 Windows Update
12-01-2015 21:05:57 Geplanter Prüfpunkt
15-01-2015 11:01:41 Windows Modules Installer
22-01-2015 23:37:16 Windows Update
25-01-2015 20:50:35 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
25-01-2015 20:52:41 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
25-01-2015 20:54:03 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
25-01-2015 20:55:32 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
25-01-2015 21:24:55 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
25-01-2015 21:25:17 Installed SlimDX Redistributable (June 2010)
25-01-2015 21:26:10 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2013-02-26 16:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1C33CFBF-704D-464C-892A-EA47C5168CB2} - System32\Tasks\{544F2744-B9FD-4DE5-8B2D-E34D76DE8258} => pcalua.exe -a C:\Users\Bina\Desktop\fs\Uninstal.exe
Task: {1D02CF1F-921E-49F3-A2BD-9A9EA2374CDF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {25F6E8D9-CCD6-4460-87B1-D32B2F0DA46E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-24] (Google Inc.)
Task: {40B84B81-9DAD-448C-8D18-B6071BC31A37} - System32\Tasks\{13D677FE-DEA3-4099-B53A-041F6397C5C3} => pcalua.exe -a C:\Users\Bina\Desktop\Progs\Take_On_Helicopters_Demo.exe -d C:\Users\Bina\Desktop\Progs
Task: {48BC1CA1-8EE9-4C9C-A5A1-87B80E0E04A9} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2174489219-974603214-2956640213-1000
Task: {5AEDD441-82BF-420B-A0E1-B50FC37C158E} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-01] (AVAST Software)
Task: {5D559121-6DAA-4B1C-9A55-8456158A0437} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {74BC5DDA-D208-4EDB-88C7-0195B086459A} - System32\Tasks\AdobeAAMUpdater-1.0-Bina-PC-krizz => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-09-19] (Adobe Systems Incorporated)
Task: {86C5C553-27E8-42D4-9830-E5F6207E3FF7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {9AD0D3F6-0A23-4511-9976-178B5DED5ACE} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-07-29] ()
Task: {B523775A-1EC6-4382-9F40-4BF97A9E6136} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B62C72C2-9D1B-47BB-B3B4-0A612D2BC9C8} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E766BFC3-E1A6-47CF-8A55-A6E2F57FA2A5} - System32\Tasks\{E2D58D26-1286-493B-AD56-A92B7CA98EE4} => Chrome.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=4.1.0.179.370&LastError=404
Task: {EDA7A4C1-AFE9-4A52-AAEA-2EF120483D05} - System32\Tasks\{11B64D25-7EE0-4523-B13C-B52F29CEF0C4} => Chrome.exe hxxp://ui.skype.com/ui/0/4.1.0.179.370/de/abandoninstall?source=lightinstaller&page=tsProblems&LastError=404&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded
Task: {FAB18F1F-26EE-4771-88DA-A1BF53EFD83D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-04-29 23:25 - 2013-04-29 23:25 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-12-19 15:57 - 2014-12-19 15:57 - 01039008 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2011-02-13 03:18 - 2010-06-10 03:54 - 00206208 _____ () C:\Windows\PLFSetI.exe
2013-04-29 23:25 - 2013-04-29 23:25 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-04-29 23:08 - 2013-04-29 23:08 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-06-18 15:49 - 2013-06-18 15:49 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-12-19 15:57 - 2014-12-19 15:57 - 05979808 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2014-08-01 07:23 - 2014-08-01 07:23 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2015-01-31 20:59 - 2015-01-31 20:59 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15013101\algo.dll
2015-02-01 11:37 - 2015-02-01 11:37 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020100\algo.dll
2011-02-13 11:43 - 2009-05-20 23:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll
2014-08-01 07:23 - 2014-08-01 07:23 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2011-01-17 15:19 - 2011-09-08 17:27 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 36730032 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll
2014-11-10 17:48 - 2014-10-22 05:04 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll
2014-11-10 17:48 - 2014-10-22 05:04 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll
2014-11-10 17:48 - 2014-10-22 05:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-11-10 17:48 - 2014-10-22 05:04 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00746160 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libglesv2.dll
2015-01-07 21:27 - 2015-01-07 21:27 - 00136368 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libegl.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:7BFFC6A9
AlternateDataStreams: C:\ProgramData\Temp:80253E8D
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2174489219-974603214-2956640213-500 - Administrator - Disabled)
Bina (S-1-5-21-2174489219-974603214-2956640213-1000 - Administrator - Enabled) => C:\Users\Bina
Gast (S-1-5-21-2174489219-974603214-2956640213-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2174489219-974603214-2956640213-1002 - Limited - Enabled)
krizz (S-1-5-21-2174489219-974603214-2956640213-1004 - Limited - Enabled) => C:\Users\krizz
==================== Faulty Device Manager Devices =============
Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/26/2015 05:35:37 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070020
Error: (01/19/2015 04:22:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: atibtmon.exe, Version: 2.0.0.0, Zeitstempel: 0x4a04ab6c
Name des fehlerhaften Moduls: atibtmon.exe, Version: 2.0.0.0, Zeitstempel: 0x4a04ab6c
Ausnahmecode: 0xc000000d
Fehleroffset: 0x00004340
ID des fehlerhaften Prozesses: 0x1698
Startzeit der fehlerhaften Anwendung: 0xatibtmon.exe0
Pfad der fehlerhaften Anwendung: atibtmon.exe1
Pfad des fehlerhaften Moduls: atibtmon.exe2
Berichtskennung: atibtmon.exe3
Error: (01/15/2015 10:46:49 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x81000101).
Error: (01/14/2015 07:58:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/14/2015 07:58:27 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/14/2015 07:57:37 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (01/13/2015 05:16:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.60905.0, Zeitstempel: 0x44fd0a92
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xcb4
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3
Error: (01/12/2015 09:04:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/12/2015 09:03:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"1".
Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/12/2015 09:02:03 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
System errors:
=============
Error: (01/28/2015 11:12:30 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (01/27/2015 00:20:48 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 27.01.2015 um 12:19:47 unerwartet heruntergefahren.
Error: (01/26/2015 11:33:01 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error: (01/26/2015 10:08:11 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst AMD FUEL Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (01/23/2015 11:13:43 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{1CFB4298-42DF-4E9A-893C-8592B1FF10EE} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (01/17/2015 07:59:39 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (01/15/2015 10:47:26 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (01/13/2015 04:59:36 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 13.01.2015 um 16:56:18 unerwartet heruntergefahren.
Error: (01/13/2015 10:23:10 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (01/08/2015 11:55:44 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Microsoft Office Sessions:
=========================
Error: (01/26/2015 05:35:37 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070020
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Error: (01/19/2015 04:22:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: atibtmon.exe2.0.0.04a04ab6catibtmon.exe2.0.0.04a04ab6cc000000d00004340169801d033fbb2fbd2b1C:\Windows\system32\atibtmon.exeC:\Windows\system32\atibtmon.exef4203ed7-9fee-11e4-8260-e686af5d78b2
Error: (01/15/2015 10:46:49 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x81000101
Error: (01/14/2015 07:58:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (01/14/2015 07:58:27 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe
Error: (01/14/2015 07:57:37 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (01/13/2015 05:16:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: fsx.exe10.0.60905.044fd0a92unknown0.0.0.000000000c000000500000000cb401d02f4aa48c427fC:\Program Files (x86)\Microsoft Games\Microsoft Flight Simulator X Demo\fsx.exeunknown7d489ae1-9b3f-11e4-adef-8441e800a2aa
Error: (01/12/2015 09:04:07 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (01/12/2015 09:03:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0"c:\program files (x86)\windows live\messenger\wlcsdk.exe
Error: (01/12/2015 09:02:03 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
CodeIntegrity Errors:
===================================
Date: 2013-02-26 16:33:49.867
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-26 16:33:49.599
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD Athlon(tm) II P320 Dual-Core Processor
Percentage of memory in use: 52%
Total physical RAM: 3838.17 MB
Available physical RAM: 1835.47 MB
Total Pagefile: 7674.53 MB
Available Pagefile: 5211.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:285.3 GB) (Free:121.42 GB) NTFS
Drive d: (PULP_FICTION_CD1) (CDROM) (Total:0.69 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 1C581C58)
Partition 1: (Not Active) - (Size=12.7 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285.3 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-01 13:20:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BPVT-22ZEST0 rev.01.01A01 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Bina\AppData\Local\Temp\kxldqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff800039b6000 45 bytes [00, 00, 26, 00, 41, 6C, 65, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495 fffff800039b602f 16 bytes [00, 02, 00, C5, F3, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[552] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\services.exe[608] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\winlogon.exe[692] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[876] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[924] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\System32\svchost.exe[268] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\atieclxx.exe[1112] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1168] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1532] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1612] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[1640] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[1728] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[1996] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2176] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\Dwm.exe[2460] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\Explorer.EXE[2552] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\System32\rundll32.exe[1176] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[996] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3256] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3368] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\PLFSetI.exe[3568] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe[3632] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe[3724] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\SysWOW64\rundll32.exe[3736] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\wbem\unsecapp.exe[2952] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3756] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[3756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe[3760] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Video Web Camera\traybar.exe[2944] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[2852] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2236] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075028791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2236] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3032] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe[3708] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe[3708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe[3708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[1620] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[2524] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[3460] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe[4216] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe[4380] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe[4380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe[4380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[4128] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[4128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[4128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[1108] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[3612] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\notepad.exe[3868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Windows\system32\notepad.exe[5080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cbef8d 1 byte [62]
.text C:\Users\Bina\Downloads\Gmer-19357.exe[4000] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007504a2fd 1 byte [62]
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 01.02.2015 Suchlauf-Zeit: 11:53:06 Logdatei: malwarebytes.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.01.02 Rootkit Datenbank: v2015.01.14.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Bina Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 446422 Verstrichene Zeit: 33 Min, 13 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 2 PUP.Optional.InstallCore.A, HKU\S-1-5-21-2174489219-974603214-2956640213-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [0a3c9d7c4644d561dd6d7256ef146799], PUP.Optional.InstallCore.A, HKU\S-1-5-21-2174489219-974603214-2956640213-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [c87eae6b305a38fe85d93f9f37cd3ac6], Registrierungswerte: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-2174489219-974603214-2956640213-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0N2X1N, In Quarantäne, [c87eae6b305a38fe85d93f9f37cd3ac6] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) |
| Themen zu Pop Up System32 beim starten des PC verschwindet sofort wieder PC ist sehr langsam geworden. |
| antivirus, branding, browser, combofix, desktop, device driver, error, failed, flash player, google, home, homepage, langsam, launch, mozilla, netzwerk, packard bell, problem, realtek, registry, scan, security, software, starten, svchost.exe, system, vista, warnung, windows |
Baum-Darstellung