| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Tencent nicht deinstallierbar + AMWB Server nicht erreichbarWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.03.2015, 17:24
| #1 |
 |  Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Hallo, ich würde gerne noch einmal um Hilfe bitten. Wir haben einen Rechner mit deutschen Win 8.1 und AMWB Pro in England, der von Tencent Programmen "infiziert" ist, die wir nicht deinstalliert bekommen. Außerdem baut der AMWB keine Verbindung mit dem Update Server auf. Zusätzlcih war vor kurzem ein Bluescreen Event. Wir wisse nicht, ob die drei Dinge zusammenhängen, würden aber gerne eure Hilfe in Ansprich nehmen. Wir haben auch im AMWB Forum nachgefragt, bisher aber keien Rückmeldung bekommen. Wei lder Rechner in UK ist, dauert es immer ein wenig, bis ich Rückmeldung von dort bekomme, daher die Bitte um Geduld bei etwas länger dauerneder Kommunikation. Anbei die Scans. Danke bD |
|
11.03.2015, 17:40
| #2 |
| /// the machine /// TB-Ausbilder    | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
11.03.2015, 17:44
| #3 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Sorry,
__________________hier die Logfiles : FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01 Ran by Standard (administrator) on TOSHIBA1LQ on 05-03-2015 19:46:41 Running from C:\Users\Standard\Desktop Loaded Profiles: Standard (Available profiles: Standard & Gast1) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] () HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] () HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated) HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation) HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-17] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default FF Homepage: google.com FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll (Tencent) FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll (Tencent Technology (Shenzhen) Company Limited) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-02-03] FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08] FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01] FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16] FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-17] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 ASPI32; No ImagePath R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-14] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2015-03-05] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-05 19:46 - 2015-03-05 19:47 - 00014187 _____ () C:\Users\Standard\Desktop\FRST.txt 2015-03-05 19:45 - 2015-03-05 19:46 - 00000000 ____D () C:\FRST 2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe 2015-03-05 19:36 - 2015-03-05 19:36 - 02092544 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe 2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk 2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Downloads\JRT.exe 2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll 2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll 2015-03-03 14:01 - 2015-03-03 14:01 - 02126848 _____ () C:\Users\Standard\Desktop\adwcleaner_4.111.exe 2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp 2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump 2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP 2015-02-27 20:36 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls 2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll 2015-02-12 22:04 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-02-12 22:04 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll 2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll 2015-02-11 22:20 - 2014-12-08 23:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg 2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys 2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2015-02-11 20:14 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2015-02-11 20:14 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2015-02-11 20:14 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-02-11 20:14 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-02-11 20:14 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll 2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll 2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll 2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll 2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll 2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll 2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll 2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll 2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll 2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll 2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll 2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe 2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe 2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe 2015-02-11 20:13 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-02-11 20:13 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-02-11 20:13 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-02-11 20:13 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2015-02-11 20:13 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-02-11 20:13 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2015-02-11 20:13 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-02-11 20:13 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2015-02-11 20:13 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2015-02-11 20:13 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-02-11 20:13 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-02-11 20:13 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-02-11 20:13 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-02-11 20:13 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2015-02-11 20:13 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-02-11 20:13 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2015-02-11 20:13 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-02-11 20:13 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2015-02-11 20:13 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-02-11 20:13 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2015-02-11 20:13 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-02-11 20:13 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-02-11 20:13 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-02-11 20:13 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2015-02-11 20:13 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-02-11 20:13 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-02-11 20:13 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-02-11 20:13 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-02-11 20:13 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-02-11 20:13 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-02-11 20:13 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2015-02-11 20:13 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2015-02-11 20:11 - 2015-01-10 08:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-03-05 19:34 - 2013-10-29 14:53 - 01559257 _____ () C:\WINDOWS\WindowsUpdate.log 2015-03-05 19:20 - 2013-08-17 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-1001 2015-03-05 19:15 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-03-05 19:11 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-03-05 19:11 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2015-03-05 19:11 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data 2015-03-05 19:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-03-05 19:08 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6} 2015-03-05 19:07 - 2013-08-22 14:46 - 00315945 _____ () C:\WINDOWS\setupact.log 2015-03-05 19:05 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP 2015-03-05 19:04 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive 2015-03-05 01:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-03-03 15:01 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-03-03 15:00 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner 2015-03-03 14:48 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle 2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java 2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard 2015-03-03 13:33 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-02-24 23:09 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache 2015-02-12 09:24 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-02-12 09:23 - 2013-09-29 19:04 - 00032246 _____ () C:\WINDOWS\PFRO.log 2015-02-12 00:38 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1 2015-02-12 00:38 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser 2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2015-02-12 00:37 - 2013-08-19 01:13 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-02-11 20:49 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-02-04 23:09 - 2013-08-17 18:18 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-02-03 19:31 - 2014-12-12 11:05 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-02-03 19:31 - 2014-12-12 11:05 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl ==================== Files in the root of some directories ======= 2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg Some content of TEMP: ==================== C:\Users\Standard\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-03 21:39 ==================== End Of Log ============================ Additions : Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by Standard at 2015-03-05 19:47:46
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29480 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1402.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
11-02-2015 20:53:45 Windows Update
19-02-2015 22:58:54 Geplanter Prüfpunkt
24-02-2015 23:09:15 Windows Update
04-03-2015 00:04:32 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"
==================== Accounts: =============================
Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xa34
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xec
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x12c4
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x76c
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
System errors:
=============
Error: (03/05/2015 07:45:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.
Error: (03/05/2015 07:27:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (03/04/2015 00:05:25 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{0a543ba0-7861-11e2-8d38-d60b12dec0bc}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{84DCEC0C-94C3-49C0-B572-5573AA6F1404}
Error: (03/04/2015 00:05:14 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "TI31051200A" wurde eine Beschädigung erkannt.
In einer Indexstruktur des Dateisystems wurde eine Beschädigung gefunden. Die Dateireferenznummer ist 0x40000000162f1. Der Name der Datei ist "\Windows\System32\DriverStore\FileRepository". Das Attribut des beschädigten Indexes ist ":$I30:$INDEX_ALLOCATION".
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 03:16:24 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.
Die genaue Art der Beschädigung ist unbekannt. Die Dateisystemstrukturen müssen online überprüft werden.
Error: (03/03/2015 03:12:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (03/03/2015 03:02:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aa3401d0577ce9733e01C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe275745ee-c370-11e4-bed7-7c050738016e
Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aec01d0577a69f6aa56C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exea8e40698-c36d-11e4-bed7-7c050738016e
Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a12c401d055c47b2b8440C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeb937cef2-c1b7-11e4-bed7-7c050738016e
Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a76c01d055c2f82e9b10C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe3fd774c2-c1b6-11e4-bed7-7c050738016e
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 23%
Total physical RAM: 8073.22 MB
Available physical RAM: 6151.34 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 14374.57 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:597.87 GB) NTFS
Drive d: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:422.99 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: E6615A88)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
CHECKRESULTS Code:
ATTFilter mbam-check result log version: 2.1.1.1001 ======================================== User Account type: Administrator OS: Windows 8.1 64 bit Operating System Current Version and Build: 6.3.9200.0 Malwarebytes Anti-Malware : Installed On: 2014/06/25 Malware Database: 0000.00.00.00 Rootkit Database: 0000.00.00.00 Remediation Database: 0000.00.00.00 IP Database: 0000.00.00.00 Domain Database: 0000.00.00.00 License: Premium Malware Protection: 4 (The service is running.) Malicious Website Protection: 1 (The service is not running.) Chameleon: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon Log Created: 2015/03/05 20:03:28 Compatibility Flag Settings: ================================= Malwarebytes Anti-Malware Shell Extension Block Check: ====================================================== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked: MBAM Startup Entries: ===================== HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Malwarebytes Anti-Malware Service and Driver Status: ======================================================= --------------Driver File Info:-------------- C:\WINDOWS\system32\drivers\mbam.sys File Size: 25816 BYTES FileVersion: 0.1.13.0 MD5: [f92b0e478c0faa6d6661e6e977247e60] C:\WINDOWS\system32\drivers\mwac.sys File Size: 64216 BYTES FileVersion: 1.0.1.0 MD5: [0664f6335f108f38fe08c3ca747311ee] C:\WINDOWS\system32\drivers\mbamswissarmy.sys File Size: 122584 BYTES FileVersion: 0.1.7.0 MD5: [8a50d5304e6ae48664cf5838ec32f647] C:\WINDOWS\system32\drivers\mbamchameleon.sys File Size: 91352 BYTES FileVersion: 1.0.4.0 MD5: [9d9ed48f841ea37aa5310d54b9e5d3c7] --------------MBAMProtector:-------------- Type: 2 State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE: 0 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 --------------MBAMService:-------------- Type: 16 State: 1 (The service is not running.) (State is stopped) WIN32_EXIT_CODE: 1067 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 --------------MBAMScheduler:-------------- Type: 16 State: 4 (The service is running.) WIN32_EXIT_CODE: 0 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 --------------MBAMChameleon:-------------- Type: N/A State: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon WIN32_EXIT_CODE: N/A SERVICE_EXIT_CODE: N/A CHECKPOINT: N/A WAIT_HINT: N/A --------------MBAMWebAccessControl:-------------- Type: 1 State: 1 (The service is not running.) (State is stopped) WIN32_EXIT_CODE: 1077 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 Required Dependencies: ====================== --------------BFE:-------------- Type: 32 State: 4 (The service is running.) WIN32_EXIT_CODE: 0 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE DisplayName REG_SZ @%SystemRoot%\system32\bfe.dll,-1001 ErrorControl REG_DWORD 1 Group REG_SZ NetworkProvider ImagePath REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork Start REG_DWORD 2 Type REG_DWORD 32 Description REG_SZ @%SystemRoot%\system32\bfe.dll,-1002 DependOnService REG_MULTI_SZ RpcSs WfpLwfs ObjectName REG_SZ NT AUTHORITY\LocalService ServiceSidType REG_DWORD 3 RequiredPrivileges REG_MULTI_SZ SeAuditPrivilege FailureActions REG_BINARY Binary Data HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters ServiceDllUnloadOnStop REG_DWORD 1 ServiceMain REG_SZ BfeServiceMain ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\bfe.dll HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data {84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Options EnablePacketQueue REG_DWORD 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Callout {22001ee0-8e87-4f75-ba58-248f5918a63a}REG_BINARY Binary Data {79f2a265-b693-4cc9-b480-cbcd87bd4747}REG_BINARY Binary Data {c4b50f21-503e-4d7a-abd4-ed0a823a2453}REG_BINARY Binary Data {91e902db-2cef-4040-b8e2-02fe4fd49c25}REG_BINARY Binary Data HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter {3a90a266-1519-4d23-911b-e84cd0f02ab8}REG_BINARY Binary Data {8b50e2ec-7cF0-4b71-b42e-5b0536f6cab8}REG_BINARY Binary Data {17043d46-fac2-4561-bca1-0c7a05e95f5f}REG_BINARY Binary Data {3180114b-8338-4740-9a16-444134ad62f4}REG_BINARY Binary Data {d870c96c-75ee-46a6-8a02-8e4401a73423}REG_BINARY Binary Data {4137b143-2770-43d4-91a2-55bb0a069830}REG_BINARY Binary Data {b02a4013-b6b5-4859-9168-1e3299e43b24}REG_BINARY Binary Data {4e718c57-c397-4221-9fbb-14fd51701d6a}REG_BINARY Binary Data {567d3836-3f5b-4067-b9c4-952f677010a2}REG_BINARY Binary Data {70694559-714a-4a38-a0cd-51439e06f1d8}REG_BINARY Binary Data {89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data {84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data {e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}REG_BINARY Binary Data {b98b75dc-17c0-4e84-bd4e-2080527ca6a6}REG_BINARY Binary Data {56b4fdc4-bb4e-4c42-a9d8-f627ee15ac21}REG_BINARY Binary Data {1ba41ed8-151d-4577-9272-317856bc637c}REG_BINARY Binary Data {9248d57e-f843-4159-807d-3813173e2096}REG_BINARY Binary Data {4658cd86-525d-44ed-98a5-791a7b8655f1}REG_BINARY Binary Data {dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data {f444c576-6e60-4ea2-9faa-80d57ed12cd2}REG_BINARY Binary Data {0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data {12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data {c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data {0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data {4d9581d2-aef8-4993-84cd-b986ced80d42}REG_BINARY Binary Data {be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}REG_BINARY Binary Data {716b48eb-0a35-4a76-92ab-1d987230d288}REG_BINARY Binary Data {1165065e-4996-4338-abaf-4b8556b4d431}REG_BINARY Binary Data {07a24961-a760-4e80-b263-6d275e1b09cb}REG_BINARY Binary Data {5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}REG_BINARY Binary Data {b6b2ca61-fb98-4422-adc2-e7cf56b3680c}REG_BINARY Binary Data {0aa7fff8-919f-453c-928c-28a12122ba38}REG_BINARY Binary Data {074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data {c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data {a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data {0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data {91ffecf0-0a9e-4572-95f1-a7111af86967}REG_BINARY Binary Data {64e55933-15a5-495d-a928-ccca43d44875}REG_BINARY Binary Data {13bfd422-6f75-4408-8924-9400ec0cb19c}REG_BINARY Binary Data {cbfb56db-3c85-4543-9bc2-76ea28cdd74e}REG_BINARY Binary Data {2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data {375fb39b-08c6-40f2-bdf2-08fa63f970a2}REG_BINARY Binary Data {2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data {c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data {b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}REG_BINARY Binary Data {3697a558-3ed3-49be-a4c1-c1a4448653b4}REG_BINARY Binary Data {935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data {941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider {decc16ca-3f33-4346-be1e-8fb4ae0f3d62}REG_BINARY Binary Data {4b153735-1049-4480-aab4-d1b9bdc03710}REG_BINARY Binary Data {1bebc969-61a5-4732-a177-847a0817862a}REG_BINARY Binary Data {839cd73f-1907-49ea-9aa5-0e6be9048087}REG_BINARY Binary Data {aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}REG_BINARY Binary Data HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer {b3cdd441-af90-41ba-a745-7c6008ff2300}REG_BINARY Binary Data {b3cdd441-af90-41ba-a745-7c6008ff2301}REG_BINARY Binary Data {b3cdd441-af90-41ba-a745-7c6008ff2302}REG_BINARY Binary Data {9ba30013-c84e-47e5-ac6e-1e1aed72fa69}REG_BINARY Binary Data {8c36b346-4e0c-4049-8b55-5295ac35567c}REG_BINARY Binary Data --------------fltmgr:-------------- Type: 2 State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) WIN32_EXIT_CODE: 0 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr AttachWhenLoaded REG_DWORD 1 DisplayName REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10001 ErrorControl REG_DWORD 3 Group REG_SZ FSFilter Infrastructure ImagePath REG_EXPAND_SZ system32\drivers\fltmgr.sys Start REG_DWORD 0 Tag REG_DWORD 1 Type REG_DWORD 2 Description REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10000 C:\WINDOWS\system32\drivers\fltmgr.sys File Size: 360792 BYTES FileVersion: 6.3.9600.17090 MD5: [6592d192e2823c043edbc010e7774053] C:\WINDOWS\SysWOW64\olepro32.dll File Size: 80384 BYTES FileVersion: 6.3.9600.16384 MD5: [0fc9b04c7f729498b41a19fa55c33573] MBAM Registry Settings and License Info: ======================================== --------------Settings:-------------- Advanced: AutomaticQuarantine: true AutostartProtection: true LimitedMode: false StartSilentMode: false StartupDelay: 0 ApplicationState: First-Run-After-Installation: false General: DaysUntilNotifyExpiration: 5 Language: RightClickAccess: true SilentErrors: false Logging: ExportLog: true Notification: ProtectionTray: DisplayMilliseconds: 7000 ScanHistory: Duration_Complete: 2000 Duration_Driver: 0 Duration_Filesystem: 0 Duration_Heuristics: 0 Duration_Loading: 0 Duration_MasterBootRecord: 0 Duration_Memory: 40000 Duration_PreScan: 3000 Duration_Registry: 12000 Duration_Sector: 0 Duration_Startup: 13000 ItemCount_Complete: 0 ItemCount_Driver: 0 ItemCount_Filesystem: 0 ItemCount_Heuristics: 0 ItemCount_Loading: 0 ItemCount_MasterBootRecord: 0 ItemCount_Memory: 2797 ItemCount_PreScan: 0 ItemCount_Registry: 637 ItemCount_Sector: 0 ItemCount_Startup: 1483 LastScanDateEpoch: 1425395637168 LastScanType: 1 (Threat Scan) Update: LastUpdate: 2014-07-17T23:03:49 NotifyInstallReady: true NotifyOutdatedDatabase: 1 ProxyPassword: ProxyPort: 0 ProxyServer: ProxyUsername: UseProxy: false UseProxyAuthentication: false --------------Account:-------------- Account Status: Premium Expiration Time: 2034/06/25 19:23:27 Activation Time: 2014/06/25 19:23:27 Trial Used: false --------------Access Policies:-------------- Scheduler Queue: ================ tasks: 5e7ebea2-0b33-4128-9099-c88ddfcc5630: parameters: CheckForUpdatesBeforeScanStart: false ProcessLaunchedFromScheduler: true ScanConfig: ExitWhenNoMalwareDetected: false FileSystemOption: true RebootSystemWhenMalwareDetected: false RemoveMalwareAutomaticallyWhenScanEnds: false ScanArchives: true ScanHeuristic: true ScanMemoryObjects: true ScanPUM: 2 ScanPUP: 2 ScanRegistry: true ScanRootkits: false ScanStartup: true ScanTargets: ScanType: 1 (Threat Scan) Silent: true StartTaskFromSystemAccount: false TaskType: 0 triggers: 7aac6cd6-1af0-40c1-9471-28baa867892e: dateinterval: 0:0:0 lastscheduled: Thu, 05 Mar 2015 19:04:45.710949 +0000 lasttriggered: Thu, 05 Mar 2015 19:04:45.710949 +0000 nextscheduled: Thu, 05 Mar 2015 20:04:45.710949 +0000 recovery: 00:00:00 start: Tue, 03 Mar 2015 14:13:56 +0000 timeinterval: 01:00:00 type: 3 uuid: 7aac6cd6-1af0-40c1-9471-28baa867892e type: scan uuid: 5e7ebea2-0b33-4128-9099-c88ddfcc5630 90bc4336-09b0-4a97-ab20-e2165a367be4: parameters: CheckForUpdatesBeforeScanStart: true ProcessLaunchedFromScheduler: true ScanConfig: ExitWhenNoMalwareDetected: false ExportLog: true FileSystemOption: true RebootSystemWhenMalwareDetected: false RemoveMalwareAutomaticallyWhenScanEnds: false ScanArchives: true ScanExtra: true ScanHeuristic: true ScanMemoryObjects: true ScanPUM: 2 ScanPUP: 2 ScanRegistry: true ScanRootkits: false ScanStartup: true ScanTargets: ScanType: 1 (Threat Scan) Silent: true TerminateExplorerWhenMalwareIsRemoved: false StartTaskFromSystemAccount: false TaskType: 0 triggers: 6d7c30f9-93f5-4612-802d-568411c3e122: dateinterval: 1:0:0 lastscheduled: Thu, 05 Mar 2015 00:00:06.219142 +0000 lasttriggered: Thu, 05 Mar 2015 00:00:06.219142 +0000 nextscheduled: Thu, 05 Mar 2015 23:52:54.219142 +0000 recovery: 23:00:00 start: Thu, 26 Jun 2014 03:05:23 +0100 timeinterval: 00:00:00 type: 4 uuid: 6d7c30f9-93f5-4612-802d-568411c3e122 type: scan uuid: 90bc4336-09b0-4a97-ab20-e2165a367be4 fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c: parameters: NotifyWhenUpdateCompletes: true ProcessLaunchedFromScheduler: true TaskType: 3 triggers: 96f87719-1e68-4d0b-bc5f-c8bb5f8426d4: dateinterval: 0:0:0 lastscheduled: Thu, 05 Mar 2015 19:04:45.710949 +0000 lasttriggered: Thu, 05 Mar 2015 19:04:45.710949 +0000 nextscheduled: Thu, 05 Mar 2015 20:11:49.710949 +0000 recovery: 00:00:00 start: Wed, 25 Jun 2014 19:56:50.261896 +0100 timeinterval: 01:00:00 type: 3 uuid: 96f87719-1e68-4d0b-bc5f-c8bb5f8426d4 type: update uuid: fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c Pending File Rename Operations: ================================ If any Malwarebytes Anti-Malware items are listed below, the user must reboot to complete a Malwarebytes Anti-Malware upgrade installation. Pending File Rename Operations: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\ PendingFileRenameOperations REG_MULTI_SZ \??\C:\Program Files (x86)\Avira\AntiVir Desktop\aeheur.dll.tmp MBAMProtector Registry Values: ============================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector Type REG_DWORD 2 Start REG_DWORD 3 ErrorControl REG_DWORD 1 ImagePath REG_EXPAND_SZ \??\C:\WINDOWS\system32\drivers\mbam.sys Group REG_SZ FSFilter Anti-Virus DependOnService REG_MULTI_SZ FltMgr WOW64 REG_DWORD 1 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances DefaultInstance REG_SZ MBAMProtector Instance HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances\MBAMProtector Instance Altitude REG_SZ 328800 Flags REG_DWORD 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Parameters PassThruFile REG_DWORD 0 ProductPath REG_DWORD 0 MBAMService Registry Values: ============================ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService Type REG_DWORD 16 Start REG_DWORD 2 ErrorControl REG_DWORD 1 ImagePath REG_EXPAND_SZ "C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe" DependOnService REG_MULTI_SZ MBAMProtector WOW64 REG_DWORD 1 ObjectName REG_SZ LocalSystem DelayedAutostart REG_DWORD 0 MBAMScheduler Registry Values: ============================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMScheduler Type REG_DWORD 16 Start REG_DWORD 2 ErrorControl REG_DWORD 1 ImagePath REG_EXPAND_SZ "C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe" WOW64 REG_DWORD 1 ObjectName REG_SZ LocalSystem Terminal Services Status for (null) entries in PM logs and GetUserToken errors: =============================================================================== --------------TERMService:-------------- Type: 32 State: 1 (The service is not running.) (State is stopped) WIN32_EXIT_CODE: 1077 SERVICE_EXIT_CODE: 0 CHECKPOINT: 0 WAIT_HINT: 0 TermService Start is set to: 3 (Manual Startup) Proxy Status: No proxy is Set LAN Settings: ============= only 'Automatically detect settings' is selected SystemPartition: ================ HKEY_LOCAL_MACHINE\SYSTEM\Setup\ SystemPartition REG_SZ \Device\HarddiskVolume2 Balloon Tips Status: ==================== Enabled Time Format Settings: ===================== Should be: h:mm:ss tt AM PM : Currently: REG_SZ HH:mm:ss REG_SZ REG_SZ REG_SZ Language and Regional Settings: =============================== ACP: Language is English (United States) MACCP: Language is English (United States) OEMCP: 850 Please refer to this link for details: Here Startup Folders for Error_Expanding_Variables Check: ==================================================== All Users Startup Folder Exists. Current User's Startup Folder Exists. Context Menu Entries: ===================== HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt (Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3} HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\MBAMShlExt (Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3} HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt (Default): REG_SZ MBAMShlExt Class HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CLSID (Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3} HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CurVer (Default): REG_SZ MBAMExt.MBAMShlExt.1 HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1 (Default): REG_SZ MBAMShlExt Class HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1\CLSID (Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3} HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE} (Default): REG_SZ IMBAMShlExt HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\ProxyStubClsid32 (Default): REG_SZ {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\TypeLib (Default): REG_SZ {AFF1A83B-6C83-4342-8E68-1648DE06CB65} Version REG_SZ 1.0 HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3} (Default): REG_SZ MBAMShlExt Class HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 (Default): REG_SZ C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll ThreadingModel REG_SZ Apartment HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\ProgID (Default): REG_SZ MBAMExt.MBAMShlExt.1 HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\TypeLib (Default): REG_SZ {AFF1A83B-6C83-4342-8E68-1648DE06CB65} HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\VersionIndependentProgID (Default): REG_SZ MBAMExt.MBAMShlExt HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65} HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0 (Default): REG_SZ MBAMExt 1.0 Type Library HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0 HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32 (Default): REG_SZ C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS (Default): REG_SZ 0 HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR (Default): REG_SZ C:\Program Files (x86)\ Malwarebytes Anti-Malware HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65} HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0 (Default): REG_SZ MBAMExt 1.0 Type Library HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0 HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32 (Default): REG_SZ C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS (Default): REG_SZ 0 HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR (Default): REG_SZ C:\Program Files (x86)\ Malwarebytes Anti-Malware List of MBAM Related Directories: ================================= C:\Program Files (x86)\ Malwarebytes Anti-Malware \ 7z.dll File Size: 920888 BYTES FileVersion: 9.20.0.0 MD5: [9f522b2708cab181c0f137abbcd1de2e] changes.txt File Size: 2261 BYTES FileVersion: N/A MD5: [af70267bdf9a37a96f1a79a5c3720ae6] license.rtf File Size: 39478 BYTES FileVersion: N/A MD5: [8627b31943a534aad30d154c2b2c1aaf] master.conf File Size: 1258 BYTES FileVersion: N/A MD5: [9702ca5e82d3756c6d8af34a2ababaea] mbam.dll File Size: 579896 BYTES FileVersion: 1.0.7.0 MD5: [d32c2a98859cb22d57a665f15f351e7d] mbam.exe File Size: 6970168 BYTES FileVersion: 1.0.0.532 MD5: [4fbc630768570e6ac35c3de8f6ec79f5] mbamcore.dll File Size: 1680696 BYTES FileVersion: 1.0.11.0 MD5: [f722fa26739eafcbd8d5f3829b632cd7] mbamdor.exe File Size: 54072 BYTES FileVersion: 1.0.1.0 MD5: [4da2f2da54a92850f56c0db712058188] mbamext.dll File Size: 184632 BYTES FileVersion: 3.0.4.0 MD5: [945bb364b09f3a8e998dbff02a0a5a58] mbampt.exe File Size: 39736 BYTES FileVersion: 1.0.0.0 MD5: [9acd7583584c93ee542c273df8e91dc1] mbamscheduler.exe File Size: 1809720 BYTES FileVersion: 3.0.2.0 MD5: [d84aea3f3329d622dfc1297dddf6163b] mbamservice.exe File Size: 860472 BYTES FileVersion: 3.0.2.0 MD5: [4f45ed469906494f9bf754e476390dbd] mbamsrv.dll File Size: 4437816 BYTES FileVersion: 1.1.0.0 MD5: [9b48e38c35f08fa831b387a0b27c40aa] mbamtoast.dll File Size: 96568 BYTES FileVersion: 1.70.0.0 MD5: [cb3f6732c7027a65f56bcb4cc7c481d3] msvcp100.dll File Size: 421688 BYTES FileVersion: 10.0.40219.325 MD5: [e4b829081e639e42985853bae754a53d] msvcr100.dll File Size: 774456 BYTES FileVersion: 10.0.40219.325 MD5: [80fcedbe920e9cbe30d9d3665bd6efed] QtCore4.dll File Size: 2732856 BYTES FileVersion: 4.8.4.0 MD5: [30490eed6a1e20e8259c0b9c58f488fe] QtGui4.dll File Size: 8575288 BYTES FileVersion: 4.8.4.0 MD5: [15e21aa7d0c0c994cd565eeb96d13c20] QtNetwork4.dll File Size: 909112 BYTES FileVersion: 4.8.4.0 MD5: [d7588d42e29080c32a003bee465160d8] unins000.dat File Size: 23072 BYTES FileVersion: N/A MD5: [fac020ffb31097943aeef8d7a4552512] unins000.exe File Size: 720281 BYTES FileVersion: 51.52.0.0 MD5: [c83db9e4930485eaf971e90043da9e2e] C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Chameleon C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Chameleon\Windows chameleon.chm File Size: 235882 BYTES FileVersion: N/A MD5: [c4190b71f037714aa77aba294434ba5b] firefox.com File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] firefox.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] firefox.pif File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] firefox.scr File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] iexplore.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] mbam-chameleon.com File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] mbam-chameleon.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] mbam-chameleon.pif File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] mbam-chameleon.scr File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] mbam-killer.exe File Size: 1181496 BYTES FileVersion: N/A MD5: [c6927fd8f7e9105b64db5d5a08b53731] rundll32.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] svchost.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] windows.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] winlogon.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee] C:\Program Files (x86)\ Malwarebytes Anti-Malware \\imageformats qgif4.dll File Size: 32568 BYTES FileVersion: 4.8.4.0 MD5: [e59f533c26c8375cd120b4791482217e] C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Languages lang_bg.qm File Size: 144048 BYTES FileVersion: N/A MD5: [9ccb79999432d56b9843a3e2b2c90325] lang_bs.qm File Size: 145523 BYTES FileVersion: N/A MD5: [6ab7a6274d4f9f7553c944f5c66201ba] lang_ca.qm File Size: 132254 BYTES FileVersion: N/A MD5: [68a83ec63b6e7bc5dbdd412bcc49c6ce] lang_cs.qm File Size: 141243 BYTES FileVersion: N/A MD5: [6b8acee7f461fa69b83d2c45c3725427] lang_da.qm File Size: 130101 BYTES FileVersion: N/A MD5: [8539796784746218b229419e99ab308d] lang_de.qm File Size: 149462 BYTES FileVersion: N/A MD5: [fcd3bc376ad219396e8c7d3c87cd8864] lang_el.qm File Size: 149912 BYTES FileVersion: N/A MD5: [74f13f95f63fe96c08e571598df052d6] lang_en.qm File Size: 115961 BYTES FileVersion: N/A MD5: [8c9da1c0ce06b89f8d323bf948bfba4e] lang_es.qm File Size: 130487 BYTES FileVersion: N/A MD5: [33e1c6d40b841cc2e783ec8d8102e66f] lang_et.qm File Size: 138126 BYTES FileVersion: N/A MD5: [aa215b5f37a72a69854c9163ac543b51] lang_fi.qm File Size: 144256 BYTES FileVersion: N/A MD5: [18912c339939c3a6629004ec900f4fe4] lang_fr.qm File Size: 149253 BYTES FileVersion: N/A MD5: [ec2bf2f431c4273f151b8c8a7b84c387] lang_he.qm File Size: 116101 BYTES FileVersion: N/A MD5: [9e692744e77051c6ce14df32f9b71920] lang_hr.qm File Size: 139841 BYTES FileVersion: N/A MD5: [3e3737fe86eb595c5f6817eebf731aa7] lang_hu.qm File Size: 145621 BYTES FileVersion: N/A MD5: [52d3d7fcf8c8db071ef0573a1357c2fd] lang_id.qm File Size: 143102 BYTES FileVersion: N/A MD5: [80473d2c73d2f54f2b23c9316f2d0ceb] lang_it.qm File Size: 146851 BYTES FileVersion: N/A MD5: [7e7aea7d0b433d7e912ed9f0887684a7] lang_ja.qm File Size: 121282 BYTES FileVersion: N/A MD5: [19ac79b7a5e05d665e417c2dd75afc94] lang_ko.qm File Size: 118033 BYTES FileVersion: N/A MD5: [de213178c14490bf452ea45278d3442d] lang_nl.qm File Size: 146325 BYTES FileVersion: N/A MD5: [5aec6f6bdc5e6c28744e6ef374709eeb] lang_no.qm File Size: 142918 BYTES FileVersion: N/A MD5: [4388c08217618af2e24173af6f5d3f97] lang_pl.qm File Size: 145434 BYTES FileVersion: N/A MD5: [699700c889447d1f9b607c04f07fff67] lang_pt_BR.qm File Size: 131739 BYTES FileVersion: N/A MD5: [a3430222223d59da8ec6ea1edae5ee2f] lang_pt_PT.qm File Size: 149128 BYTES FileVersion: N/A MD5: [afdf1907af4c95f9af510d5fc1bb9067] lang_ro.qm File Size: 121166 BYTES FileVersion: N/A MD5: [1672a2b3a9807a1497fe43824c0026c0] lang_ru.qm File Size: 122186 BYTES FileVersion: N/A MD5: [d4dd1eea2b0f52aba2fca4d159c387f7] lang_sk.qm File Size: 119827 BYTES FileVersion: N/A MD5: [8b200d162e8028843e41aa1a927cfd84] lang_sl.qm File Size: 143191 BYTES FileVersion: N/A MD5: [1760a6aa6990b2f0c4c71ec04b25ac9c] lang_sr.qm File Size: 143261 BYTES FileVersion: N/A MD5: [377d15c0da0249f4a7a58978b6307d81] lang_sv.qm File Size: 142525 BYTES FileVersion: N/A MD5: [2587ead21967296fefdd0ee0684fe8b4] lang_tr.qm File Size: 142194 BYTES FileVersion: N/A MD5: [880fcbe97ec6f13ec094f7371b5b295f] lang_vi.qm File Size: 126874 BYTES FileVersion: N/A MD5: [c61281786b5bfec68afc742a19f6abd9] lang_zh_tr.qm File Size: 110870 BYTES FileVersion: N/A MD5: [f223d83580b1ee35edea13293cb2c80d] C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Plugins fixdamage.exe File Size: 821560 BYTES FileVersion: 1.1.0.1010 MD5: [3a4dcd021d9f3a5305a22e5e309da305] C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware actions.ref File Size: 314 BYTES FileVersion: N/A MD5: [b26a36c0696e299fdfebe180c09c2737] domains.ref File Size: 38 BYTES FileVersion: N/A MD5: [8c30b536b67543eb68e68b9640d4d498] exclusions.dat File Size: 140 BYTES FileVersion: N/A MD5: [724d5aeeb7e57420d425044679ee5209] ips.ref File Size: 33 BYTES FileVersion: N/A MD5: [8a1c580788ea8de3f32862c2c1cf373c] rules.ref File Size: 8863610 BYTES FileVersion: N/A MD5: [9d389c002ea17dd045da4895ddec27e0] S-1-5-18-0-ntuser.dat File Size: 704512 BYTES FileVersion: N/A MD5: [6b5a548b3dfd3c0cabef14b49b51b1bd] S-1-5-18-0-ntuser.dat.LOG1 File Size: 57344 BYTES FileVersion: N/A MD5: [17df360f3e11285083f09d36011be5e3] S-1-5-18-0-ntuser.dat.LOG2 File Size: 143360 BYTES FileVersion: N/A MD5: [33a008b39aa31fcdd90f964e8db3cf01] S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [6816fb565f2eaaa62f26c6ec8cda8ffa] S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [a1dac2b305a9d35bad4c5d886e2d4f81] S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-18-1-ntuser.dat File Size: 704512 BYTES FileVersion: N/A MD5: [dc49f2f183e3be3d2d4ff1e5218c4088] S-1-5-18-1-ntuser.dat.LOG1 File Size: 188416 BYTES FileVersion: N/A MD5: [bfddbaa227db76c6c289f94bb9ea7d07] S-1-5-18-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [8a293a2f1884cc0fb6834778ba015784] S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [9a802aa7c09a84796a35e00685b38f00] S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [040282b950b3ab2e6b81a7e0cb4d2c4c] S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-18-2-ntuser.dat File Size: 700416 BYTES FileVersion: N/A MD5: [b8fd93873e3865df577bd1bb8672a810] S-1-5-18-2-ntuser.dat.LOG1 File Size: 200704 BYTES FileVersion: N/A MD5: [8f12924d39789720d6f58f11c9cfd6d1] S-1-5-18-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [c61160b6331c15a6c1f2f0bd8c616f5e] S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [5fb0fbf8cf89a143fe48c5d4eb2646f8] S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [4ff1b9e4316eb27a844c1c57a79e3ad1] S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-18-3-ntuser.dat File Size: 712704 BYTES FileVersion: N/A MD5: [3464492656b64b88ca6d84746c06cc97] S-1-5-18-3-ntuser.dat.LOG1 File Size: 86016 BYTES FileVersion: N/A MD5: [b25cbd6f5f1ea5ff24db1e6a405fe0c7] S-1-5-18-3-ntuser.dat.LOG2 File Size: 110592 BYTES FileVersion: N/A MD5: [3d0d55eb386a7e92f27c85f6bf8e509b] S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [35f9d299a6569d9699d7d5c42fdae8b6] S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [f367c43fcfbe4027108300860c3d6402] S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-18-4-ntuser.dat File Size: 712704 BYTES FileVersion: N/A MD5: [693505122959e46a3ef6ca7a37ac5a29] S-1-5-18-4-ntuser.dat.LOG1 File Size: 192512 BYTES FileVersion: N/A MD5: [829765f1af24b9188e1af6e90f3c9ace] S-1-5-18-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e] S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [55045203021b326be7a3b540bd176612] S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [0dcb7cacac4379ecf42e1e11a7e4cc69] S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-19-0-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [d6fba4138ff9fdeb197162b8c53fce80] S-1-5-19-0-ntuser.dat.LOG1 File Size: 40960 BYTES FileVersion: N/A MD5: [693879c7f81b823b5fd4478b653acabd] S-1-5-19-0-ntuser.dat.LOG2 File Size: 147456 BYTES FileVersion: N/A MD5: [ea691b7e114538b59fea5404eacc52cb] S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [c74d8888757cdec6746e33125b523700] S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [de89f5907934d3d64235d70cb728df3c] S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-19-1-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [0c954c292b80656ed027ee52dece738e] S-1-5-19-1-ntuser.dat.LOG1 File Size: 176128 BYTES FileVersion: N/A MD5: [f173fb29966b9783a7bf1ea64a16851d] S-1-5-19-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [4eeb87f219a266db2e0c7f4b566d25bf] S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [917673819023ee076376302bb87b598b] S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [36f848c02d37e91c64e2148fe60184d4] S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-19-2-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [a70fbd74ae178cc6a57ca8a066936591] S-1-5-19-2-ntuser.dat.LOG1 File Size: 176128 BYTES FileVersion: N/A MD5: [0f1b17a3d340653987ba6eb3ca299d82] S-1-5-19-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [b3020c2527bc3bbc3cf89905cd43cf99] S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [f5c72a7130b0f558a5f93c0d1d81c5c4] S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [3eb7a869dcc93cd5425e5b40de8edc02] S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-19-3-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [4ecce3622ebd5abf3a0a469ed2938a89] S-1-5-19-3-ntuser.dat.LOG1 File Size: 61440 BYTES FileVersion: N/A MD5: [d73a49af316e4d6914f379d83628d743] S-1-5-19-3-ntuser.dat.LOG2 File Size: 118784 BYTES FileVersion: N/A MD5: [0929a50906ea17f3711c8d3a5dcd8afa] S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [b499b912185317472c4337bbd38e33f7] S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [cdaffa84768ab0dce3518da0daa914d0] S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-19-4-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [4d8615cf98078169ee9ac868735e3d70] S-1-5-19-4-ntuser.dat.LOG1 File Size: 180224 BYTES FileVersion: N/A MD5: [9c986f305ad1a3aeb93bae21bfebc093] S-1-5-19-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e] S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [c1742f9a374dd21e977e2fadd46e0857] S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [a3736b15fe4ab7eaaee4e4d17bb7bdf3] S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-20-0-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [37b515e2b33f7c426df7d60886a3e1bb] S-1-5-20-0-ntuser.dat.LOG1 File Size: 36864 BYTES FileVersion: N/A MD5: [8262eeb34e5574000c517f69873f5f18] S-1-5-20-0-ntuser.dat.LOG2 File Size: 135168 BYTES FileVersion: N/A MD5: [41f208fae388ad47d0d906c6bff8f8a9] S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [df2b10fb871b43805ef865decfb65a3a] S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [388767cd11750a20bacb7f286034b0ec] S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-20-1-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [cee596e968eb3635b0e6cb4feecb2cc1] S-1-5-20-1-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [e35f52c3f51f72cae4a5ae2b5f1645a3] S-1-5-20-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [754d89ad01a0816c775f39e67e307170] S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [fe6c9c8982df9dabffc4a651d49675b2] S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [809a0090dc7a077d4e9fa9cfbf6587b6] S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-20-2-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [f6609b88ab6fb82c595a81d1c7eb5abf] S-1-5-20-2-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [0b9ebfeb9018492f871e90e47ca9708d] S-1-5-20-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [2b96e77dad94e2fd05267b4e59227dfe] S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [069295c78b53051b7b2fbafc6e009a8c] S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [9251a87c755dd08f9cf34f1fc41321b9] S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-20-3-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [82dae0b7f5134b0e34247ed64bc45748] S-1-5-20-3-ntuser.dat.LOG1 File Size: 53248 BYTES FileVersion: N/A MD5: [11cac051b53cbdf73363e10415186eaf] S-1-5-20-3-ntuser.dat.LOG2 File Size: 106496 BYTES FileVersion: N/A MD5: [f3928cb9d5c607cf95f342ce48b0b34e] S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [0bc13804a4a0264c9e957bac31de33b7] S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [5246dd537049fee8b997a33fd54c1147] S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-20-4-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [f791ad2fbf9ed206ad764fece74901ff] S-1-5-20-4-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [7abcd573c17b1958c4703b29189ada25] S-1-5-20-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e] S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [afb6a248b897db712fd870dd974f8002] S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [c15f2fb49eaa094288ceeebc09a2d093] S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat File Size: 1470464 BYTES FileVersion: N/A MD5: [cac242444602a56a61d3fd2493f16dac] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG1 File Size: 94208 BYTES FileVersion: N/A MD5: [044580c8b2c5bbc144158df6f75fa70d] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG2 File Size: 569344 BYTES FileVersion: N/A MD5: [7281d5c1eebc1fac15e593850dce4589] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [98d931e4d1f33fda69f6bd8e23925b7f] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [e9897af43c5b038e280125234e83e662] S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat File Size: 1474560 BYTES FileVersion: N/A MD5: [8024b722285aaf3fa0094aff5c59e718] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG1 File Size: 634880 BYTES FileVersion: N/A MD5: [12991ffddde2d8c861a2ef93f69aa72f] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG2 File Size: 16384 BYTES FileVersion: N/A MD5: [26b6a0842eecb4f9d72dfe251cf7f615] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [fba12a1a28f34d43f13de017033d08f2] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [e814135258c24add4119aabb1db0bafe] S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat File Size: 1478656 BYTES FileVersion: N/A MD5: [5184759010cc9a5299c4e5b881864b37] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG1 File Size: 618496 BYTES FileVersion: N/A MD5: [eb1ea80e80ac81799adb3619c17ab3d1] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [78c4fa70f03a23518e2e91d0466587ef] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [4bdb135aa24c26b13ea4f6052799e1b4] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [3797bbde08845bcedbda757e7fd1af16] S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat File Size: 1482752 BYTES FileVersion: N/A MD5: [4b4bc2246e2c5cc1009e36df5cd08b81] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG1 File Size: 225280 BYTES FileVersion: N/A MD5: [26a024ac1268ac8ae931e46b27dcbf35] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG2 File Size: 417792 BYTES FileVersion: N/A MD5: [5e5ac93b13a971dbc5377ca342cbe759] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [84800fdf96a01e2b6ad91a33b1ac1035] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [bde9d199371386ae7b8acc400d24ddc4] S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat File Size: 1486848 BYTES FileVersion: N/A MD5: [4c14a1d143f6ee22c782a4b34be9fc0b] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG1 File Size: 671744 BYTES FileVersion: N/A MD5: [fd2f134b1f086613378020e943a1ec14] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [f1d06ffa7126d9c6a7104459a19f437b] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [7b4a055edccc0410a78566b71cd345b4] S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95] swissarmy.ref File Size: 21903 BYTES FileVersion: N/A MD5: [68cc3f4cebf0705040feee779c643c8e] C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Configuration build.conf File Size: 194 BYTES FileVersion: N/A MD5: [01dd2fbf24bfb8fc2536095eb00acb5b] database.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2] gatekeeper.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2] license.conf File Size: 573 BYTES FileVersion: N/A MD5: [6533c5568b403e8733a23fa8e231d210] manifest.conf File Size: 2133 BYTES FileVersion: N/A MD5: [5ec7491212d5b62725246dcbc0fca59e] marketing.conf File Size: 1434 BYTES FileVersion: N/A MD5: [19533c40d9c9778b2ab423dbcf063d80] net.conf File Size: 333 BYTES FileVersion: N/A MD5: [b576a0e7c7c483ebed18a884d7c8945e] notifications.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2] scheduler.conf File Size: 3560 BYTES FileVersion: N/A MD5: [db3ba362555a1f6544572e7abe4105c5] settings.conf File Size: 1975 BYTES FileVersion: N/A MD5: [dff1ce75f5c62dddfefc2af5eeefcea1] statistics.conf File Size: 597 BYTES FileVersion: N/A MD5: [fa51cb4303462862730bfec3e07d250b] C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Logs mbam-log-2014-07-02 (05-37-23).xml File Size: 2480 BYTES FileVersion: N/A MD5: [f0860c31a50545886f522dc0065e6b36] mbam-log-2014-07-04 (10-08-48).xml File Size: 2480 BYTES FileVersion: N/A MD5: [b01af37b8d8b2ff93409c28809c77bae] mbam-log-2014-07-06 (17-20-06).xml File Size: 2480 BYTES FileVersion: N/A MD5: [198bc1155af42a83248762304264e550] mbam-log-2014-07-08 (18-15-12).xml File Size: 2480 BYTES FileVersion: N/A MD5: [cf59bc88413237e63aefcd0d57d26c99] mbam-log-2014-07-10 (14-55-11).xml File Size: 2482 BYTES FileVersion: N/A MD5: [ce08bcd85e4f45f52fc824f221914d2e] mbam-log-2014-07-11 (14-45-56).xml File Size: 2480 BYTES FileVersion: N/A MD5: [03f03869fdb7036e103a3581abf117c9] mbam-log-2014-07-14 (11-11-06).xml File Size: 2480 BYTES FileVersion: N/A MD5: [7b61e8032c7139f315c13d80958a6737] mbam-log-2014-07-15 (11-59-08).xml File Size: 2480 BYTES FileVersion: N/A MD5: [190fbf0e33fbeaf94b9128c088c65269] mbam-log-2014-07-16 (11-07-15).xml File Size: 2480 BYTES FileVersion: N/A MD5: [c4f23f5a929fa9c1310ffea6d471b301] mbam-log-2014-07-17 (18-49-53).xml File Size: 2480 BYTES FileVersion: N/A MD5: [a7cf455ddeec6445faf7ead514141aa4] mbam-log-2015-03-03 (14-19-26).xml File Size: 2474 BYTES FileVersion: N/A MD5: [7c08691c88836b275fa976ea45051a41] mbam-log-2015-03-03 (15-13-56).xml File Size: 2474 BYTES FileVersion: N/A MD5: [57bb5756a737d08a59a0c1ef4965c425] protection-log-2014-06-25.xml File Size: 4755 BYTES FileVersion: N/A MD5: [6a6ba3f9191502e108e7083c716d576f] protection-log-2014-06-27.xml File Size: 2112 BYTES FileVersion: N/A MD5: [67f885f5ec15ab5fef8ec1d38fd5050e] protection-log-2014-06-28.xml File Size: 3281 BYTES FileVersion: N/A MD5: [d11b95d9b66f1fe99010514ca6a276ce] protection-log-2014-07-02.xml File Size: 9862 BYTES FileVersion: N/A MD5: [16ba74d628a6f900dea0f9c4c91002a6] protection-log-2014-07-03.xml File Size: 8223 BYTES FileVersion: N/A MD5: [1b2a7e95598399d50673bfac6fb143a6] protection-log-2014-07-04.xml File Size: 21529 BYTES FileVersion: N/A MD5: [1066272ee8b08219bf01430a2be5aa7d] protection-log-2014-07-05.xml File Size: 2110 BYTES FileVersion: N/A MD5: [565177150da82da687ced8f491e704c9] protection-log-2014-07-06.xml File Size: 2109 BYTES FileVersion: N/A MD5: [48c5db4acb7f1f6595e0fcae30154bd8] protection-log-2014-07-07.xml File Size: 14415 BYTES FileVersion: N/A MD5: [c352467d2ee0e1fd713135edd2d07047] protection-log-2014-07-08.xml File Size: 14838 BYTES FileVersion: N/A MD5: [4960bc0f3a0f7e0bd1b7f33b1859778b] protection-log-2014-07-09.xml File Size: 10452 BYTES FileVersion: N/A MD5: [f376d745fb29107a63b1d3a63c3f79e4] protection-log-2014-07-10.xml File Size: 3588 BYTES FileVersion: N/A MD5: [bfa6d1a28f268b72dd6d7dc8744bbe6c] protection-log-2014-07-11.xml File Size: 6217 BYTES FileVersion: N/A MD5: [1adba58d5d46661ee5babe519cfee22c] protection-log-2014-07-13.xml File Size: 8270 BYTES FileVersion: N/A MD5: [f2a1713de43ebf36c24044621cad8dcd] protection-log-2014-07-14.xml File Size: 10323 BYTES FileVersion: N/A MD5: [f8807c44cbabd77440a8d60355860e96] protection-log-2014-07-15.xml File Size: 4474 BYTES FileVersion: N/A MD5: [1f43a87b631162a3d382588781b4dd3b] protection-log-2014-07-16.xml File Size: 10326 BYTES FileVersion: N/A MD5: [37ecfe715087e046d6be81a1a645cf07] protection-log-2014-07-17.xml File Size: 2111 BYTES FileVersion: N/A MD5: [4c4cbd7cddc112cc2eb52924fe7b6b88] protection-log-2014-07-18.xml File Size: 2112 BYTES FileVersion: N/A MD5: [47e69f65115acc7b31dd13487f6ec74a] C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Quarantine Malware Exclusions: =================== Web Exclusions: ================ Quarantined Items: =================== Unable to access quarantine information: Error code 20002=============================================================== END OF FILE bD |
|
12.03.2015, 09:21
| #4 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Revo Uninstaller - Download - Filepony damit deinstallieren, Reste entfernen lassen. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.03.2015, 12:49
| #5 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Revo haben wir installiert. Das hat aber nichts von Tencent gefunden, weder QQChat noch was anderes. Daher ging das angeforderte "damit deinstallieren, Reste entfernen lassen." so nicht. Anbei zwei Bilder, was Renove findet, eben nichts von Tencent, dass kam nur bei AMWB hoch. Wie jetzt weiter vorgehen ? Mit ADW und JRT ? Oder doch noch was mit Revo ? Danke bD |
|
12.03.2015, 21:10
| #6 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Ja, einfach weiter im Text mit Adw und Co 
__________________ --> Tencent nicht deinstallierbar + AMWB Server nicht erreichbar |
|
12.03.2015, 23:44
| #7 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Hi, anbei die Dateien. Ich muss vorausschicken, dass ich morgen am Freitag wegen eines Kundenbesuchs erst spät abends wieder online bin, werde mich aber spät abends und vor allem am Wochenende weiter drum kümmern. ADW : AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v4.112 - Bericht erstellt 12/03/2015 um 21:57:25
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-05.1 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : Standard - TOSHIBA1LQ
# Gestarted von : C:\Users\Standard\Desktop\adwcleaner_4.112.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v36.0.1 (x86 de)
*************************
AdwCleaner[R0].txt - [1673 Bytes] - [05/11/2014 14:04:09]
AdwCleaner[R1].txt - [1240 Bytes] - [10/01/2015 12:33:40]
AdwCleaner[R2].txt - [1305 Bytes] - [03/03/2015 14:02:05]
AdwCleaner[R3].txt - [1007 Bytes] - [03/03/2015 14:58:35]
AdwCleaner[R4].txt - [1128 Bytes] - [12/03/2015 21:55:43]
AdwCleaner[S0].txt - [1366 Bytes] - [03/03/2015 14:07:17]
AdwCleaner[S1].txt - [1068 Bytes] - [03/03/2015 15:00:42]
AdwCleaner[S2].txt - [1051 Bytes] - [12/03/2015 21:57:25]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1110 Bytes] ##########
[/CODE] JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 8.1 x64
Ran by Standard on 12.03.2015 at 22:14:07,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.03.2015 at 22:18:15,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by Standard (administrator) on TOSHIBA1LQ on 12-03-2015 22:21:11 Running from C:\Users\Standard\Desktop Loaded Profiles: Standard & Gast1 (Available profiles: Standard & Gast1) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] () HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] () HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated) HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation) HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-10] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-03] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-03] (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default FF Homepage: google.com FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] () FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2014-12-26] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation) FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent) FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-12] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-03-10] FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08] FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01] FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16] FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992560 2015-03-10] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH) R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 ASPI32; No ImagePath R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-12 22:20 - 2015-03-12 22:20 - 00000000 ____D () C:\Users\Standard\Desktop\FRST-OlderVersion 2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT1.txt 2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT.txt 2015-03-12 22:10 - 2015-03-12 22:10 - 00000994 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2015-03-12 22:00 - 2015-03-12 22:00 - 00001190 _____ () C:\Users\Standard\Desktop\AdwCleaner[S2].txt 2015-03-12 11:41 - 2015-03-12 11:41 - 02171392 _____ () C:\Users\Standard\Desktop\adwcleaner_4.112.exe 2015-03-12 11:27 - 2015-03-12 11:27 - 00001295 _____ () C:\Users\Standard\Desktop\Revo Uninstaller.lnk 2015-03-12 11:27 - 2015-03-12 11:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-03-12 11:26 - 2015-03-12 11:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Standard\Desktop\revosetup95.exe 2015-03-10 23:16 - 2015-02-06 23:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2015-03-10 23:16 - 2015-02-03 23:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2015-03-10 23:16 - 2015-02-03 23:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2015-03-10 23:16 - 2015-02-03 23:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2015-03-10 23:16 - 2015-02-02 23:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll 2015-03-10 23:16 - 2015-02-02 23:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll 2015-03-10 23:16 - 2015-01-27 03:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe 2015-03-10 23:16 - 2015-01-24 01:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe 2015-03-10 23:16 - 2015-01-23 07:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll 2015-03-10 23:16 - 2015-01-23 05:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll 2015-03-10 23:15 - 2015-02-05 20:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2015-03-10 23:15 - 2015-01-30 23:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2015-03-10 23:15 - 2015-01-30 23:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2015-03-10 23:15 - 2015-01-29 01:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll 2015-03-10 23:15 - 2015-01-29 01:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll 2015-03-10 23:14 - 2015-02-07 23:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll 2015-03-10 23:14 - 2015-02-07 23:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll 2015-03-10 23:14 - 2015-02-06 01:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2015-03-10 23:14 - 2015-02-06 01:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2015-03-10 23:14 - 2015-02-03 00:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2015-03-10 23:14 - 2015-02-03 00:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2015-03-10 23:14 - 2015-01-30 03:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys 2015-03-10 23:14 - 2015-01-30 02:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll 2015-03-10 23:14 - 2015-01-30 02:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll 2015-03-10 23:14 - 2015-01-30 02:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll 2015-03-10 23:14 - 2015-01-30 01:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll 2015-03-10 23:14 - 2015-01-30 01:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll 2015-03-10 23:14 - 2015-01-30 01:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll 2015-03-10 23:14 - 2015-01-30 01:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll 2015-03-10 23:14 - 2015-01-30 01:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll 2015-03-10 23:14 - 2015-01-30 01:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll 2015-03-10 23:14 - 2015-01-30 01:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll 2015-03-10 23:14 - 2015-01-30 01:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll 2015-03-10 23:14 - 2015-01-30 01:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll 2015-03-10 23:14 - 2015-01-30 01:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll 2015-03-10 23:14 - 2015-01-29 01:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-10 23:14 - 2015-01-29 01:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2015-03-10 23:14 - 2015-01-29 01:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2015-03-10 23:14 - 2015-01-29 01:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-10 23:14 - 2015-01-29 00:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-03-10 23:14 - 2015-01-29 00:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2015-03-10 23:14 - 2015-01-29 00:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2015-03-10 23:14 - 2015-01-29 00:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-03-10 23:14 - 2015-01-28 02:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll 2015-03-10 23:14 - 2015-01-28 01:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll 2015-03-10 23:14 - 2015-01-27 23:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2015-03-10 23:14 - 2015-01-27 23:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2015-03-10 23:14 - 2014-12-11 05:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe 2015-03-10 23:14 - 2014-10-29 02:43 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe 2015-03-10 23:14 - 2014-10-29 02:34 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll 2015-03-10 23:14 - 2014-10-29 02:34 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe 2015-03-10 23:14 - 2014-10-29 02:34 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2015-03-10 23:14 - 2014-10-29 02:04 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll 2015-03-10 23:14 - 2014-10-29 01:58 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe 2015-03-10 23:14 - 2014-10-29 01:52 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll 2015-03-10 23:14 - 2014-10-29 01:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll 2015-03-10 23:14 - 2014-10-29 01:45 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll 2015-03-10 23:14 - 2014-10-29 01:28 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll 2015-03-10 23:14 - 2014-10-29 01:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll 2015-03-10 23:14 - 2014-10-29 01:20 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll 2015-03-10 23:14 - 2014-10-29 01:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll 2015-03-10 23:14 - 2014-10-29 01:15 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll 2015-03-10 23:14 - 2014-10-29 01:13 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2015-03-10 23:14 - 2014-10-29 00:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll 2015-03-10 23:14 - 2014-10-29 00:55 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll 2015-03-10 23:14 - 2014-10-29 00:55 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll 2015-03-10 23:14 - 2014-10-29 00:44 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll 2015-03-10 23:14 - 2014-10-29 00:41 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll 2015-03-10 23:14 - 2014-10-29 00:35 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll 2015-03-10 20:17 - 2015-03-06 02:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2015-03-10 20:17 - 2015-03-06 02:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2015-03-10 20:17 - 2015-02-25 23:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-03-10 20:17 - 2015-02-20 03:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-03-10 20:17 - 2015-02-20 02:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-03-10 20:17 - 2015-02-20 02:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-03-10 20:17 - 2015-02-20 02:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-03-10 20:17 - 2015-01-28 15:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-03-10 20:17 - 2015-01-28 15:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-03-10 20:17 - 2015-01-28 15:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-03-10 20:17 - 2014-10-29 02:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll 2015-03-10 20:17 - 2014-10-29 02:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll 2015-03-10 20:17 - 2014-10-29 02:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll 2015-03-10 20:17 - 2014-10-29 02:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll 2015-03-10 20:17 - 2014-10-29 02:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll 2015-03-10 20:17 - 2014-10-29 02:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll 2015-03-10 20:16 - 2015-01-30 23:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll 2015-03-10 20:16 - 2015-01-27 04:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2015-03-10 20:16 - 2015-01-27 02:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2015-03-10 20:16 - 2014-10-29 03:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys 2015-03-10 20:16 - 2014-10-29 02:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll 2015-03-10 20:14 - 2015-02-21 01:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-03-10 20:14 - 2015-02-21 00:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-03-10 20:14 - 2015-02-21 00:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2015-03-10 20:14 - 2015-02-21 00:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2015-03-10 20:14 - 2015-02-21 00:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-03-10 20:14 - 2015-02-20 23:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2015-03-10 20:14 - 2015-02-20 23:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2015-03-10 20:14 - 2015-02-20 02:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-03-10 20:14 - 2015-02-20 02:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-03-10 20:14 - 2015-02-20 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2015-03-10 20:14 - 2015-02-20 02:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-03-10 20:14 - 2015-02-20 02:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2015-03-10 20:14 - 2015-02-20 02:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-03-10 20:14 - 2015-02-20 02:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-03-10 20:14 - 2015-02-20 02:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2015-03-10 20:14 - 2015-02-20 02:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2015-03-10 20:14 - 2015-02-20 02:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2015-03-10 20:14 - 2015-02-20 02:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-03-10 20:14 - 2015-02-20 01:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-03-10 20:14 - 2015-02-20 01:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-03-10 20:14 - 2015-02-20 01:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-03-10 20:14 - 2015-02-20 01:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-03-10 20:14 - 2015-02-20 01:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-03-10 20:14 - 2015-02-20 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-03-10 20:14 - 2015-02-20 01:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-03-10 20:14 - 2015-02-20 01:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-03-10 20:14 - 2015-02-20 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-03-10 20:14 - 2015-02-20 01:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2015-03-10 20:14 - 2015-02-20 01:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-03-10 20:14 - 2015-02-20 01:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-03-10 20:14 - 2015-02-20 01:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-03-10 20:14 - 2015-02-20 01:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-03-10 20:14 - 2015-02-20 01:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-03-10 20:14 - 2015-02-20 01:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-03-10 20:14 - 2015-02-20 01:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-03-10 20:14 - 2015-02-20 00:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-03-10 20:14 - 2015-02-20 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-03-10 20:13 - 2015-01-29 18:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2015-03-10 20:13 - 2015-01-29 18:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2015-03-10 20:12 - 2015-02-12 17:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-03-10 20:12 - 2015-02-12 17:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-03-10 20:11 - 2015-01-28 01:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll 2015-03-10 20:11 - 2015-01-28 01:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll 2015-03-10 20:11 - 2015-01-21 05:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2015-03-10 20:11 - 2015-01-21 05:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\Standard\Desktop\attachments 2015-03-07 23:03 - 2015-03-07 23:04 - 10040114 _____ () C:\Users\Standard\Desktop\attachments.zip 2015-03-06 20:22 - 2015-03-06 20:22 - 00001422 _____ () C:\Users\Standard\Desktop\NN CV English.txt 2015-03-05 20:03 - 2015-03-06 01:20 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-03-05 20:03 - 2015-03-05 20:03 - 01682416 _____ (Malwarebytes Corporation) C:\Users\Standard\Desktop\mbam-check-2.1.1.1001.exe 2015-03-05 20:03 - 2015-03-05 20:03 - 00068241 _____ () C:\Users\Standard\Desktop\CheckResults.txt 2015-03-05 19:47 - 2015-03-05 19:48 - 00020460 _____ () C:\Users\Standard\Desktop\Addition.txt 2015-03-05 19:46 - 2015-03-12 22:21 - 00014752 _____ () C:\Users\Standard\Desktop\FRST.txt 2015-03-05 19:45 - 2015-03-12 22:21 - 00000000 ____D () C:\FRST 2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe 2015-03-05 19:37 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-03-05 19:36 - 2015-03-12 22:20 - 02095616 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe 2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk 2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Desktop\JRT.exe 2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll 2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll 2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp 2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump 2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls 2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll 2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll 2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll 2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg 2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys 2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll 2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll 2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll 2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll 2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll 2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll 2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll 2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll 2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll 2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll 2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll 2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe 2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe 2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe 2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-12 22:11 - 2013-10-29 14:53 - 01974330 _____ () C:\WINDOWS\WindowsUpdate.log 2015-03-12 22:10 - 2014-07-21 19:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer 2015-03-12 22:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-03-12 22:04 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-03-12 22:04 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2015-03-12 22:04 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2015-03-12 22:02 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-03-12 21:59 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive 2015-03-12 21:59 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP 2015-03-12 21:58 - 2013-08-22 14:46 - 00316715 _____ () C:\WINDOWS\setupact.log 2015-03-12 21:58 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-03-12 21:57 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner 2015-03-12 21:57 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-03-12 21:42 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6} 2015-03-12 16:05 - 2013-08-17 16:59 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-1001 2015-03-12 11:25 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-03-12 00:59 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-03-11 21:58 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Windows Defender 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\WinStore 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2015-03-11 00:34 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-03-11 00:31 - 2013-08-19 01:13 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-03-10 11:32 - 2013-08-19 20:27 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys 2015-03-10 11:32 - 2013-08-19 20:27 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys 2015-03-10 11:32 - 2013-08-19 20:27 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys 2015-03-06 20:06 - 2013-09-29 19:04 - 00032604 _____ () C:\WINDOWS\PFRO.log 2015-03-06 20:06 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-03-05 21:31 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache 2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-03-05 20:00 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1 2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data 2015-03-04 21:24 - 2014-12-12 11:05 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-03-04 21:24 - 2014-12-12 11:05 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle 2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java 2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard 2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache 2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser 2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel ==================== Files in the root of some directories ======= 2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg Some content of TEMP: ==================== C:\Users\Standard\AppData\Local\Temp\avgnt.exe C:\Users\Standard\AppData\Local\Temp\Quarantine.exe C:\Users\Standard\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-11 23:30 ==================== End Of Log ============================ und falls notwendig noch ADDITIONS : Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Standard at 2015-03-12 22:22:16
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1405.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
19-02-2015 22:58:54 Geplanter Prüfpunkt
24-02-2015 23:09:15 Windows Update
04-03-2015 00:04:32 Geplanter Prüfpunkt
11-03-2015 00:22:30 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {91748338-A418-4ABA-8A56-C469B59B0290} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-11] (Microsoft Corporation)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"
==================== Accounts: =============================
Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 18%
Total physical RAM: 8073.22 MB
Available physical RAM: 6547.39 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 14682.09 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:593.43 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Danke und bis morgen abend bD |
|
13.03.2015, 12:37
| #8 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited)
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.03.2015, 19:43
| #9 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Hi, so haben alles laufen lassen. FIXLOG.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Standard at 2015-03-14 10:08:27 Run:1
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard (Available profiles: Standard & Gast1)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited)
Emptytemp:
*****************
"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npqscall" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QQPhotoDrawEx" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QzoneMusic" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tencent.com/npQQMailWebKit,version=1.0.0.1" => Key deleted successfully.
C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll => Moved successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tencent.com/nptxftnWebKit,version=1.0.0.1" => Key deleted successfully.
C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll => Moved successfully.
EmptyTemp: => Removed 1.3 GB temporary data.
The system needed a reboot.
==== End of Fixlog 10:10:19 ====
ESET log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=659babde60926f42b46280e5db20f69d
# engine=22905
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-14 02:12:37
# local_time=2015-03-14 02:12:37 (+0000, Westeuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 304657 51223650 0 0
# scanned=226062
# found=0
# cleaned=0
# scan_time=5626
CHECKUP.txt Code:
ATTFilter Results of screen317's Security Check version 0.99.97 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Windows Defender Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Secunia PSI (3.0.0.9016) Java 8 Update 31 Java version 32-bit out of Date! Java 64-bit 8 Update 31 Adobe Flash Player 16.0.0.305 Adobe Reader XI Mozilla Firefox (36.0.1) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by Standard (administrator) on TOSHIBA1LQ on 14-03-2015 18:16:49 Running from C:\Users\Standard\Desktop Loaded Profiles: Standard (Available profiles: Standard & Gast1) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] () HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] () HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated) HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation) HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-10] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-03] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-03] (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default FF Homepage: google.com FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] () FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT \npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT \npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2014-12-26] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered \0\NP_wtapp.dll [2012-05-12] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-03-10] FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions \CNTVLive2@www.cntv.cn [2014-07-08] FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01] FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65- 2a3cc1668adc} [2014-02-16] FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2- 2b9879e08c5d}.xpi [2013-10-09] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992560 2015-03-10] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed] R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH) R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 ASPI32; No ImagePath R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-14 18:14 - 2015-03-14 18:14 - 00000925 _____ () C:\Users\Standard\Desktop\checkup.txt 2015-03-14 10:29 - 2015-03-14 10:29 - 00852604 _____ () C:\Users\Standard\Desktop\SecurityCheck.exe 2015-03-14 10:25 - 2015-03-14 10:26 - 00001374 _____ () C:\Users\Standard\Desktop\anleitung.txt 2015-03-14 10:21 - 2015-03-14 10:21 - 02347384 _____ (ESET) C:\Users\Standard\Desktop\esetsmartinstaller_deu.exe 2015-03-12 22:23 - 2015-03-12 22:23 - 00043625 _____ () C:\Users\Standard\Desktop\FRST2.txt 2015-03-12 22:22 - 2015-03-12 22:22 - 00014104 _____ () C:\Users\Standard\Desktop\Addition2.txt 2015-03-12 22:20 - 2015-03-12 22:20 - 00000000 ____D () C:\Users\Standard\Desktop\FRST-OlderVersion 2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT1.txt 2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT.txt 2015-03-12 22:10 - 2015-03-12 22:10 - 00000994 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2015-03-12 22:00 - 2015-03-12 22:00 - 00001190 _____ () C:\Users\Standard\Desktop\AdwCleaner[S2].txt 2015-03-12 11:41 - 2015-03-12 11:41 - 02171392 _____ () C:\Users\Standard\Desktop\adwcleaner_4.112.exe 2015-03-12 11:27 - 2015-03-12 11:27 - 00001295 _____ () C:\Users\Standard\Desktop\Revo Uninstaller.lnk 2015-03-12 11:27 - 2015-03-12 11:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-03-12 11:26 - 2015-03-12 11:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Standard\Desktop\revosetup95.exe 2015-03-10 23:16 - 2015-02-06 23:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2015-03-10 23:16 - 2015-02-03 23:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2015-03-10 23:16 - 2015-02-03 23:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2015-03-10 23:16 - 2015-02-03 23:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2015-03-10 23:16 - 2015-02-02 23:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll 2015-03-10 23:16 - 2015-02-02 23:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll 2015-03-10 23:16 - 2015-01-27 03:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe 2015-03-10 23:16 - 2015-01-24 01:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe 2015-03-10 23:16 - 2015-01-23 07:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll 2015-03-10 23:16 - 2015-01-23 05:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll 2015-03-10 23:15 - 2015-02-05 20:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2015-03-10 23:15 - 2015-01-30 23:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2015-03-10 23:15 - 2015-01-30 23:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2015-03-10 23:15 - 2015-01-29 01:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll 2015-03-10 23:15 - 2015-01-29 01:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll 2015-03-10 23:14 - 2015-02-07 23:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll 2015-03-10 23:14 - 2015-02-07 23:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll 2015-03-10 23:14 - 2015-02-06 01:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2015-03-10 23:14 - 2015-02-06 01:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2015-03-10 23:14 - 2015-02-03 00:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2015-03-10 23:14 - 2015-02-03 00:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2015-03-10 23:14 - 2015-01-30 03:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys 2015-03-10 23:14 - 2015-01-30 02:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll 2015-03-10 23:14 - 2015-01-30 02:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll 2015-03-10 23:14 - 2015-01-30 02:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll 2015-03-10 23:14 - 2015-01-30 01:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll 2015-03-10 23:14 - 2015-01-30 01:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll 2015-03-10 23:14 - 2015-01-30 01:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll 2015-03-10 23:14 - 2015-01-30 01:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll 2015-03-10 23:14 - 2015-01-30 01:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll 2015-03-10 23:14 - 2015-01-30 01:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll 2015-03-10 23:14 - 2015-01-30 01:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll 2015-03-10 23:14 - 2015-01-30 01:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll 2015-03-10 23:14 - 2015-01-30 01:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll 2015-03-10 23:14 - 2015-01-30 01:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll 2015-03-10 23:14 - 2015-01-29 01:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-10 23:14 - 2015-01-29 01:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2015-03-10 23:14 - 2015-01-29 01:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2015-03-10 23:14 - 2015-01-29 01:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-10 23:14 - 2015-01-29 00:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-03-10 23:14 - 2015-01-29 00:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2015-03-10 23:14 - 2015-01-29 00:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2015-03-10 23:14 - 2015-01-29 00:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-03-10 23:14 - 2015-01-28 02:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll 2015-03-10 23:14 - 2015-01-28 01:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll 2015-03-10 23:14 - 2015-01-27 23:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2015-03-10 23:14 - 2015-01-27 23:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2015-03-10 23:14 - 2014-12-11 05:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe 2015-03-10 23:14 - 2014-10-29 02:43 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe 2015-03-10 23:14 - 2014-10-29 02:34 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll 2015-03-10 23:14 - 2014-10-29 02:34 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe 2015-03-10 23:14 - 2014-10-29 02:34 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2015-03-10 23:14 - 2014-10-29 02:04 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll 2015-03-10 23:14 - 2014-10-29 01:58 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe 2015-03-10 23:14 - 2014-10-29 01:52 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll 2015-03-10 23:14 - 2014-10-29 01:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll 2015-03-10 23:14 - 2014-10-29 01:45 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll 2015-03-10 23:14 - 2014-10-29 01:28 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll 2015-03-10 23:14 - 2014-10-29 01:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll 2015-03-10 23:14 - 2014-10-29 01:20 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll 2015-03-10 23:14 - 2014-10-29 01:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll 2015-03-10 23:14 - 2014-10-29 01:15 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll 2015-03-10 23:14 - 2014-10-29 01:13 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll 2015-03-10 23:14 - 2014-10-29 00:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll 2015-03-10 23:14 - 2014-10-29 00:55 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll 2015-03-10 23:14 - 2014-10-29 00:55 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll 2015-03-10 23:14 - 2014-10-29 00:44 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll 2015-03-10 23:14 - 2014-10-29 00:41 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll 2015-03-10 23:14 - 2014-10-29 00:35 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll 2015-03-10 20:17 - 2015-03-06 02:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2015-03-10 20:17 - 2015-03-06 02:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2015-03-10 20:17 - 2015-02-25 23:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-03-10 20:17 - 2015-02-20 03:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-03-10 20:17 - 2015-02-20 02:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-03-10 20:17 - 2015-02-20 02:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-03-10 20:17 - 2015-02-20 02:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-03-10 20:17 - 2015-01-28 15:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-03-10 20:17 - 2015-01-28 15:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-03-10 20:17 - 2015-01-28 15:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-03-10 20:17 - 2014-10-29 02:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll 2015-03-10 20:17 - 2014-10-29 02:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll 2015-03-10 20:17 - 2014-10-29 02:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll 2015-03-10 20:17 - 2014-10-29 02:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll 2015-03-10 20:17 - 2014-10-29 02:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll 2015-03-10 20:17 - 2014-10-29 02:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll 2015-03-10 20:16 - 2015-01-30 23:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll 2015-03-10 20:16 - 2015-01-27 04:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2015-03-10 20:16 - 2015-01-27 02:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2015-03-10 20:16 - 2014-10-29 03:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys 2015-03-10 20:16 - 2014-10-29 02:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll 2015-03-10 20:14 - 2015-02-21 01:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-03-10 20:14 - 2015-02-21 00:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-03-10 20:14 - 2015-02-21 00:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2015-03-10 20:14 - 2015-02-21 00:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2015-03-10 20:14 - 2015-02-21 00:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-03-10 20:14 - 2015-02-20 23:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2015-03-10 20:14 - 2015-02-20 23:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2015-03-10 20:14 - 2015-02-20 02:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-03-10 20:14 - 2015-02-20 02:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-03-10 20:14 - 2015-02-20 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2015-03-10 20:14 - 2015-02-20 02:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-03-10 20:14 - 2015-02-20 02:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2015-03-10 20:14 - 2015-02-20 02:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-03-10 20:14 - 2015-02-20 02:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-03-10 20:14 - 2015-02-20 02:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2015-03-10 20:14 - 2015-02-20 02:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2015-03-10 20:14 - 2015-02-20 02:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2015-03-10 20:14 - 2015-02-20 02:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-03-10 20:14 - 2015-02-20 01:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-03-10 20:14 - 2015-02-20 01:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-03-10 20:14 - 2015-02-20 01:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-03-10 20:14 - 2015-02-20 01:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-03-10 20:14 - 2015-02-20 01:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-03-10 20:14 - 2015-02-20 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-03-10 20:14 - 2015-02-20 01:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-03-10 20:14 - 2015-02-20 01:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-03-10 20:14 - 2015-02-20 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-03-10 20:14 - 2015-02-20 01:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2015-03-10 20:14 - 2015-02-20 01:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-03-10 20:14 - 2015-02-20 01:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-03-10 20:14 - 2015-02-20 01:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-03-10 20:14 - 2015-02-20 01:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-03-10 20:14 - 2015-02-20 01:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-03-10 20:14 - 2015-02-20 01:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-03-10 20:14 - 2015-02-20 01:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-03-10 20:14 - 2015-02-20 00:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-03-10 20:14 - 2015-02-20 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-03-10 20:13 - 2015-01-29 18:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2015-03-10 20:13 - 2015-01-29 18:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2015-03-10 20:12 - 2015-02-12 17:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-03-10 20:12 - 2015-02-12 17:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-03-10 20:11 - 2015-01-28 01:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll 2015-03-10 20:11 - 2015-01-28 01:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll 2015-03-10 20:11 - 2015-01-21 05:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2015-03-10 20:11 - 2015-01-21 05:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\Standard\Desktop\attachments 2015-03-07 23:03 - 2015-03-07 23:04 - 10040114 _____ () C:\Users\Standard\Desktop\attachments.zip 2015-03-06 20:22 - 2015-03-06 20:22 - 00001422 _____ () C:\Users\Standard\Desktop\NN CV English.txt 2015-03-05 20:03 - 2015-03-06 01:20 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-03-05 20:03 - 2015-03-05 20:03 - 01682416 _____ (Malwarebytes Corporation) C:\Users\Standard\Desktop\mbam-check-2.1.1.1001.exe 2015-03-05 20:03 - 2015-03-05 20:03 - 00068241 _____ () C:\Users\Standard\Desktop\CheckResults.txt 2015-03-05 19:47 - 2015-03-12 22:22 - 00014104 _____ () C:\Users\Standard\Desktop\Addition.txt 2015-03-05 19:46 - 2015-03-14 18:17 - 00013871 _____ () C:\Users\Standard\Desktop\FRST.txt 2015-03-05 19:45 - 2015-03-14 18:16 - 00000000 ____D () C:\FRST 2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe 2015-03-05 19:37 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-03-05 19:36 - 2015-03-12 22:20 - 02095616 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe 2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk 2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Desktop\JRT.exe 2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll 2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll 2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp 2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump 2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls 2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls 2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll 2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-14 18:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-03-14 18:01 - 2013-08-22 14:46 - 00317331 _____ () C:\WINDOWS\setupact.log 2015-03-14 18:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-03-14 17:11 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6} 2015-03-14 17:09 - 2013-10-29 14:53 - 01166877 _____ () C:\WINDOWS\WindowsUpdate.log 2015-03-14 12:57 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-03-14 12:51 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-03-14 10:16 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP 2015-03-14 10:15 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive 2015-03-14 10:14 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-03-14 10:14 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-03-14 10:08 - 2013-08-17 20:22 - 00000000 ____D () C:\Program Files (x86)\QQMailPlugin 2015-03-14 10:00 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-03-14 10:00 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2015-03-14 10:00 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2015-03-14 09:54 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-03-12 22:10 - 2014-07-21 19:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer 2015-03-12 21:57 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner 2015-03-12 16:05 - 2013-08-17 16:59 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893- 1633341002-1001 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Windows Defender 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\WinStore 2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2015-03-11 00:34 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-03-11 00:31 - 2013-08-19 01:13 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-03-10 11:32 - 2013-08-19 20:27 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys 2015-03-10 11:32 - 2013-08-19 20:27 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys 2015-03-10 11:32 - 2013-08-19 20:27 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys 2015-03-06 20:06 - 2013-09-29 19:04 - 00032604 _____ () C:\WINDOWS\PFRO.log 2015-03-06 20:06 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-03-05 21:31 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache 2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-03-05 20:00 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1 2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data 2015-03-04 21:24 - 2014-12-12 11:05 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-03-04 21:24 - 2014-12-12 11:05 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle 2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java 2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard 2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache 2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser 2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel ==================== Files in the root of some directories ======= 2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg Some content of TEMP: ==================== C:\Users\Standard\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-14 14:13 ==================== End Of Log ============================ --- --- --- [/CODE] und ADDITIONS Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Standard at 2015-03-14 18:17:58
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1405.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
14-03-2015 12:35:10 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {3F228536-083D-42DD-8CEA-4D06331D4891} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-11] (Microsoft Corporation)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"
==================== Accounts: =============================
Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/14/2015 06:07:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 02:16:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 02:16:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 02:14:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 00:33:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 00:33:45 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 10:22:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 10:22:34 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 10:22:09 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (03/14/2015 10:21:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (03/14/2015 10:15:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (03/14/2015 10:14:16 AM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/14/2015 09:55:41 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (03/14/2015 09:53:43 AM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: 1069fdPHostNicht verfügbar{D3DCB472-7261-43CE-924B-0704BD730D5F}
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Autom. Setup von Geräten, die mit dem Netzwerk verbunden sind" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "NcdAutoSetup" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Funktionssuchanbieter-Host" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "fdPHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "TCP/IP-NetBIOS-Hilfsdienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "lmhosts" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%50
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Microsoft Office Sessions:
=========================
Error: (03/14/2015 06:07:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (03/14/2015 02:16:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (03/14/2015 02:16:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\users\standard\desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 02:14:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (03/14/2015 00:33:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 00:33:45 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 10:22:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 10:22:34 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 10:22:09 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
Error: (03/14/2015 10:21:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 27%
Total physical RAM: 8073.22 MB
Available physical RAM: 5848.27 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 13653.82 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:596.32 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Probleme ? Ja. a) Da ist noch ein Ordner : C:\Program Files (x86)\QQMailPlugin. Einfach löschen ? b) der zweite Punkt : die Verbindung zum MBAM Server geht partout nicht. c) Ein Scan mit Avira brauchte über 15 Stunden und blieb bei 87 % hängen. Steht das in Zusammenhang mit dem letztlich erfolgtem Bluescreen ? Müssen wir uns um die Platte kümmern ? Was können wir da noch tun ? Danke bD |
|
15.03.2015, 07:58
| #10 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar MBAM und Avira neu installieren. Den Ordner einfach löschen. Windows Bluescreen Absturz analysieren und beheben - so geht's - Anleitungen Poste mal bitte einen Bericht von Bluescreenview.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.03.2015, 22:46
| #11 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Ordner C:\Program Files (x86)\QQMailPlugin ist jetzt gelöscht. AntiMalwareBytes deinstalliert, wieder installiert, Updateserver wieder kontaktierbar (!), Scan durchgeführt, hat ca. 30 min gebraucht, keine Funde. Danke dafür. Avira aber läuft nun seit Stunden, hängt (scheinbar) wieder bei 70 %, genauer gesagt : geht nur sehr langsam voran. Wir haben das jetzt abgebrochen. Können wir da noch etwas machen ? Anbei der Log vom BlueScreenViewer : Code:
ATTFilter ==================================================
Dump File : 030315-29093-01.dmp
Crash Time : 03.03.2015 13:19:20
Bug Check String : KERNEL_DATA_INPAGE_ERROR
Bug Check Code : 0x0000007a
Parameter 1 : 00000000`00000004
Parameter 2 : 00000000`00000000
Parameter 3 : ffffe001`c45b5c60
Parameter 4 : ffffd000`35b61000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+1509a0
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+1509a0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\030315-29093-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 9600
Dump File Size : 285.784
Dump File Time : 03.03.2015 13:34:16
==================================================
bD |
|
16.03.2015, 11:38
| #12 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Der Bluescreen ist irgend ein Treiberproblem. Bitte mal alle Treiber beim hersteller neu laden und drüber ziehen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.03.2015, 23:26
| #13 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Hi, wegen der Meldung im checkup.txt haben wir Java neue Version eingespielt. Dann haben wir Avira gestartet, und siehe da, diesmal lief es durch. Dann haben wir von der Toshiba-seite die Treiebr für unsere Maschine geladen und installiert. So weit sieht jetzt alles wieder in Ordnung aus. Ein grosses Dankeschön von uns ! Müssen wir noch etwas machen ? Desktop bereinigen oder anderes ? Danke bD |
|
17.03.2015, 12:35
| #14 |
| /// the machine /// TB-Ausbilder | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.03.2015, 15:16
| #15 |
| | Tencent nicht deinstallierbar + AMWB Server nicht erreichbar 'Gestern abend haben wir noch Windows-Systemupdate versucht, was mit der Fehlermeldung "Code: 8024402C" endete. Wohl so etwas wie eine Blockade der Internetverbindung. Heute morgen dann mit Delfix alles aufgeräumt, 1 wichitges Update "Net Framework" eingespielt, Windows Update suchen lassen und da ging auch die Windows-Updatefunktion wieder (sprich : keine Fehlermeldung). Also, wir hoffen, daß "Code: 8024402C" nicht wieder kommt. Danke für alle Hilfe bD |
|
| Themen zu Tencent nicht deinstallierbar + AMWB Server nicht erreichbar |
| bluescreen, dauert, deinstalliert, deutsche, deutschen, dinge, erreichbar, forum, gen, hänge, hängen, infiziert, keine verbindung, kurzem, länger, programme, programmen, rechner, rückmeldung, server, tencent, update, verbindung, wenig, win, würde |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
