| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Home Premium 64bit: diverse VirenfundeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
15.03.2015, 14:51
| #1 |
 |  Windows 7 Home Premium 64bit: diverse Virenfunde Hallo, Malwarebytes und Avira melden diverse Virenfunde. Der Laptop fährt nach einem Neustart (z.B. nach Updates) nicht mehr richtig hoch und ist auch ansonsten insgesamt schrecklich langsam. Hier die Log-Files: Avira Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Sonntag, 15. März 2015 13:51
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ****-HP
Versionsinformationen:
BUILD.DAT : 15.0.8.650 91859 Bytes 25.02.2015 17:54:00
AVSCAN.EXE : 15.0.8.650 1014064 Bytes 05.03.2015 13:45:10
AVSCANRC.DLL : 15.0.8.650 63792 Bytes 05.03.2015 13:45:10
LUKE.DLL : 15.0.8.650 60664 Bytes 05.03.2015 13:45:23
AVSCPLR.DLL : 15.0.8.650 94456 Bytes 05.03.2015 13:45:10
REPAIR.DLL : 15.0.8.650 366328 Bytes 05.03.2015 13:45:08
REPAIR.RDF : 1.0.5.86 777107 Bytes 05.03.2015 13:46:02
AVREG.DLL : 15.0.8.650 264496 Bytes 05.03.2015 13:45:08
AVLODE.DLL : 15.0.8.650 645368 Bytes 05.03.2015 13:45:07
AVLODE.RDF : 14.0.4.54 78895 Bytes 30.12.2014 14:13:44
XBV00017.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 09:23:34
XBV00044.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00045.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00046.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00047.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00048.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00049.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00050.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00051.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00052.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00053.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00054.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00055.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00056.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00057.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:30
XBV00058.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00059.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00060.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00061.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00062.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00063.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00064.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00065.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00066.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00067.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00068.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00069.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00070.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:31
XBV00071.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00072.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00073.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00074.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00075.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00076.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00077.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:32
XBV00078.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00079.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00080.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00081.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00082.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00083.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00084.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00085.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00086.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:33
XBV00087.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00088.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00089.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00090.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00091.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00092.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00093.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00094.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00095.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00096.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00097.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00098.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00099.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00100.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:34
XBV00101.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00102.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00103.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00104.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00105.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00106.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00107.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00108.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00109.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00110.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00111.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00112.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00113.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00114.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00115.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00116.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00117.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00118.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00119.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00120.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00121.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:35
XBV00122.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00123.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00124.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00125.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00126.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00127.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:36
XBV00128.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00129.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00130.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00131.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00132.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00133.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00134.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00135.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00136.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00137.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00138.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00139.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00140.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:37
XBV00141.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00142.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00143.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00144.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00145.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00146.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00147.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00148.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00149.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00150.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00151.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00152.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00153.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00154.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00155.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00156.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00157.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00158.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00159.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00160.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00161.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00162.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:38
XBV00163.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00164.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00165.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00166.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00167.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00168.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00169.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00170.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00171.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00172.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00173.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00174.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00175.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:39
XBV00176.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:40
XBV00177.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:40
XBV00178.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00179.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00180.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00181.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00182.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00183.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00184.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00185.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00186.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00187.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00188.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00189.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00190.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00191.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00192.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00193.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00194.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:41
XBV00195.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00196.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00197.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00198.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00199.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00200.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00201.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00202.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00203.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00204.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00205.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00206.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:42
XBV00207.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00208.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00209.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00210.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00211.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00212.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00213.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00214.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00215.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00216.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00217.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00218.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00219.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00220.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00221.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:43
XBV00222.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:44
XBV00223.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00224.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00225.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00226.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00227.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00228.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00229.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00230.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00231.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00232.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00233.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00234.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00235.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00236.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00237.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00238.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00239.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00240.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:45
XBV00241.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00242.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00243.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00244.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00245.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00246.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00247.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00248.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00249.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00250.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00251.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00252.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00253.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00254.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00255.VDF : 8.11.213.176 2048 Bytes 05.03.2015 13:45:46
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:23:34
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 09:23:34
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 09:23:34
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 09:23:34
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 09:23:34
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 09:23:34
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 09:23:34
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 09:23:34
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 09:23:34
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 09:23:34
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14.10.2014 09:23:34
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11.11.2014 09:23:34
XBV00012.VDF : 8.11.190.32 1876992 Bytes 03.12.2014 14:13:48
XBV00013.VDF : 8.11.201.28 2973696 Bytes 14.01.2015 15:55:26
XBV00014.VDF : 8.11.206.252 2695680 Bytes 04.02.2015 11:35:05
XBV00015.VDF : 8.11.213.84 3175936 Bytes 03.03.2015 13:45:29
XBV00016.VDF : 8.11.213.176 212480 Bytes 05.03.2015 13:45:30
XBV00042.VDF : 8.11.213.202 3584 Bytes 05.03.2015 13:45:30
XBV00043.VDF : 8.11.213.204 2048 Bytes 05.03.2015 13:45:30
LOCAL000.VDF : 8.11.213.204 123270656 Bytes 05.03.2015 13:47:26
Engineversion : 8.3.28.30
AEVDF.DLL : 8.3.1.6 133992 Bytes 24.11.2014 09:23:20
AESCRIPT.DLL : 8.2.2.56 554920 Bytes 15.02.2015 09:12:13
AESCN.DLL : 8.3.2.2 139456 Bytes 24.11.2014 09:23:20
AESBX.DLL : 8.2.20.34 1615784 Bytes 05.03.2015 13:45:02
AERDL.DLL : 8.2.1.20 731040 Bytes 15.02.2015 09:12:13
AEPACK.DLL : 8.4.0.62 793456 Bytes 22.02.2015 13:51:02
AEOFFICE.DLL : 8.3.1.12 350120 Bytes 22.02.2015 13:51:01
AEMOBILE.DLL : 8.1.2.0 277360 Bytes 30.12.2014 14:13:44
AEHEUR.DLL : 8.1.4.1568 8182640 Bytes 05.03.2015 13:45:02
AEHELP.DLL : 8.3.1.0 278728 Bytes 24.11.2014 09:23:20
AEGEN.DLL : 8.1.7.40 456608 Bytes 30.12.2014 14:13:34
AEEXP.DLL : 8.4.2.70 255904 Bytes 06.02.2015 11:35:03
AEEMU.DLL : 8.1.3.4 399264 Bytes 24.11.2014 09:23:20
AEDROID.DLL : 8.4.3.6 850800 Bytes 30.12.2014 14:13:43
AECORE.DLL : 8.3.4.0 243624 Bytes 30.12.2014 14:13:34
AEBB.DLL : 8.1.2.0 60448 Bytes 24.11.2014 09:23:20
AVWINLL.DLL : 15.0.8.650 25904 Bytes 05.03.2015 13:44:58
AVPREF.DLL : 15.0.8.650 52016 Bytes 05.03.2015 13:45:08
AVREP.DLL : 15.0.8.650 221432 Bytes 05.03.2015 13:45:08
AVARKT.DLL : 15.0.8.650 227120 Bytes 05.03.2015 13:45:04
AVEVTLOG.DLL : 15.0.8.650 183600 Bytes 05.03.2015 13:45:06
SQLITE3.DLL : 15.0.8.650 455472 Bytes 05.03.2015 13:45:27
AVSMTP.DLL : 15.0.8.650 79096 Bytes 05.03.2015 13:45:10
NETNT.DLL : 15.0.8.650 15152 Bytes 05.03.2015 13:45:24
RCIMAGE.DLL : 15.0.8.650 4864816 Bytes 05.03.2015 13:44:58
RCTEXT.DLL : 15.0.8.650 75056 Bytes 05.03.2015 13:44:58
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Schnelle Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\quicksysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Sonntag, 15. März 2015 13:51
Der Suchlauf über die Bootsektoren wird begonnen:
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '171' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '176' Modul(e) wurden durchsucht
Durchsuche Prozess 'NetworkLicenseServer.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtkNGUI64.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'AERTSr64.exe' - '8' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdobeARM.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'vprot.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNQMMAIN.EXE' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '134' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'ezSharedSvcHost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPClientServices.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'RIconMan.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'IJPLMSVC.EXE' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'ToolbarUpdater.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'loggingserver.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'YCMMirage.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCleaner64.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'splwow64.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '217' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNQMUPDT.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNQMSWCS.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'SYNTPHELPER.EXE' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '121' Modul(e) wurden durchsucht
Durchsuche Prozess 'update.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'updrgui.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'msfeedssync.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'NOTEPAD.EXE' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE.dll
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
Die Registry wurde durchsucht ( '1530' Dateien ).
Beginne mit der Desinfektion:
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater> wurde erfolgreich entfernt.
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Application Updater> wurde erfolgreich entfernt.
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Application Updater> wurde erfolgreich entfernt.
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50022625.qua' verschoben!
[HINWEIS] Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater\ImagePath> wurde erfolgreich repariert.
[HINWEIS] Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Application Updater\ImagePath> wurde erfolgreich repariert.
[HINWEIS] Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Application Updater\ImagePath> wurde erfolgreich repariert.
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}\> wurde erfolgreich entfernt.
Der Registrierungseintrag <HKEY_CLASSES_ROOT\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\> wurde erfolgreich entfernt.
C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE.dll
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '488b0996.qua' verschoben!
[HINWEIS] Der Registrierungseintrag <HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}> wurde erfolgreich repariert.
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings> wurde erfolgreich entfernt.
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
[FUND] Ist das Trojanische Pferd TR/Drop.Softomat.AN
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ad95360.qua' verschoben!
[HINWEIS] Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings> wurde erfolgreich repariert.
Ende des Suchlaufs: Sonntag, 15. März 2015 13:58
Benötigte Zeit: 04:02 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
2574 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
2571 Dateien ohne Befall
15 Archive wurden durchsucht
0 Warnungen
3 Hinweise
|
|
15.03.2015, 14:52
| #2 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde Malwarebytes
__________________Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.03.2015 Suchlauf-Zeit: 14:54:47 Logdatei: Malwarebytes 2015-03-05.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.03.05.02 Rootkit Datenbank: v2015.02.25.01 Lizenz: Testversion Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: benutzer Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 340646 Verstrichene Zeit: 42 Min, 7 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 1 PUP.Optional.Spigot.A, C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe, 5392, , [33b362df4c3ebe7810c5d9d328d9f30d] Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 11 PUP.Optional.Spigot.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Application Updater, , [33b362df4c3ebe7810c5d9d328d9f30d], PUP.Optional.Spigot.A, HKLM\SOFTWARE\CLASSES\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKLM\SOFTWARE\CLASSES\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\INPROCSERVER32, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\APPLICATION UPDATER, , [39ad55ec54361d19c045d1ed60a3a759], PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\SEARCH SETTINGS, , [1dc9f34e2d5df640788cb20c05feff01], PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Search Settings, , [1fc74ef36327ed491e8981a47b8ab24e], PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SEARCH SETTINGS, , [04e2d869dab08aace021e0de0df618e8], Registrierungswerte: 11 PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\APPLICATION UPDATER\APPLICATIONUPDATER.EXE, 1, , [33b362df4c3ebe7810c5d9d328d9f30d] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\SEARCH SETTINGS\SEARCHSETTINGS.EXE, 1, , [a2442a171971241251b1e5f11ae7ba46] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchSettings, "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe", , [a2442a171971241251b1e5f11ae7ba46] PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{B922D405-6D13-4A2B-AE89-08A030DA4402}, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{B922D405-6D13-4A2B-AE89-08A030DA4402}, pdfforge Toolbar, , [618566db0387fc3a8c76954139c89967] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{B922D405-6D13-4A2B-AE89-08A030DA4402}, pdfforge Toolbar, , [618566db0387fc3a8c76954139c89967] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\APPLICATION UPDATER|serverURL, hxxp://www.mybrowserbar.com/, , [39ad55ec54361d19c045d1ed60a3a759] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\SEARCH SETTINGS|installDir, C:\Program Files (x86)\Common Files\Spigot\Search Settings\, , [1dc9f34e2d5df640788cb20c05feff01] PUP.Optional.Spigot.A, HKU\S-1-5-21-1544451011-3975194477-2784028731-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SEARCH SETTINGS|GCProtected, 0, , [04e2d869dab08aace021e0de0df618e8] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\SEARCH SETTINGS\{4D6A6C8E-1EB2-46E1-8CAA-40DAFDE3ED93}.XPI, 1, , [1ec8360b2b5ff73f063f0a80f31056aa] PUP.Optional.Spigot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\COMMON FILES\SPIGOT\SEARCH SETTINGS\{62DD0A97-FDD4-421B-94A5-D1A9434450C7}.XPI, 1, , [1ec8360b2b5ff73f063f0a80f31056aa] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 4 PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Res, , [1ec8360b2b5ff73f063f0a80f31056aa], Dateien: 27 PUP.Optional.Spigot.A, C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe, , [33b362df4c3ebe7810c5d9d328d9f30d], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe, , [a2442a171971241251b1e5f11ae7ba46], PUP.Optional.Spigot.A, C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE64.dll, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE.dll, , [618566db0387fc3a8c76954139c89967], PUP.Optional.Spigot.A, C:\Program Files (x86)\pdfforge Toolbar\WidgiHelper.exe, , [8a5ca49d2664fc3a0dc9c3e9e41d2ad6], PUP.Optional.Spigot.A, C:\Windows\Installer\433ed.msi, , [76704ff231595adcb34fddf95da4b749], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ff.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ie.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\config.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\searchcom_ff.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\searchcom_ie.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\wth200.dll, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\wthx200.dll, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ff.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ie.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandextr_ff.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandextr_ie.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ff.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ie.xml, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\{4D6A6C8E-1EB2-46e1-8CAA-40DAFDE3ED93}.xpi, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\{62DD0A97-FDD4-421b-94A5-D1A9434450C7}.xpi, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], PUP.Optional.Spigot.A, C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini, , [1ec8360b2b5ff73f063f0a80f31056aa], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:00 on 15/03/2015 (****)
Checking for autostart values...^^
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by **** (administrator) on ****-HP on 15-03-2015 14:02:50 Running from C:\Users\****\Downloads Loaded Profiles: **** (Available profiles: ****) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe () C:\Program Files (x86)\AVG Secure Search\vprot.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe () C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2503704 2015-03-05] () HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.) HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-26] (Easybits) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-05] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [] => [X] HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\Run: [Google Update] => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-09-02] (Google Inc.) HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE /EPT "EPLTarget\P0000000000000001" /M "XP-302 303 305 306 Series" HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd) HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\RunOnce: [Adobe Speed Launcher] => 1426423548 HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\MountPoints2: F - F:\autostart.exe HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\MountPoints2: {eec51d56-2dc7-11e3-98ff-2c768ae646aa} - G:\pushinst.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://web.de/ HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQNOT/4 HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.pixelio.de/ hxxp://www.google.de/ URLSearchHook: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE64.dll () SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={5DAC5645-8911-4FE5-B479-CE9AA19E9E4C}&mid=eba0431ce20f47d09ea8fd3fcc02af59-cc200d34b14e5459bf1ea92047f6eef29cd316c2&lang=en&ds=gf011&pr=sa&d=2012-08-28 08:35:01&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {5A7FB257-9F57-49C7-B172-EEC9DEC4FDAA} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=507C4DE0-FFB8-4BBB-8D3C-85C5782205FF&apn_sauid=B7BC1221-D834-478E-9363-72D6044C27DF SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={5DAC5645-8911-4FE5-B479-CE9AA19E9E4C}&mid=eba0431ce20f47d09ea8fd3fcc02af59-cc200d34b14e5459bf1ea92047f6eef29cd316c2&lang=en&ds=gf011&pr=sa&d=2012-08-28 08:35:01&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.) BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.3.0.885\AVG Secure Search_toolbar.dll [2015-03-05] (AVG Secure Search) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation) Toolbar: HKLM - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\11.0\pdfforgeToolbarIE64.dll [2015-02-26] () Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.3.0.885\AVG Secure Search_toolbar.dll [2015-03-05] (AVG Secure Search) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.) Toolbar: HKLM-x32 - No Name - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No File Toolbar: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Toolbar: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll [2015-03-05] (AVG Secure Search) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\jitqdoz9.default-1426423934191 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-06] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-06] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.3.0\\npsitesafety.dll No File FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=3 -> C:\Users\****\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=9 -> C:\Users\****\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml [2015-03-05] FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.3.0.885 FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.3.0.885 [2015-03-05] Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Users\****\AppData\Local\Google\Chrome\Application\23.0.1271.91\gcswf32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\****\AppData\Local\Google\Chrome\Application\23.0.1271.91\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Users\****\AppData\Local\Google\Chrome\Application\23.0.1271.91\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.0\\npsitesafety.dll (AVG Technologies) CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\SysWOW64\npDeployJava1.dll No File CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Users\****\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Profile: C:\Users\****\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-02] CHR Extension: (Google Search) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-02] CHR Extension: (AVG Secure Search) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2012-11-08] CHR Extension: (Gmail) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-02] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-05] (Avira Operations GmbH & Co. KG) S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG) R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed] R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed] R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] () R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 vToolbarUpdater18.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [1802776 2015-03-05] (AVG Secure Search) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-05] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-05] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-18] (Siliten) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-08-23] (Windows (R) 2000 DDK provider) R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-08-23] (Paragon) R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-08-23] (Paragon) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () S3 massfilter; system32\drivers\massfilter.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-15 14:02 - 2015-03-15 14:04 - 00023817 _____ () C:\Users\****\Downloads\FRST.txt 2015-03-15 14:02 - 2015-03-15 14:03 - 00000000 ____D () C:\FRST 2015-03-15 14:02 - 2015-03-15 14:02 - 02095616 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe 2015-03-15 14:00 - 2015-03-15 14:00 - 00000472 _____ () C:\Users\****\Desktop\defogger_disable.log 2015-03-15 14:00 - 2015-03-15 14:00 - 00000000 _____ () C:\Users\****\defogger_reenable 2015-03-15 13:57 - 2015-03-15 13:57 - 00050477 _____ () C:\Users\****\Downloads\Defogger.exe 2015-03-15 13:52 - 2015-03-15 13:52 - 00000000 ____D () C:\Users\****\Desktop\Alte Firefox-Daten 2015-03-05 15:46 - 2015-03-15 13:52 - 00009431 _____ () C:\Users\****\Desktop\Malwarebytes 2015-03-05.txt 2015-03-05 14:49 - 2015-03-15 13:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-03-05 14:49 - 2015-03-05 14:49 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-03-05 14:49 - 2015-03-05 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-03-05 14:48 - 2015-03-05 14:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-03-05 14:48 - 2015-03-05 14:48 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-03-05 14:48 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-03-05 14:48 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-03-05 14:48 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-03-05 14:45 - 2015-03-15 13:58 - 00000000 ____D () C:\Program Files (x86)\Application Updater 2015-03-05 14:45 - 2015-03-06 21:20 - 00000000 ____D () C:\Program Files (x86)\pdfforge Toolbar 2015-03-05 14:37 - 2015-03-15 13:49 - 00000146 _____ () C:\Windows\setupact.log 2015-03-05 14:37 - 2015-03-05 14:37 - 00000000 _____ () C:\Windows\setuperr.log 2015-03-02 17:06 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls 2015-03-02 17:06 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls 2015-02-19 11:06 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-19 11:06 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-19 11:06 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-19 11:06 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-16 12:11 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-16 12:11 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-16 12:11 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-16 12:11 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-16 12:11 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-16 12:11 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-16 12:10 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-16 12:10 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-16 12:10 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-16 12:10 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-16 12:10 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-16 12:10 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-16 12:10 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-16 12:10 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-16 12:10 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-16 12:10 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-16 12:10 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-16 12:10 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-16 12:10 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-16 12:10 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-16 12:10 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-16 12:10 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-16 12:10 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-16 12:10 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-16 12:10 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-16 12:10 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-16 12:10 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-16 12:10 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-16 12:10 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-16 12:10 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-16 12:10 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-16 12:10 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-16 12:10 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-16 12:10 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-16 12:10 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-16 12:10 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-16 12:10 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-16 12:10 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-16 12:10 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-16 12:10 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-16 12:10 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-16 12:10 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-16 12:10 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-16 12:10 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-16 12:10 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-16 12:10 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-16 12:10 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-16 12:10 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-16 12:10 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-16 12:10 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-16 12:10 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-16 12:10 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-16 12:10 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-16 12:10 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-16 12:10 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-16 12:10 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-16 12:10 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-16 12:10 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-16 12:08 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-16 12:08 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-16 12:08 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-16 12:08 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-16 12:08 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-16 12:08 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-16 12:08 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-16 12:08 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-16 12:08 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-16 12:08 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-16 12:08 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-16 12:08 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-16 12:08 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-16 12:08 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-16 12:08 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-16 12:08 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-16 12:08 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-16 12:08 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-16 12:08 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-16 12:08 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-16 12:07 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-16 12:07 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-16 12:07 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-16 12:07 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-16 12:07 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-16 12:07 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-16 12:07 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-16 12:07 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-16 12:06 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-16 12:06 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-16 12:06 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-16 12:06 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-16 12:06 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-16 12:05 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-16 12:05 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-16 12:05 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-16 12:05 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-16 12:04 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-15 14:00 - 2012-05-31 20:26 - 00000000 ____D () C:\Users\**** 2015-03-15 13:59 - 2013-06-01 20:38 - 01155546 _____ () C:\Windows\WindowsUpdate.log 2015-03-15 13:57 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-15 13:57 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-15 13:52 - 2013-05-09 08:35 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4B85906F-98E1-4B70-9AA7-74C90EFB8482} 2015-03-15 13:45 - 2013-06-07 19:05 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job 2015-03-15 13:45 - 2013-06-05 19:31 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2015-03-15 13:45 - 2013-05-23 17:52 - 00065536 _____ () C:\Windows\system32\Ikeext.etl 2015-03-15 13:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-06 21:20 - 2011-11-07 21:42 - 00000000 ___RD () C:\Users\Public\Recorded TV 2015-03-06 21:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2015-03-05 15:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-03-05 14:45 - 2014-12-30 15:17 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-03-05 14:45 - 2014-12-30 15:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-03-05 14:45 - 2014-12-30 15:09 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-03-05 14:44 - 2014-12-30 15:02 - 00000000 ____D () C:\ProgramData\Package Cache 2015-03-05 14:44 - 2014-12-30 15:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-03-05 14:43 - 2014-12-30 15:02 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-03-05 14:38 - 2012-08-28 07:34 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search 2015-03-02 17:06 - 2013-10-05 15:22 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2015-03-02 17:06 - 2012-06-24 18:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-03-02 16:39 - 2014-05-24 19:01 - 00000000 ____D () C:\Users\****\AppData\Local\Audible 2015-03-02 16:34 - 2012-09-02 13:22 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job 2015-03-02 15:34 - 2012-09-02 13:22 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job 2015-03-02 14:49 - 2014-05-15 11:29 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleFor**** 2015-03-02 14:49 - 2014-05-15 11:29 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleFor****.job 2015-03-02 14:48 - 2012-06-25 21:50 - 00000000 ____D () C:\Users\****\AppData\Local\CrashDumps 2015-02-24 10:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-19 09:57 - 2013-06-26 19:06 - 00347064 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-19 09:49 - 2014-12-13 14:47 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-19 09:49 - 2014-05-06 11:47 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-16 13:41 - 2012-06-01 20:06 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-16 13:34 - 2013-08-14 17:59 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-16 13:24 - 2012-06-24 20:15 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe ==================== Files in the root of some directories ======= 2013-06-26 19:07 - 2014-06-29 11:19 - 0003730 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml 2012-08-28 07:52 - 2012-08-28 11:09 - 0000021 _____ () C:\Users\****\AppData\Roaming\ISOWorkshop.ini Some content of TEMP: ==================== C:\Users\****\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-24 10:24 ==================== End Of Log ============================ FRST Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by **** at 2015-03-15 14:06:00
Running from C:\Users\****\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1998470398.48.56.35720562 - Audible, Inc.)
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.3.0.885 - AVG Technologies)
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Boot Media Builder for Paragon Backup and Recovery™ 11 Home (HKLM-x32\...\{9B5C65EB-A2A6-5DCD-A5BC-53A1895C8204}) (Version: 1.00.0000 - Paragon Software)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.0.0 - Canon Inc.)
Canon MG3200 series Benutzerregistrierung (HKLM-x32\...\Canon MG3200 series Benutzerregistrierung) (Version: - Canon Inc.)
Canon MG3200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3200_series) (Version: 1.01 - Canon Inc.)
Canon MG3200 series On-screen Manual (HKLM-x32\...\Canon MG3200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
CompuPic (HKLM-x32\...\CompuPic) (Version: - )
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2515 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM-x32\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
FILEminimizer Pictures (HKLM-x32\...\FILEminimizer Pictures_is1) (Version: - balesio AG)
Google Chrome (HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KODAK Create@Home Software (für dm) (HKLM-x32\...\{33D21DE0-8363-4997-A960-E32EA9D84AB3}) (Version: 7.3.4392 - Digilabs)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Medion Home Cinema (HKLM-x32\...\InstallShield_{AB770FDE-8087-4C98-9A85-BD64262C104C}) (Version: 6.0.0000 - CyberLink Corp.)
Medion Home Cinema (x32 Version: 6.0.0000 - CyberLink Corp.) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Netzwerkhandbuch EPSON XP-302 303 305 306 Series (HKLM-x32\...\EPSON XP-302 303 305 306 Series Netg) (Version: - )
Paragon Backup and Recovery™ 11 Home (HKLM-x32\...\{485DF5E7-8379-4BFA-BAE1-9B8DBFE0D6B4}) (Version: 90.00.0003 - Paragon Software)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
pdfforge Toolbar v11.0 (HKLM-x32\...\{9C131BA5-223C-4856-B0D2-826775A2BA6E}) (Version: 11.0 - Spigot, Inc.) <==== ATTENTION
PHOTO Evolution PRO (HKLM-x32\...\{4DBEC42D-E6F8-4BC1-A2BD-12D2A6D3F3F3}_is1) (Version: - Franzis Verlag)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 3.02.01.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Reveal 1.2 (HKLM-x32\...\Reveal_1.2) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Software Updater (HKLM-x32\...\{A737E18A-5171-40D0-8034-7DD243420081}) (Version: 4.1.1 - SEIKO EPSON CORPORATION)
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.29.0 - Synaptics Incorporated)
Unlocker 1.9.0-x64 (HKLM\...\Unlocker) (Version: 1.9.0 - Cedrick Collomb)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\****\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
==================== Restore Points =========================
29-01-2015 15:13:12 Windows Update
06-02-2015 12:42:56 Windows Update
10-02-2015 13:12:00 Windows Update
16-02-2015 11:58:20 Windows Update
16-02-2015 13:20:02 Windows Update
22-02-2015 14:51:50 Windows Update
02-03-2015 14:27:42 Windows Update
02-03-2015 17:06:22 Windows Update
05-03-2015 14:58:38 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0C4AC2AB-F19E-47FA-B0C1-F623AC42A993} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {1FCB485B-F56D-4CF1-B411-72ADEE68CFCB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {23C47CB7-4B7C-4CE3-BB20-43D8B8DEAEAF} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{D2D21822-E4CD-42AA-AF7B-9DA2D55B821C}.exe
Task: {3EF895A6-81DE-43C1-8173-1E155D069DC9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {4C08FDCC-2F91-41E6-B58E-C9EE9BD240D0} - System32\Tasks\HPCeeScheduleFor**** => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {4D0F4783-9CF2-4C17-8017-1869B287279D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {570DA36F-EEEC-452C-B015-8A606D008DCB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {60AFA18A-8357-474B-B7C9-42CDF0610AE0} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02] (Google Inc.)
Task: {80B59B5A-AA0B-4367-A460-FC4534EA60F5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {943711D3-3648-4131-9B86-4D935976DED8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {A4482426-EE58-4DF8-B204-FE513B064F67} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe
Task: {AB288D5C-64BB-44F2-A514-72573254ED0B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02] (Google Inc.)
Task: {BE631227-8CD4-4CDC-8999-EF14D355F7A1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {C7A5B382-369F-4924-9FA1-F7B93F56E3FB} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {CB3F7F4F-5B7B-46EC-BBFF-609BF8F8EC0F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {E377D9C3-B0B7-4D7B-B782-EDA8293D21F0} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{9947737E-416C-493F-B34B-7A3794001960}.exe
Task: {E9CBC81B-C735-477E-885C-D6BA781FA75A} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{D2D21822-E4CD-42AA-AF7B-9DA2D55B821C}.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{9947737E-416C-493F-B34B-7A3794001960}.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleFor****.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) ==============
2012-09-04 11:05 - 2005-03-12 00:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2012-08-28 07:34 - 2015-03-05 14:38 - 02503704 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe
2013-10-05 15:42 - 2012-03-28 13:49 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2015-03-05 14:38 - 2015-03-05 14:38 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\loggingserver.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2015-03-05 14:38 - 2015-03-05 14:38 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\log4cplusU.dll
2009-11-02 13:20 - 2009-11-02 13:20 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 13:23 - 2009-11-02 13:23 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2015-01-29 16:28 - 2015-01-29 16:28 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-02-06 14:06 - 2015-02-06 14:06 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: ccleaner => "C:\EXTRAS\ccleaner_portable_3.20\CCleaner64.exe" /AUTO
MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: SetDefault => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe
MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-1544451011-3975194477-2784028731-500 - Administrator - Disabled)
Gast (S-1-5-21-1544451011-3975194477-2784028731-501 - Limited - Disabled)
**** (S-1-5-21-1544451011-3975194477-2784028731-1001 - Administrator - Enabled) => C:\Users\****
HomeGroupUser$ (S-1-5-21-1544451011-3975194477-2784028731-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/15/2015 01:46:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2015 03:53:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2015 02:39:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2015 03:29:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Error: (03/02/2015 03:27:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Error: (03/02/2015 02:30:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm CCleaner64.exe, Version 5.1.0.5075 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 42c
Startzeit: 01d054eb91899ea7
Endzeit: 265
Anwendungspfad: C:\Program Files\CCleaner\CCleaner64.exe
Berichts-ID: 22d09b76-c0e0-11e4-9bf0-2c768ae646aa
Error: (03/02/2015 02:12:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CNQMUPDT.EXE, Version: 2.0.0.0, Zeitstempel: 0x4f7a7000
Name des fehlerhaften Moduls: CNMDWLD.DLL, Version: 1.0.0.0, Zeitstempel: 0x4f5eedc8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000023c6
ID des fehlerhaften Prozesses: 0xf18
Startzeit der fehlerhaften Anwendung: 0xCNQMUPDT.EXE0
Pfad der fehlerhaften Anwendung: CNQMUPDT.EXE1
Pfad des fehlerhaften Moduls: CNQMUPDT.EXE2
Berichtskennung: CNQMUPDT.EXE3
Error: (03/02/2015 02:11:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/24/2015 05:16:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/24/2015 10:26:18 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
System errors:
=============
Error: (03/15/2015 01:51:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (03/15/2015 01:51:13 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (03/15/2015 01:51:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (03/15/2015 01:51:13 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (03/15/2015 01:51:13 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801
Error: (03/15/2015 01:51:13 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801
Error: (03/15/2015 01:51:06 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (03/15/2015 01:51:06 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (03/15/2015 01:51:06 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801
Error: (03/15/2015 01:46:34 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Microsoft Office Sessions:
=========================
Error: (03/15/2015 01:46:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2015 03:53:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2015 02:39:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2015 03:29:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
Error: (03/02/2015 03:27:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\EPSON Software\Download Navigator\EPSDNAVI.EXE
Error: (03/02/2015 02:30:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: CCleaner64.exe5.1.0.507542c01d054eb91899ea7265C:\Program Files\CCleaner\CCleaner64.exe22d09b76-c0e0-11e4-9bf0-2c768ae646aa
Error: (03/02/2015 02:12:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CNQMUPDT.EXE2.0.0.04f7a7000CNMDWLD.DLL1.0.0.04f5eedc8c0000005000023c6f1801d054ea3c1eb2fbC:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXEC:\Program Files (x86)\Canon\Quick Menu\CNMDWLD.DLLb60dfd7c-c0dd-11e4-9bf0-2c768ae646aa
Error: (03/02/2015 02:11:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/24/2015 05:16:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/24/2015 10:26:18 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files\CCleaner\CCleaner.exe
==================== Memory info ===========================
Processor: AMD E-300 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 70%
Total physical RAM: 3690.91 MB
Available physical RAM: 1106.86 MB
Total Pagefile: 7380 MB
Available Pagefile: 3961.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:278.51 GB) (Free:209.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.42 GB) (Free:1.68 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:3.27 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: F2DC90A7)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=278.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-03-15 14:27:20 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000066 Hitachi_ rev.ES2O 298,09GB Running: Gmer-19357.exe; Driver: C:\Users\****\AppData\Local\Temp\ugtiqpob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075721401 2 bytes JMP 74f9b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075721419 2 bytes JMP 74f9b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075721431 2 bytes JMP 75018ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007572144a 2 bytes CALL 74f748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757214dd 2 bytes JMP 750187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757214f5 2 bytes JMP 75018978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007572150d 2 bytes JMP 75018698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075721525 2 bytes JMP 75018a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007572153d 2 bytes JMP 74f8fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075721555 2 bytes JMP 74f968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007572156d 2 bytes JMP 75018f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075721585 2 bytes JMP 75018ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007572159d 2 bytes JMP 7501865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757215b5 2 bytes JMP 74f8fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757215cd 2 bytes JMP 74f9b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757216b2 2 bytes JMP 75018e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757216bd 2 bytes JMP 750185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075721401 2 bytes JMP 74f9b21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075721419 2 bytes JMP 74f9b346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075721431 2 bytes JMP 75018ea9 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007572144a 2 bytes CALL 74f748ad C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757214dd 2 bytes JMP 750187a2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757214f5 2 bytes JMP 75018978 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007572150d 2 bytes JMP 75018698 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075721525 2 bytes JMP 75018a62 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007572153d 2 bytes JMP 74f8fca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075721555 2 bytes JMP 74f968ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007572156d 2 bytes JMP 75018f61 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075721585 2 bytes JMP 75018ac2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007572159d 2 bytes JMP 7501865c C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757215b5 2 bytes JMP 74f8fd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757215cd 2 bytes JMP 74f9b2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757216b2 2 bytes JMP 75018e24 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[2428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757216bd 2 bytes JMP 750185f1 C:\Windows\syswow64\KERNEL32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075721401 2 bytes JMP 74f9b21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075721419 2 bytes JMP 74f9b346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075721431 2 bytes JMP 75018ea9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007572144a 2 bytes CALL 74f748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757214dd 2 bytes JMP 750187a2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757214f5 2 bytes JMP 75018978 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007572150d 2 bytes JMP 75018698 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075721525 2 bytes JMP 75018a62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007572153d 2 bytes JMP 74f8fca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075721555 2 bytes JMP 74f968ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007572156d 2 bytes JMP 75018f61 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075721585 2 bytes JMP 75018ac2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007572159d 2 bytes JMP 7501865c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757215b5 2 bytes JMP 74f8fd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757215cd 2 bytes JMP 74f9b2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757216b2 2 bytes JMP 75018e24 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\ezSharedSvcHost.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757216bd 2 bytes JMP 750185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075721401 2 bytes JMP 74f9b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075721419 2 bytes JMP 74f9b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075721431 2 bytes JMP 75018ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007572144a 2 bytes CALL 74f748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757214dd 2 bytes JMP 750187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757214f5 2 bytes JMP 75018978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007572150d 2 bytes JMP 75018698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075721525 2 bytes JMP 75018a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007572153d 2 bytes JMP 74f8fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075721555 2 bytes JMP 74f968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007572156d 2 bytes JMP 75018f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075721585 2 bytes JMP 75018ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007572159d 2 bytes JMP 7501865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757215b5 2 bytes JMP 74f8fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757215cd 2 bytes JMP 74f9b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757216b2 2 bytes JMP 75018e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[3040] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757216bd 2 bytes JMP 750185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075721401 2 bytes JMP 74f9b21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075721419 2 bytes JMP 74f9b346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075721431 2 bytes JMP 75018ea9 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007572144a 2 bytes CALL 74f748ad C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757214dd 2 bytes JMP 750187a2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757214f5 2 bytes JMP 75018978 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007572150d 2 bytes JMP 75018698 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075721525 2 bytes JMP 75018a62 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007572153d 2 bytes JMP 74f8fca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075721555 2 bytes JMP 74f968ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007572156d 2 bytes JMP 75018f61 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075721585 2 bytes JMP 75018ac2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007572159d 2 bytes JMP 7501865c C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757215b5 2 bytes JMP 74f8fd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757215cd 2 bytes JMP 74f9b2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757216b2 2 bytes JMP 75018e24 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[4984] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757216bd 2 bytes JMP 750185f1 C:\Windows\syswow64\KERNEL32.dll ---- Registry - GMER 2.1 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D1EAB7F3-7C6E-C36A-FEC1-25F15DD25502} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D1EAB7F3-7C6E-C36A-FEC1-25F15DD25502}@jadmifokeehbniegchpm 0x6D 0x61 0x64 0x6F ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- |
|
15.03.2015, 15:18
| #3 |
| /// the machine /// TB-Ausbilder    | Windows 7 Home Premium 64bit: diverse Virenfunde hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
15.03.2015, 16:47
| #4 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde pdfforge Toolbar mit Revo Uninstaller deinstalliert. Reste waren nicht vorhanden. Combofix konnte beim ersten Versuch nicht vollständig durchgeführt werden. Hat sich bei Schritt 4 aufgehängt. Habe dann Avira komplett deinstalliert und dann hat es funktioniert. Code:
ATTFilter ComboFix 15-03-14.03 - guedo 15.03.2015 16:26:42.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3691.1555 [GMT 1:00]
ausgeführt von:: c:\users\guedo\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-02-15 bis 2015-03-15 ))))))))))))))))))))))))))))))
.
.
2015-03-15 15:38 . 2015-03-15 15:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-03-15 14:21 . 2015-03-15 14:21 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-03-15 13:43 . 2015-03-15 13:44 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2C563FD-0B27-492C-A53D-2B0D2A2F71B2}\offreg.dll
2015-03-15 13:36 . 2015-01-29 09:07 11910896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2C563FD-0B27-492C-A53D-2B0D2A2F71B2}\mpengine.dll
2015-03-15 13:02 . 2015-03-15 13:08 -------- d-----w- C:\FRST
2015-03-05 13:49 . 2015-03-15 13:28 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-05 13:48 . 2015-03-05 13:49 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-03-05 13:48 . 2015-03-05 13:48 -------- d-----w- c:\programdata\Malwarebytes
2015-03-05 13:48 . 2014-11-21 05:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-03-05 13:48 . 2014-11-21 05:14 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-03-05 13:48 . 2014-11-21 05:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-03-05 13:48 . 2015-03-05 13:48 -------- d-----w- c:\users\guedo\AppData\Local\Programs
2015-02-19 10:06 . 2015-01-23 03:43 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2015-02-19 10:06 . 2015-01-23 03:17 4300800 ----a-w- c:\windows\SysWow64\jscript9.dll
2015-02-19 10:06 . 2015-01-23 04:41 6041600 ----a-w- c:\windows\system32\jscript9.dll
2015-02-19 10:06 . 2015-01-23 04:42 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-16 11:10 . 2015-01-12 02:48 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2015-02-16 11:09 . 2015-01-12 02:59 10949120 ----a-w- c:\program files\Internet Explorer\F12Resources.dll
2015-02-16 11:07 . 2014-12-12 05:31 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-02-16 11:07 . 2014-07-07 02:06 187904 ----a-w- c:\windows\system32\cryptsvc.dll
2015-02-16 11:07 . 2014-12-12 05:07 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-02-16 11:07 . 2014-07-07 02:07 229376 ----a-w- c:\windows\system32\wintrust.dll
2015-02-16 11:07 . 2014-07-07 01:40 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2015-02-16 11:07 . 2014-07-07 01:40 143872 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2015-02-16 11:07 . 2014-11-26 03:53 861696 ----a-w- c:\windows\system32\oleaut32.dll
2015-02-16 11:07 . 2014-11-26 03:32 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-02-16 11:06 . 2014-12-08 03:09 406528 ----a-w- c:\windows\system32\scesrv.dll
2015-02-16 11:06 . 2014-12-08 02:46 308224 ----a-w- c:\windows\SysWow64\scesrv.dll
2015-02-16 11:06 . 2015-01-14 06:09 5554112 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-02-16 11:06 . 2015-01-14 05:44 3972544 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-02-16 11:06 . 2015-01-14 05:44 3917760 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-02-16 11:05 . 2015-01-14 06:05 503808 ----a-w- c:\windows\system32\srcore.dll
2015-02-16 11:05 . 2015-01-14 06:04 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-02-16 11:05 . 2015-01-14 06:05 50176 ----a-w- c:\windows\system32\srclient.dll
2015-02-16 11:05 . 2015-01-14 05:41 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-02-16 11:04 . 2015-01-09 02:03 3201536 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-24 03:17 . 2010-11-21 03:27 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-16 12:24 . 2012-06-24 19:15 116773704 ----a-w- c:\windows\system32\MRT.exe
2015-02-06 13:06 . 2012-06-24 17:05 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-06 13:06 . 2011-08-09 11:02 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-24 16:33 . 2015-01-24 16:35 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-12-19 03:06 . 2015-01-21 16:02 210432 ----a-w- c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-21 16:02 141312 ----a-w- c:\windows\system32\drivers\mrxdav.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2015-03-05 13:38 3507736 ----a-w- c:\program files (x86)\AVG Secure Search\18.3.0.885\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\18.3.0.885\AVG Secure Search_toolbar.dll" [2015-03-05 3507736]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-12-12 7394584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128]
"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2015-03-05 2503704]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"CanonQuickMenu"="c:\program files (x86)\Canon\Quick Menu\CNQMMAIN.EXE" [2012-04-03 1273448]
"Magic Desktop for HP notification"="c:\programdata\Easybits Magic Desktop for HP\mdhpSUN.exe" [2013-12-26 1258504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
"HPOSD"=c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
"HP Quick Launch"=c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
.
3;3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;c:\windows\system32\DRIVERS\InputFilter_FlexDef2b.sys;c:\windows\SYSNATIVE\DRIVERS\InputFilter_FlexDef2b.sys [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S1 Uim_VIM;UIM Virtual Image Plugin;c:\windows\system32\Drivers\uim_vimx64.sys;c:\windows\SYSNATIVE\Drivers\uim_vimx64.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 vToolbarUpdater18.3.0;vToolbarUpdater18.3.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.3.0\ToolbarUpdater.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S4 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - UGTIQPOB
*Deregistered* - ugtiqpob
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-24 13:07]
.
2015-03-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job
- c:\users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02 12:22]
.
2015-03-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job
- c:\users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02 12:22]
.
2015-03-15 c:\windows\Tasks\HPCeeScheduleForguedo.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://web.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll
FF - ProfilePath - c:\users\guedo\AppData\Roaming\Mozilla\Firefox\Profiles\jitqdoz9.default-1426423934191\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-EPLTarget\P0000000000000001 - c:\windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.abr"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ani"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.arw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bmp"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cr2"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CRW\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.crw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cs1"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cur"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dcr"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dcx"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dib"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dng"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.emf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.eps"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.erf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fff"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.FPX\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.gif"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.hdr"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icl"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2k"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jfif"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jif"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jp2"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpc"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpe"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpeg"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-1544451011-3975194477-2784028731-1001)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Jpeg"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.KDC\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.kdc"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mef"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mos"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mrw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.nef"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.nrw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.orf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pcd"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pcx"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pef"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pgm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pic"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.png"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ppm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PSD\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psd"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psp"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspimage"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raw"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rle"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rw2"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rwl"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sr2"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.srf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tga"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.thm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tif"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.tiff"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttc"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30po"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30pp"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30ppf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wbm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wbmp"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wmf"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xif"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xmp"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
[HKEY_USERS\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D1EAB7F3-7C6E-C36A-FEC1-25F15DD25502}*]
"jadmifokeehbniegchpm"=hex:6d,61,64,6f,66,6c,62,6c,70,6f,61,6f,6c,64,70,64,6d,
6a,68,6a,66,6f,65,6f,64,6f,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
"Key"="ActionsPane3"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-03-15 16:43:51
ComboFix-quarantined-files.txt 2015-03-15 15:43
.
Vor Suchlauf: 14 Verzeichnis(se), 224.780.943.360 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 226.622.758.912 Bytes frei
.
- - End Of File - - BCF29C2E6BFD6FF24A07E57E0F8246C9
66082AD9BF9B782C5A32FD52F15B4C31
|
|
16.03.2015, 08:31
| #5 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse Virenfunde Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.03.2015, 10:25
| #6 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde Hier die Logfiles: MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.03.2015 Suchlauf-Zeit: 09:20:55 Logdatei: MBAM.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.03.16.01 Rootkit Datenbank: v2015.02.25.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: guedo Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 356967 Verstrichene Zeit: 30 Min, 11 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.112 - Bericht erstellt 16/03/2015 um 10:00:01
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-15.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : guedo - GUEDO-HP
# Gestarted von : C:\Users\guedo\Desktop\AdwCleaner_4.112.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : vToolbarUpdater18.3.0
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\Program Files (x86)\AVG Secure Search
Ordner Gelöscht : C:\Program Files (x86)\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\guedo\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\guedo\AppData\LocalLow\AVG Secure Search
Ordner Gelöscht : C:\Users\guedo\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Datei Gelöscht : C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5A7FB257-9F57-49C7-B172-EEC9DEC4FDAA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gelöscht : HKCU\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\A81E737A17150D040843D72D34240018
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\A81E737A17150D040843D72D34240018
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A81E737A17150D040843D72D34240018
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17689
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
-\\ Mozilla Firefox v36.0.1 (x86 de)
[jitqdoz9.default-1426423934191\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-global\":{\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"d\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\browser\\\\extensions\\\\{972ce4c6-7e08-4474-a285[...]
-\\ Google Chrome v
[C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}
[C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
[C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.avg.com/search?cid={5DAC5645-8911-4FE5-B479-CE9AA19E9E4C}&mid=eba0431ce20f47d09ea8fd3fcc02af59-cc200d34b14e5459bf1ea92047f6eef29cd316c2&lang=en&ds=gf011&pr=sa&d=2012-08-28 08:35:01&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
[C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=507C4DE0-FFB8-4BBB-8D3C-85C5782205FF&apn_ptnrs=U3&apn_sauid=B7BC1221-D834-478E-9363-72D6044C27DF&apn_dtid=OSJ000YYDE&q={searchTerms}
[C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=507C4DE0-FFB8-4BBB-8D3C-85C5782205FF&apn_ptnrs=U3&apn_sauid=B7BC1221-D834-478E-9363-72D6044C27DF&apn_dtid=OSJ000YYDE&q={searchTerms}
*************************
AdwCleaner[R0].txt - [11597 Bytes] - [16/03/2015 09:55:57]
AdwCleaner[S0].txt - [10705 Bytes] - [16/03/2015 10:00:01]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10765 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by guedo on 16.03.2015 at 10:07:20,46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
~~~ Files
Successfully deleted: [File] C:\Windows\prefetch\PDFFORGETOOLBAR.EXE-78521224.pf
Successfully deleted: [File] C:\Windows\prefetch\DRIVERINSTALLER.EXE-60359B37.pf
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{0477993E-E541-4BB0-9A2C-06BE1B4B387B}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{06C697AA-DB33-49F4-AB05-EED9BF6753AB}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{08155E47-7115-4BFD-B79A-2A122F500BB4}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{0DEC440E-1C7F-48A0-BEA8-2458FF248646}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{12AFEFB8-B06E-4831-9E2B-F27C631DDE67}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{14F3B291-265D-49F7-89E5-E752B9C8E7DF}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{1A4BCF96-C1CB-4AAE-BB10-C8B042C7D741}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{1F4F790F-70B4-4D7D-9E5E-815DE269EEAC}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{315D14F0-FDE5-4B24-BDA9-19FC6BBCBBD5}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{31D73432-6ED9-4302-9C29-DC04AEB8C06A}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{3697C4E8-0393-43AA-B0AA-AEC5DB5A2B66}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{39FE27C6-ADCB-4D70-B34E-7081A5EF3981}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{3A3A8ADD-7715-4114-A393-FA2C6C1988D0}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{3B5E78D9-0AAA-4FF1-A231-F7B919D8E315}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{3FCE9A00-9703-4C15-9BC5-AC4532C24299}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{445641D8-679E-4B20-A4C4-F12D470D1FBF}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{477F4262-5FED-451C-ADE6-32CB085BC5E0}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{4C70D086-2BA0-47B3-B376-4B0DC05825E7}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{4C880C66-0B93-46CD-B390-122F46C529A6}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{4D5A186F-A407-4AE8-8A7B-AA357998F116}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{4F76C751-978A-4833-BFA4-8701E3400853}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{565A5BFF-571D-4414-A917-8A56D98FA3D7}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{5A4B91A9-2564-45DB-9EFC-E18C24306333}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{5B74B464-C591-4289-836B-326FA9E05A93}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{5C7E1CA9-CF1C-4DD3-BE0E-246F216D4933}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{69008004-78B1-4CDB-8289-7D90CCF04435}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{6E80FA1C-6E3A-40DE-ADAB-972B3EC5D318}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{790A8987-5A56-467A-BF62-7C80CB50ED46}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{79C0C41C-6116-4202-A368-FA186D65514C}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{7AC72BAE-B660-4203-9171-B8AB9EC0739A}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{7B5A0025-FFA7-42F6-9D28-61B505349C91}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{7C9871C2-9271-4F24-9D6E-ED7D736B2211}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{7D6BA537-355A-414A-85CF-D50FC487B6CF}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{7F651FFF-0990-4E29-9B37-4ECF3A275D6D}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{87068A7D-351D-48EB-93D9-2476F4C2299E}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{88ED9482-A351-4798-BD1F-8E7DEF17F4C7}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{899CD8E3-3BFC-4F60-8072-A2F31DCC0E77}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{8BE9979C-50DF-48AF-A074-1A66088CF897}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{8E87F0C2-39AB-4286-8104-9049BDC444C0}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{8F3DF228-E14F-45F6-BC0C-9A9183CFE3E6}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{95DCDDBC-0D81-459A-888B-256BD44B95BB}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{9784702B-18DE-4CE4-93DA-731A245B8F0A}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{9AB5253E-9168-4763-A167-D3FA862C26CF}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{9CEFF5F8-124A-4BCA-B329-92E0CBB1415E}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{A0AC80EF-987E-418D-82E8-C19A5EF62E0C}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{ABF2477D-790E-4728-895F-4C463256B396}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{ADC0EC94-782C-4266-8465-D860B04D90C9}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{B6B3B2C8-7AA4-498F-8F7E-FB39FC5F245E}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{BE24A842-19C7-4D3E-9FD3-82D346F32D5A}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{C4013A74-1F08-4250-89B1-6995EB950F1C}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{C7B762B5-6BCA-4B2B-BE8E-350A51E45E7C}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{C8914F9E-9C45-415A-A859-91D02EA5DA3B}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{CFF6720C-578E-472E-99DA-E27DB491970E}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{D21F14FB-9A86-480E-9007-91A83C189736}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{D4934DE5-0569-487B-B743-FA10F3105B9A}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{D98961D2-1826-4870-B8B7-FAF955050131}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{E56D967F-99FD-4D5B-93BA-4E6166C3C28F}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{E77FF5A4-9490-4D2F-AE40-AF052A47B38E}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{E8256FE4-5F35-4C8A-93DD-CF348C7866DA}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{E8E9F742-D16A-4BD6-AC8E-D0CD513CAD88}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{EB7310AD-2258-4841-A9FF-A17FC7C627D3}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{EEA94078-6C29-4FE2-94EA-C827256C24B8}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{F32CECEA-BCEA-449B-ABDB-A05F28B58D3C}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{F816E947-4654-45EB-8285-71BCC16E1426}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{F9E783DA-8D2D-4458-8237-F9A5DC74AEE5}
Successfully deleted: [Empty Folder] C:\Users\guedo\appdata\local\{FBFBDD4A-0993-4FE0-BF5E-A3B1A0CE7D64}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.03.2015 at 10:16:18,88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und die FRST Dateien: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by guedo (administrator) on GUEDO-HP on 16-03-2015 10:19:52
Running from C:\Users\guedo\Downloads
Loaded Profiles: guedo (Available profiles: guedo)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-26] (Easybits)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://web.de/
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-15] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-15] (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\guedo\AppData\Roaming\Mozilla\Firefox\Profiles\jitqdoz9.default-1426423934191
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-06] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-06] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-15] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=3 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=9 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.0\\npsitesafety.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\guedo\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-02]
CHR Extension: (Google Search) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-02]
CHR Extension: (Gmail) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-18] (Siliten)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-08-23] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-08-23] (Paragon)
R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-08-23] (Paragon)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-16 10:19 - 2015-03-16 10:20 - 00015619 _____ () C:\Users\guedo\Downloads\FRST.txt
2015-03-16 10:16 - 2015-03-16 10:18 - 00007937 _____ () C:\Users\guedo\Desktop\JRT.txt
2015-03-16 10:06 - 2015-03-16 10:06 - 01388333 _____ (Thisisu) C:\Users\guedo\Downloads\JRT.exe
2015-03-16 10:04 - 2015-03-16 10:04 - 00010922 _____ () C:\Users\guedo\Desktop\AdwCleaner[S0].txt
2015-03-16 09:55 - 2015-03-16 10:00 - 00000000 ____D () C:\AdwCleaner
2015-03-16 09:54 - 2015-03-16 09:54 - 02171392 _____ () C:\Users\guedo\Desktop\AdwCleaner_4.112.exe
2015-03-16 09:53 - 2015-03-16 09:53 - 00001201 _____ () C:\Users\guedo\Desktop\MBAM.txt
2015-03-15 18:32 - 2015-02-03 04:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-15 18:32 - 2015-02-03 04:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-15 18:32 - 2015-02-03 04:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-15 18:32 - 2015-02-03 04:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-15 18:32 - 2015-02-03 04:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-15 18:31 - 2015-02-03 04:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-15 18:31 - 2015-02-03 04:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-15 18:31 - 2015-02-03 04:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-15 18:31 - 2015-02-03 04:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-15 18:31 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-15 18:31 - 2015-02-03 04:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-15 18:31 - 2015-02-03 04:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-15 18:31 - 2015-02-03 04:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-15 18:31 - 2015-02-03 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-15 18:31 - 2015-02-03 04:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-15 18:31 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-15 18:31 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-15 18:31 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-15 18:31 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-15 18:31 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-15 18:31 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-15 18:31 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-15 18:31 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-15 18:31 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-15 18:31 - 2015-02-03 03:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-15 18:31 - 2014-10-31 23:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-15 18:31 - 2014-06-28 01:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-15 18:31 - 2014-06-28 01:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-15 17:55 - 2015-03-15 17:55 - 00009044 _____ () C:\Windows\PFRO.log
2015-03-15 17:11 - 2015-03-15 17:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-15 16:48 - 2015-03-15 16:48 - 00039412 _____ () C:\Users\guedo\Desktop\Combofix.txt
2015-03-15 16:43 - 2015-03-15 16:43 - 00039412 _____ () C:\ComboFix.txt
2015-03-15 15:32 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 15:32 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 15:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 15:28 - 2015-03-15 16:43 - 00000000 ____D () C:\Qoobox
2015-03-15 15:27 - 2015-03-15 16:40 - 00000000 ____D () C:\Windows\erdnt
2015-03-15 15:26 - 2015-03-15 15:26 - 05615380 ____R (Swearware) C:\Users\guedo\Desktop\ComboFix.exe
2015-03-15 15:21 - 2015-03-15 15:21 - 00001228 _____ () C:\Users\guedo\Desktop\Revo Uninstaller.lnk
2015-03-15 15:21 - 2015-03-15 15:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-15 15:20 - 2015-03-15 15:20 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\guedo\Downloads\revosetup95.exe
2015-03-15 14:51 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-15 14:51 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-15 14:51 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-03-15 14:51 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-03-15 14:50 - 2015-02-24 04:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-15 14:50 - 2015-02-24 03:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-15 14:50 - 2015-02-21 01:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-15 14:50 - 2015-02-21 01:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-15 14:50 - 2015-02-21 00:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-15 14:50 - 2015-02-20 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-15 14:50 - 2015-02-20 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-15 14:50 - 2015-02-20 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-15 14:50 - 2015-02-20 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-15 14:50 - 2015-02-20 03:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-15 14:50 - 2015-02-20 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-15 14:50 - 2015-02-20 03:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-15 14:50 - 2015-02-20 03:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-15 14:50 - 2015-02-20 03:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-15 14:50 - 2015-02-20 03:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-15 14:50 - 2015-02-20 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-15 14:50 - 2015-02-20 02:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-15 14:50 - 2015-02-20 02:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-15 14:50 - 2015-02-20 01:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-15 14:50 - 2015-02-20 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-15 14:49 - 2015-02-21 02:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-15 14:49 - 2015-02-21 01:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-15 14:49 - 2015-02-21 01:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-15 14:49 - 2015-02-21 00:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-15 14:49 - 2015-02-20 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-15 14:49 - 2015-02-20 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-15 14:49 - 2015-02-20 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-15 14:49 - 2015-02-20 03:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-15 14:49 - 2015-02-20 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-15 14:49 - 2015-02-20 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-15 14:49 - 2015-02-20 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-15 14:49 - 2015-02-20 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-15 14:49 - 2015-02-20 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-15 14:49 - 2015-02-20 03:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-15 14:49 - 2015-02-20 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-15 14:49 - 2015-02-20 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-15 14:49 - 2015-02-20 03:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-15 14:49 - 2015-02-20 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-15 14:49 - 2015-02-20 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-15 14:49 - 2015-02-20 03:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-15 14:49 - 2015-02-20 03:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-15 14:49 - 2015-02-20 02:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-15 14:49 - 2015-02-20 02:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-15 14:49 - 2015-02-20 02:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-15 14:49 - 2015-02-20 02:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-15 14:49 - 2015-02-20 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-15 14:49 - 2015-02-20 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-15 14:49 - 2015-02-20 02:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-15 14:49 - 2015-02-20 02:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-15 14:49 - 2015-02-20 02:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-15 14:49 - 2015-02-20 02:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-15 14:49 - 2015-02-20 02:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-15 14:49 - 2015-02-20 02:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-15 14:49 - 2015-02-20 02:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-15 14:49 - 2015-02-20 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-15 14:49 - 2015-02-20 02:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-15 14:45 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-15 14:45 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-15 14:45 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-15 14:45 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-15 14:45 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-15 14:45 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-15 14:45 - 2015-01-31 04:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-15 14:45 - 2015-01-31 04:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-15 14:45 - 2015-01-31 00:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-15 14:42 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-15 14:42 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-15 14:42 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-15 14:42 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-15 14:41 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-15 14:41 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-15 14:41 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-15 14:41 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-15 14:41 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-15 14:41 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-15 14:41 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-15 14:41 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-15 14:41 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-15 14:41 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-15 14:41 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-15 14:41 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-15 14:41 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-15 14:41 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-15 14:40 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-15 14:40 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-15 14:40 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-15 14:40 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-15 14:39 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-15 14:27 - 2015-03-15 14:43 - 00019715 _____ () C:\Users\guedo\Desktop\gmer.txt
2015-03-15 14:09 - 2015-03-15 14:09 - 00380416 _____ () C:\Users\guedo\Downloads\Gmer-19357.exe
2015-03-15 14:06 - 2015-03-15 14:47 - 00033614 _____ () C:\Users\guedo\Desktop\Addition.txt
2015-03-15 14:02 - 2015-03-16 10:19 - 00000000 ____D () C:\FRST
2015-03-15 14:02 - 2015-03-15 14:47 - 00044204 _____ () C:\Users\guedo\Desktop\FRST.txt
2015-03-15 14:02 - 2015-03-15 14:02 - 02095616 _____ (Farbar) C:\Users\guedo\Downloads\FRST64.exe
2015-03-15 14:00 - 2015-03-15 14:00 - 00000472 _____ () C:\Users\guedo\Desktop\defogger_disable.log
2015-03-15 14:00 - 2015-03-15 14:00 - 00000000 _____ () C:\Users\guedo\defogger_reenable
2015-03-15 13:57 - 2015-03-15 13:57 - 00050477 _____ () C:\Users\guedo\Downloads\Defogger.exe
2015-03-05 15:46 - 2015-03-15 13:52 - 00009431 _____ () C:\Users\guedo\Desktop\Malwarebytes 2015-03-05.txt
2015-03-05 14:49 - 2015-03-16 10:05 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 14:49 - 2015-03-05 14:49 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 14:49 - 2015-03-05 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-05 14:48 - 2015-03-05 14:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-05 14:48 - 2015-03-05 14:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-05 14:48 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 14:48 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 14:48 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 14:37 - 2015-03-16 10:03 - 00001223 _____ () C:\Windows\setupact.log
2015-03-05 14:37 - 2015-03-05 14:37 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-02 17:06 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-03-02 17:06 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-17 15:26 - 2015-02-17 15:26 - 01217184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL
2015-02-16 12:11 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-16 12:11 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-16 12:11 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-16 12:07 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-16 12:07 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-16 12:06 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-16 12:06 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-16 10:11 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-16 10:11 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-16 10:07 - 2013-06-01 20:38 - 02014881 _____ () C:\Windows\WindowsUpdate.log
2015-03-16 10:06 - 2012-06-24 18:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-16 10:03 - 2013-05-23 17:52 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-03-16 10:03 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-16 09:34 - 2012-09-02 13:22 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job
2015-03-15 19:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-03-15 19:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-03-15 18:49 - 2012-06-25 21:50 - 00000000 ____D () C:\Users\guedo\AppData\Local\CrashDumps
2015-03-15 18:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-15 18:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-15 18:36 - 2012-06-01 20:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-15 18:27 - 2011-08-09 21:16 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-03-15 18:27 - 2011-08-09 21:16 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-03-15 18:27 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-15 18:23 - 2015-01-24 17:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-15 18:22 - 2014-05-24 19:01 - 00000000 ____D () C:\Users\guedo\AppData\Local\Audible
2015-03-15 18:22 - 2013-07-09 19:30 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-15 18:07 - 2013-06-26 19:06 - 00347064 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-15 17:27 - 2013-08-14 17:59 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-15 17:27 - 2012-06-24 20:15 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-15 17:12 - 2012-11-27 19:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-15 16:38 - 2009-07-14 03:34 - 00000248 _____ () C:\Windows\system.ini
2015-03-15 15:34 - 2012-09-02 13:22 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job
2015-03-15 14:49 - 2014-05-15 11:29 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForguedo
2015-03-15 14:49 - 2014-05-15 11:29 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForguedo.job
2015-03-15 14:00 - 2012-05-31 20:26 - 00000000 ____D () C:\Users\guedo
2015-03-15 13:52 - 2013-05-09 08:35 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4B85906F-98E1-4B70-9AA7-74C90EFB8482}
2015-03-06 21:20 - 2011-11-07 21:42 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-03-06 21:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-03-02 17:06 - 2013-10-05 15:22 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-02-24 04:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-19 09:49 - 2014-12-13 14:47 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-19 09:49 - 2014-05-06 11:47 - 00000000 ___SD () C:\Windows\system32\CompatTel
==================== Files in the root of some directories =======
2013-06-26 19:07 - 2014-06-29 11:19 - 0003730 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-08-28 07:52 - 2012-08-28 11:09 - 0000021 _____ () C:\Users\guedo\AppData\Roaming\ISOWorkshop.ini
Some content of TEMP:
====================
C:\Users\guedo\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\guedo\AppData\Local\Temp\Quarantine.exe
C:\Users\guedo\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-15 19:28
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by guedo at 2015-03-16 10:21:25
Running from C:\Users\guedo\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1998470398.48.56.35720562 - Audible, Inc.)
Boot Media Builder for Paragon Backup and Recovery™ 11 Home (HKLM-x32\...\{9B5C65EB-A2A6-5DCD-A5BC-53A1895C8204}) (Version: 1.00.0000 - Paragon Software)
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.0.0 - Canon Inc.)
Canon MG3200 series Benutzerregistrierung (HKLM-x32\...\Canon MG3200 series Benutzerregistrierung) (Version: - Canon Inc.)
Canon MG3200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3200_series) (Version: 1.01 - Canon Inc.)
Canon MG3200 series On-screen Manual (HKLM-x32\...\Canon MG3200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
CompuPic (HKLM-x32\...\CompuPic) (Version: - )
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2515 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM-x32\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Download Navigator (HKLM-x32\...\{E728441A-7820-4B1C-87C9-DE7BE37B2953}) (Version: 1.1.0 - SEIKO EPSON CORPORATION)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
FILEminimizer Pictures (HKLM-x32\...\FILEminimizer Pictures_is1) (Version: - balesio AG)
Google Chrome (HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KODAK Create@Home Software (für dm) (HKLM-x32\...\{33D21DE0-8363-4997-A960-E32EA9D84AB3}) (Version: 7.3.4392 - Digilabs)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Medion Home Cinema (HKLM-x32\...\InstallShield_{AB770FDE-8087-4C98-9A85-BD64262C104C}) (Version: 6.0.0000 - CyberLink Corp.)
Medion Home Cinema (x32 Version: 6.0.0000 - CyberLink Corp.) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Netzwerkhandbuch EPSON XP-302 303 305 306 Series (HKLM-x32\...\EPSON XP-302 303 305 306 Series Netg) (Version: - )
Paragon Backup and Recovery™ 11 Home (HKLM-x32\...\{485DF5E7-8379-4BFA-BAE1-9B8DBFE0D6B4}) (Version: 90.00.0003 - Paragon Software)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
PHOTO Evolution PRO (HKLM-x32\...\{4DBEC42D-E6F8-4BC1-A2BD-12D2A6D3F3F3}_is1) (Version: - Franzis Verlag)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 3.02.01.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Reveal 1.2 (HKLM-x32\...\Reveal_1.2) (Version: - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Software Updater (HKLM-x32\...\{A737E18A-5171-40D0-8034-7DD243420081}) (Version: 4.1.1 - SEIKO EPSON CORPORATION)
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.29.0 - Synaptics Incorporated)
Unlocker 1.9.0-x64 (HKLM\...\Unlocker) (Version: 1.9.0 - Cedrick Collomb)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
==================== Restore Points =========================
10-02-2015 13:12:00 Windows Update
16-02-2015 11:58:20 Windows Update
16-02-2015 13:20:02 Windows Update
22-02-2015 14:51:50 Windows Update
02-03-2015 14:27:42 Windows Update
02-03-2015 17:06:22 Windows Update
05-03-2015 14:58:38 Windows Update
15-03-2015 14:35:45 Windows Update
15-03-2015 15:22:32 Revo Uninstaller's restore point - pdfforge Toolbar v11.0
15-03-2015 15:23:15 Removed pdfforge Toolbar v11.0.
15-03-2015 17:21:15 Windows Update
15-03-2015 18:33:00 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2015-03-15 16:38 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0C4AC2AB-F19E-47FA-B0C1-F623AC42A993} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {1FCB485B-F56D-4CF1-B411-72ADEE68CFCB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {3EF895A6-81DE-43C1-8173-1E155D069DC9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {4C08FDCC-2F91-41E6-B58E-C9EE9BD240D0} - System32\Tasks\HPCeeScheduleForguedo => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {4D0F4783-9CF2-4C17-8017-1869B287279D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {570DA36F-EEEC-452C-B015-8A606D008DCB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {60AFA18A-8357-474B-B7C9-42CDF0610AE0} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA => C:\Users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02] (Google Inc.)
Task: {80B59B5A-AA0B-4367-A460-FC4534EA60F5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A4482426-EE58-4DF8-B204-FE513B064F67} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe
Task: {AB288D5C-64BB-44F2-A514-72573254ED0B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core => C:\Users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-02] (Google Inc.)
Task: {BE631227-8CD4-4CDC-8999-EF14D355F7A1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {C7A5B382-369F-4924-9FA1-F7B93F56E3FB} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {CB3F7F4F-5B7B-46EC-BBFF-609BF8F8EC0F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {E9CBC81B-C735-477E-885C-D6BA781FA75A} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job => C:\Users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job => C:\Users\guedo\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForguedo.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) ==============
2012-09-04 11:05 - 2005-03-12 00:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-10-05 15:42 - 2012-03-28 13:49 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2009-11-02 13:20 - 2009-11-02 13:20 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 13:23 - 2009-11-02 13:23 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\guedo\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: ccleaner => "C:\EXTRAS\ccleaner_portable_3.20\CCleaner64.exe" /AUTO
MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: SetDefault => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe
MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-1544451011-3975194477-2784028731-500 - Administrator - Disabled)
Gast (S-1-5-21-1544451011-3975194477-2784028731-501 - Limited - Disabled)
guedo (S-1-5-21-1544451011-3975194477-2784028731-1001 - Administrator - Enabled) => C:\Users\guedo
HomeGroupUser$ (S-1-5-21-1544451011-3975194477-2784028731-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-03-15 16:37:26.954
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-03-15 16:37:25.909
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD E-300 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 31%
Total physical RAM: 3690.91 MB
Available physical RAM: 2546.08 MB
Total Pagefile: 7380 MB
Available Pagefile: 5895.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:278.51 GB) (Free:209.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.42 GB) (Free:1.68 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:3.27 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: F2DC90A7)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=278.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
|
|
16.03.2015, 17:02
| #7 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse VirenfundeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.03.2015, 22:51
| #8 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde Hier die Logfile von ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a9bf696fce0b9d4e97d3ad8e094be898
# engine=22932
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-16 06:38:06
# local_time=2015-03-16 07:38:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 92484 178160936 0 0
# scanned=170657
# found=4
# cleaned=0
# scan_time=7683
sh=3D09B4A1E2E55E7D1DF62B739D434F3F4E51DB90 ft=1 fh=31688d33c108b3f2 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir"
sh=D3D66FD0FABBF8B6ED9B0FAD90984F6E8A856C44 ft=1 fh=ccadf6decbbd9878 vn="Variante von Win32/Toolbar.Widgi.A evtl. unerwünschte Anwendung" ac=I fn="C:\Config.Msi\433e1.rbf"
sh=376985DCFAF5BF1F0819D1C9610C61B730B67FA0 ft=1 fh=1cf58d2f38045666 vn="Variante von Win64/Toolbar.Widgi.B evtl. unerwünschte Anwendung" ac=I fn="C:\Config.Msi\433e2.rbf"
sh=6CF8A9F031B45F70BE3E66E7ACC7449CDA15FA34 ft=1 fh=2de4b6f517306153 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="E:\PDFCreator-1_2_3_setup.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.97
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
JavaFX 2.1.1
Java 8 Update 40
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.305
Adobe Reader 10.1.13 Adobe Reader out of Date!
Mozilla Firefox (36.0.1)
Google Chrome (40.0.2214.115)
Google Chrome (41.0.2272.89)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by guedo (administrator) on GUEDO-HP on 16-03-2015 22:49:16
Running from C:\Users\guedo\Downloads
Loaded Profiles: guedo (Available profiles: guedo)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-26] (Easybits)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\...\RunOnce: [Adobe Speed Launcher] => 1426522211
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://web.de/
HKU\S-1-5-21-1544451011-3975194477-2784028731-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1544451011-3975194477-2784028731-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2012-06-14] (CANON INC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-15] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-15] (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2012-06-14] (CANON INC.)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\guedo\AppData\Roaming\Mozilla\Firefox\Profiles\jitqdoz9.default-1426423934191
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-06] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-06] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-15] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=3 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544451011-3975194477-2784028731-1001: @tools.google.com/Google Update;version=9 -> C:\Users\guedo\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\gcswf32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\guedo\AppData\Local\Google\Chrome\Application\23.0.1271.91\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.0\\npsitesafety.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U7) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.70.10) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\guedo\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-09-02]
CHR Extension: (Google Search) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-09-02]
CHR Extension: (Gmail) - C:\Users\guedo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-09-02]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] ()
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-18] (Siliten)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-08-23] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-08-23] (Paragon)
R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-08-23] (Paragon)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-16 22:37 - 2015-03-16 22:37 - 00852604 _____ () C:\Users\guedo\Downloads\SecurityCheck.exe
2015-03-16 17:12 - 2015-03-16 17:13 - 02347384 _____ (ESET) C:\Users\guedo\Downloads\esetsmartinstaller_deu.exe
2015-03-16 10:31 - 2015-03-16 10:31 - 00001805 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2015-03-16 10:31 - 2015-03-16 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-03-16 10:31 - 2015-03-16 10:31 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2015-03-16 10:21 - 2015-03-16 10:22 - 00022248 _____ () C:\Users\guedo\Downloads\Addition.txt
2015-03-16 10:19 - 2015-03-16 22:49 - 00016245 _____ () C:\Users\guedo\Downloads\FRST.txt
2015-03-16 10:16 - 2015-03-16 10:18 - 00007937 _____ () C:\Users\guedo\Desktop\JRT.txt
2015-03-16 10:06 - 2015-03-16 10:06 - 01388333 _____ (Thisisu) C:\Users\guedo\Downloads\JRT.exe
2015-03-16 10:04 - 2015-03-16 10:04 - 00010922 _____ () C:\Users\guedo\Desktop\AdwCleaner[S0].txt
2015-03-16 09:55 - 2015-03-16 10:00 - 00000000 ____D () C:\AdwCleaner
2015-03-16 09:54 - 2015-03-16 09:54 - 02171392 _____ () C:\Users\guedo\Desktop\AdwCleaner_4.112.exe
2015-03-16 09:53 - 2015-03-16 09:53 - 00001201 _____ () C:\Users\guedo\Desktop\MBAM.txt
2015-03-15 18:32 - 2015-02-03 04:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-15 18:32 - 2015-02-03 04:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-15 18:32 - 2015-02-03 04:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-15 18:32 - 2015-02-03 04:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-15 18:32 - 2015-02-03 04:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-15 18:32 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-15 18:31 - 2015-02-03 04:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-15 18:31 - 2015-02-03 04:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-15 18:31 - 2015-02-03 04:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-15 18:31 - 2015-02-03 04:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-15 18:31 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-15 18:31 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-15 18:31 - 2015-02-03 04:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-15 18:31 - 2015-02-03 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-15 18:31 - 2015-02-03 04:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-15 18:31 - 2015-02-03 04:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-15 18:31 - 2015-02-03 04:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-15 18:31 - 2015-02-03 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-15 18:31 - 2015-02-03 04:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-15 18:31 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-15 18:31 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-15 18:31 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-15 18:31 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-15 18:31 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-15 18:31 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-15 18:31 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-15 18:31 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-15 18:31 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-15 18:31 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-15 18:31 - 2015-02-03 03:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-15 18:31 - 2014-10-31 23:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-15 18:31 - 2014-06-28 01:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-15 18:31 - 2014-06-28 01:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-15 17:55 - 2015-03-15 17:55 - 00009044 _____ () C:\Windows\PFRO.log
2015-03-15 17:11 - 2015-03-15 17:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-15 16:48 - 2015-03-15 16:48 - 00039412 _____ () C:\Users\guedo\Desktop\Combofix.txt
2015-03-15 16:43 - 2015-03-15 16:43 - 00039412 _____ () C:\ComboFix.txt
2015-03-15 15:32 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 15:32 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 15:32 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 15:32 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 15:28 - 2015-03-15 16:43 - 00000000 ____D () C:\Qoobox
2015-03-15 15:27 - 2015-03-15 16:40 - 00000000 ____D () C:\Windows\erdnt
2015-03-15 15:26 - 2015-03-15 15:26 - 05615380 ____R (Swearware) C:\Users\guedo\Desktop\ComboFix.exe
2015-03-15 15:21 - 2015-03-15 15:21 - 00001228 _____ () C:\Users\guedo\Desktop\Revo Uninstaller.lnk
2015-03-15 15:21 - 2015-03-15 15:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-15 15:20 - 2015-03-15 15:20 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\guedo\Downloads\revosetup95.exe
2015-03-15 14:51 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-15 14:51 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-15 14:51 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-03-15 14:51 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-03-15 14:50 - 2015-02-24 04:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-15 14:50 - 2015-02-24 03:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-15 14:50 - 2015-02-21 01:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-15 14:50 - 2015-02-21 01:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-15 14:50 - 2015-02-21 00:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-15 14:50 - 2015-02-20 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-15 14:50 - 2015-02-20 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-15 14:50 - 2015-02-20 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-15 14:50 - 2015-02-20 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-15 14:50 - 2015-02-20 03:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-15 14:50 - 2015-02-20 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-15 14:50 - 2015-02-20 03:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-15 14:50 - 2015-02-20 03:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-15 14:50 - 2015-02-20 03:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-15 14:50 - 2015-02-20 03:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-15 14:50 - 2015-02-20 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-15 14:50 - 2015-02-20 02:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-15 14:50 - 2015-02-20 02:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-15 14:50 - 2015-02-20 01:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-15 14:50 - 2015-02-20 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-15 14:49 - 2015-02-21 02:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-15 14:49 - 2015-02-21 01:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-15 14:49 - 2015-02-21 01:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-15 14:49 - 2015-02-21 00:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-15 14:49 - 2015-02-20 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-15 14:49 - 2015-02-20 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-15 14:49 - 2015-02-20 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-15 14:49 - 2015-02-20 03:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-15 14:49 - 2015-02-20 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-15 14:49 - 2015-02-20 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-15 14:49 - 2015-02-20 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-15 14:49 - 2015-02-20 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-15 14:49 - 2015-02-20 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-15 14:49 - 2015-02-20 03:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-15 14:49 - 2015-02-20 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-15 14:49 - 2015-02-20 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-15 14:49 - 2015-02-20 03:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-15 14:49 - 2015-02-20 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-15 14:49 - 2015-02-20 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-15 14:49 - 2015-02-20 03:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-15 14:49 - 2015-02-20 03:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-15 14:49 - 2015-02-20 02:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-15 14:49 - 2015-02-20 02:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-15 14:49 - 2015-02-20 02:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-15 14:49 - 2015-02-20 02:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-15 14:49 - 2015-02-20 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-15 14:49 - 2015-02-20 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-15 14:49 - 2015-02-20 02:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-15 14:49 - 2015-02-20 02:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-15 14:49 - 2015-02-20 02:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-15 14:49 - 2015-02-20 02:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-15 14:49 - 2015-02-20 02:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-15 14:49 - 2015-02-20 02:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-15 14:49 - 2015-02-20 02:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-15 14:49 - 2015-02-20 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-15 14:49 - 2015-02-20 02:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-15 14:45 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-15 14:45 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-15 14:45 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-15 14:45 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-15 14:45 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-15 14:45 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-15 14:45 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-15 14:45 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-15 14:45 - 2015-01-31 04:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-15 14:45 - 2015-01-31 04:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-15 14:45 - 2015-01-31 00:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-15 14:42 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-15 14:42 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-15 14:42 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-15 14:42 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-15 14:41 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-15 14:41 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-15 14:41 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-15 14:41 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-15 14:41 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-15 14:41 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-15 14:41 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-15 14:41 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-15 14:41 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-15 14:41 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-15 14:41 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-15 14:41 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-15 14:41 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-15 14:41 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-15 14:41 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-15 14:41 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-15 14:40 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-15 14:40 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-15 14:40 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-15 14:40 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-15 14:39 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-15 14:27 - 2015-03-15 14:43 - 00019715 _____ () C:\Users\guedo\Desktop\gmer.txt
2015-03-15 14:09 - 2015-03-15 14:09 - 00380416 _____ () C:\Users\guedo\Downloads\Gmer-19357.exe
2015-03-15 14:06 - 2015-03-15 14:47 - 00033614 _____ () C:\Users\guedo\Desktop\Addition.txt
2015-03-15 14:02 - 2015-03-16 22:49 - 00000000 ____D () C:\FRST
2015-03-15 14:02 - 2015-03-15 14:47 - 00044204 _____ () C:\Users\guedo\Desktop\FRST.txt
2015-03-15 14:02 - 2015-03-15 14:02 - 02095616 _____ (Farbar) C:\Users\guedo\Downloads\FRST64.exe
2015-03-15 14:00 - 2015-03-15 14:00 - 00000472 _____ () C:\Users\guedo\Desktop\defogger_disable.log
2015-03-15 14:00 - 2015-03-15 14:00 - 00000000 _____ () C:\Users\guedo\defogger_reenable
2015-03-15 13:57 - 2015-03-15 13:57 - 00050477 _____ () C:\Users\guedo\Downloads\Defogger.exe
2015-03-05 15:46 - 2015-03-15 13:52 - 00009431 _____ () C:\Users\guedo\Desktop\Malwarebytes 2015-03-05.txt
2015-03-05 14:49 - 2015-03-16 17:10 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 14:49 - 2015-03-05 14:49 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-05 14:49 - 2015-03-05 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-05 14:48 - 2015-03-05 14:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-05 14:48 - 2015-03-05 14:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-05 14:48 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-05 14:48 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-05 14:48 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-05 14:37 - 2015-03-16 17:10 - 00001279 _____ () C:\Windows\setupact.log
2015-03-05 14:37 - 2015-03-05 14:37 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-02 17:06 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-03-02 17:06 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-17 15:26 - 2015-02-17 15:26 - 01217184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL
2015-02-16 12:11 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-16 12:11 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-16 12:11 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-16 12:11 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-16 12:07 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-16 12:07 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-16 12:06 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-16 12:06 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-16 22:34 - 2012-09-02 13:22 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001UA.job
2015-03-16 22:06 - 2012-06-24 18:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-16 21:24 - 2013-06-01 20:38 - 02056042 _____ () C:\Windows\WindowsUpdate.log
2015-03-16 17:17 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-16 17:17 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-16 17:14 - 2013-05-09 08:35 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4B85906F-98E1-4B70-9AA7-74C90EFB8482}
2015-03-16 17:10 - 2013-05-23 17:52 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-03-16 17:10 - 2012-07-22 10:56 - 00000000 ____D () C:\Users\guedo\AppData\Roaming\Apple Computer
2015-03-16 17:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-15 19:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-03-15 19:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-03-15 18:49 - 2012-06-25 21:50 - 00000000 ____D () C:\Users\guedo\AppData\Local\CrashDumps
2015-03-15 18:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-15 18:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-15 18:36 - 2012-06-01 20:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-15 18:27 - 2011-08-09 21:16 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-03-15 18:27 - 2011-08-09 21:16 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-03-15 18:27 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-15 18:23 - 2015-01-24 17:35 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-15 18:22 - 2014-05-24 19:01 - 00000000 ____D () C:\Users\guedo\AppData\Local\Audible
2015-03-15 18:22 - 2013-07-09 19:30 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-15 18:07 - 2013-06-26 19:06 - 00347064 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-15 17:27 - 2013-08-14 17:59 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-15 17:27 - 2012-06-24 20:15 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-15 17:12 - 2012-11-27 19:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-15 16:38 - 2009-07-14 03:34 - 00000248 _____ () C:\Windows\system.ini
2015-03-15 15:34 - 2012-09-02 13:22 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544451011-3975194477-2784028731-1001Core.job
2015-03-15 14:49 - 2014-05-15 11:29 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForguedo
2015-03-15 14:49 - 2014-05-15 11:29 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForguedo.job
2015-03-15 14:00 - 2012-05-31 20:26 - 00000000 ____D () C:\Users\guedo
2015-03-06 21:20 - 2011-11-07 21:42 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-03-06 21:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-03-02 17:06 - 2013-10-05 15:22 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2015-02-24 04:17 - 2010-11-21 04:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-19 09:49 - 2014-12-13 14:47 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-19 09:49 - 2014-05-06 11:47 - 00000000 ___SD () C:\Windows\system32\CompatTel
==================== Files in the root of some directories =======
2013-06-26 19:07 - 2014-06-29 11:19 - 0003730 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-08-28 07:52 - 2012-08-28 11:09 - 0000021 _____ () C:\Users\guedo\AppData\Roaming\ISOWorkshop.ini
Some content of TEMP:
====================
C:\Users\guedo\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\guedo\AppData\Local\Temp\Quarantine.exe
C:\Users\guedo\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-15 19:28
==================== End Of Log ============================
--- --- --- |
|
17.03.2015, 12:33
| #9 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse Virenfunde Java und Adobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\AdwCleaner\Quarantine\C\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir
C:\Config.Msi\433e1.rbf
C:\Config.Msi\433e2.rbf
E:\PDFCreator-1_2_3_setup.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
 Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.03.2015, 12:33
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse Virenfunde Java und Adobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\AdwCleaner\Quarantine\C\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir
C:\Config.Msi\433e1.rbf
C:\Config.Msi\433e2.rbf
E:\PDFCreator-1_2_3_setup.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde: Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst... und/oder das Forum mit einer kleinen Spende unterstützen. Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung: Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional: NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.03.2015, 13:00
| #11 |
| | Windows 7 Home Premium 64bit: diverse VirenfundeCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by guedo at 2015-03-17 12:50:32 Run:1
Running from C:\Users\guedo\Downloads
Loaded Profiles: guedo (Available profiles: guedo)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir
C:\Config.Msi\433e1.rbf
C:\Config.Msi\433e2.rbf
E:\PDFCreator-1_2_3_setup.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
*****************
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe.vir => Moved successfully.
C:\Config.Msi\433e1.rbf => Moved successfully.
C:\Config.Msi\433e2.rbf => Moved successfully.
E:\PDFCreator-1_2_3_setup.exe => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
EmptyTemp: => Removed 203.9 MB temporary data.
The system needed a reboot.
==== End of Fixlog 12:51:01 ====
Der Neustart hat aber leider nicht reibungslos geklappt. Beim Herunterfahren hat der Laptop sich aufgehängt (hat er früher auch schon gemacht) und ich musste kalt starten. Hochfahren hat dann funktioniert. Beiim Neustart über die Funktion "Neustart" hängt er sich immer auf. Beim einfachen Herunterfahren und dann erneuten Einschalten funktioniert alles. Den Cleanup habe ich daher noch nicht durchgeführt. Ist Microsoft Security Essentials ein ausreichender Virenschutz? |
|
17.03.2015, 16:16
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse Virenfunde MSE ist das absolute Minimum, sagen wir mal so. 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.03.2015, 23:05
| #13 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde bei Schritt 1 sieht das Programm bei mir leider anders aus als in deinem Screenshot. Den Button "Do it" habe ich gar nicht .... |
|
18.03.2015, 11:53
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7 Home Premium 64bit: diverse Virenfunde Einfach im Screenshot 1 auf Check klicken.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.03.2015, 12:47
| #15 |
| | Windows 7 Home Premium 64bit: diverse Virenfunde ups ... Danke :-) Hab den Check unter Step 3 durchgeführt. Auch danach erscheint kein "Do it" Button. Hier das Logfile: Code:
ATTFilter Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Alle Rechte vorbehalten.
C:\Users\guedo\Desktop>CD /D C:\
C:\>set path=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
C:\>chkdsk C:
Der Typ des Dateisystems ist NTFS.
Das Volume wird von einem anderen Prozess benutzt. Chkdsk
meldet m”glicherweise Fehler wenn keine Besch„digung vorliegt.
WARNUNG! Der Parameter F wurde nicht angegeben.
CHKDSK wird im schreibgeschtzten Modus ausgefhrt.
CHKDSK berprft Dateien (Phase 1 von 3)...
0 Prozent abgeschlossen. (0 von 207104 Datens„tzen verarbeitet)
0 Prozent abgeschlossen. (19416 von 207104 Datens„tzen verarbeitet)
1 Prozent abgeschlossen. (20711 von 207104 Datens„tzen verarbeitet)
1 Prozent abgeschlossen. (28971 von 207104 Datens„tzen verarbeitet)
1 Prozent abgeschlossen. (38887 von 207104 Datens„tzen verarbeitet)
2 Prozent abgeschlossen. (41421 von 207104 Datens„tzen verarbeitet)
2 Prozent abgeschlossen. (50244 von 207104 Datens„tzen verarbeitet)
3 Prozent abgeschlossen. (62132 von 207104 Datens„tzen verarbeitet)
3 Prozent abgeschlossen. (73189 von 207104 Datens„tzen verarbeitet)
4 Prozent abgeschlossen. (82842 von 207104 Datens„tzen verarbeitet)
5 Prozent abgeschlossen. (103552 von 207104 Datens„tzen verarbeitet)
5 Prozent abgeschlossen. (119221 von 207104 Datens„tzen verarbeitet)
6 Prozent abgeschlossen. (124263 von 207104 Datens„tzen verarbeitet)
6 Prozent abgeschlossen. (139265 von 207104 Datens„tzen verarbeitet)
7 Prozent abgeschlossen. (144973 von 207104 Datens„tzen verarbeitet)
7 Prozent abgeschlossen. (161112 von 207104 Datens„tzen verarbeitet)
8 Prozent abgeschlossen. (165684 von 207104 Datens„tzen verarbeitet)
9 Prozent abgeschlossen. (186394 von 207104 Datens„tzen verarbeitet)
207104 Datens„tze verarbeitet.
Dateiberprfung beendet.
906 groáe Datens„tze verarbeitet.
0 ungltige Datens„tze verarbeitet.
0 E/A-Datens„tze verarbeitet.
75 Analysedatens„tze verarbeitet.
CHKDSK berprft Indizes (Phase 2 von 3)...
11 Prozent abgeschlossen. (4894 von 281940 Indexeintr„gen verarbeitet)
12 Prozent abgeschlossen. (10114 von 281940 Indexeintr„gen verarbeitet)
13 Prozent abgeschlossen. (15334 von 281940 Indexeintr„gen verarbeitet)
14 Prozent abgeschlossen. (20554 von 281940 Indexeintr„gen verarbeitet)
15 Prozent abgeschlossen. (25774 von 281940 Indexeintr„gen verarbeitet)
16 Prozent abgeschlossen. (30994 von 281940 Indexeintr„gen verarbeitet)
17 Prozent abgeschlossen. (36214 von 281940 Indexeintr„gen verarbeitet)
18 Prozent abgeschlossen. (41434 von 281940 Indexeintr„gen verarbeitet)
19 Prozent abgeschlossen. (46654 von 281940 Indexeintr„gen verarbeitet)
20 Prozent abgeschlossen. (51874 von 281940 Indexeintr„gen verarbeitet)
21 Prozent abgeschlossen. (57094 von 281940 Indexeintr„gen verarbeitet)
22 Prozent abgeschlossen. (62314 von 281940 Indexeintr„gen verarbeitet)
23 Prozent abgeschlossen. (67534 von 281940 Indexeintr„gen verarbeitet)
24 Prozent abgeschlossen. (72754 von 281940 Indexeintr„gen verarbeitet)
25 Prozent abgeschlossen. (77974 von 281940 Indexeintr„gen verarbeitet)
26 Prozent abgeschlossen. (83194 von 281940 Indexeintr„gen verarbeitet)
27 Prozent abgeschlossen. (88414 von 281940 Indexeintr„gen verarbeitet)
28 Prozent abgeschlossen. (93634 von 281940 Indexeintr„gen verarbeitet)
29 Prozent abgeschlossen. (98854 von 281940 Indexeintr„gen verarbeitet)
30 Prozent abgeschlossen. (104074 von 281940 Indexeintr„gen verarbeitet)
31 Prozent abgeschlossen. (109294 von 281940 Indexeintr„gen verarbeitet)
32 Prozent abgeschlossen. (114514 von 281940 Indexeintr„gen verarbeitet)
33 Prozent abgeschlossen. (119734 von 281940 Indexeintr„gen verarbeitet)
34 Prozent abgeschlossen. (124954 von 281940 Indexeintr„gen verarbeitet)
35 Prozent abgeschlossen. (130174 von 281940 Indexeintr„gen verarbeitet)
36 Prozent abgeschlossen. (135394 von 281940 Indexeintr„gen verarbeitet)
37 Prozent abgeschlossen. (140614 von 281940 Indexeintr„gen verarbeitet)
38 Prozent abgeschlossen. (145834 von 281940 Indexeintr„gen verarbeitet)
39 Prozent abgeschlossen. (151054 von 281940 Indexeintr„gen verarbeitet)
40 Prozent abgeschlossen. (156274 von 281940 Indexeintr„gen verarbeitet)
41 Prozent abgeschlossen. (161494 von 281940 Indexeintr„gen verarbeitet)
42 Prozent abgeschlossen. (166714 von 281940 Indexeintr„gen verarbeitet)
43 Prozent abgeschlossen. (171934 von 281940 Indexeintr„gen verarbeitet)
44 Prozent abgeschlossen. (177154 von 281940 Indexeintr„gen verarbeitet)
45 Prozent abgeschlossen. (182374 von 281940 Indexeintr„gen verarbeitet)
46 Prozent abgeschlossen. (187594 von 281940 Indexeintr„gen verarbeitet)
47 Prozent abgeschlossen. (192814 von 281940 Indexeintr„gen verarbeitet)
48 Prozent abgeschlossen. (198034 von 281940 Indexeintr„gen verarbeitet)
49 Prozent abgeschlossen. (203255 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (208475 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (208842 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (210093 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (210463 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (210787 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (211005 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (211465 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (211979 von 281940 Indexeintr„gen verarbeitet)
50 Prozent abgeschlossen. (213175 von 281940 Indexeintr„gen verarbeitet)
Der Indexeintrag "CHKDSK.EXE-496676BC.pf" im Index "$I30" der Datei "9968" ist falsch.
Der Indexeintrag "CHKDSK~1.PF" im Index "$I30" der Datei "9968" ist falsch.
50 Prozent abgeschlossen. (213636 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (213695 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (214291 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (214875 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (215121 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (216526 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (218066 von 281940 Indexeintr„gen verarbeitet)
51 Prozent abgeschlossen. (218630 von 281940 Indexeintr„gen verarbeitet)
52 Prozent abgeschlossen. (218915 von 281940 Indexeintr„gen verarbeitet)
52 Prozent abgeschlossen. (219757 von 281940 Indexeintr„gen verarbeitet)
52 Prozent abgeschlossen. (220903 von 281940 Indexeintr„gen verarbeitet)
52 Prozent abgeschlossen. (221867 von 281940 Indexeintr„gen verarbeitet)
52 Prozent abgeschlossen. (222973 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (224135 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (225094 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (226137 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (226676 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (226916 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (227349 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (227424 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (227689 von 281940 Indexeintr„gen verarbeitet)
53 Prozent abgeschlossen. (228380 von 281940 Indexeintr„gen verarbeitet)
Der Indexeintrag "prefs.js" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "sessionCheckpoints.json" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "sessionstore.js" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "SESSIO~1.JS" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "SESSIO~1.JS~" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "xulstore.json" im Index "$I30" der Datei "87723" ist falsch.
Der Indexeintrag "XULSTO~1.JS~" im Index "$I30" der Datei "87723" ist falsch.
53 Prozent abgeschlossen. (228779 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (229355 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (230236 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (230744 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (231214 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (231652 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (232522 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (232764 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (233068 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (233848 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (234104 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (234289 von 281940 Indexeintr„gen verarbeitet)
54 Prozent abgeschlossen. (234471 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (234575 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (234937 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (235332 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (235857 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (236736 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (237996 von 281940 Indexeintr„gen verarbeitet)
55 Prozent abgeschlossen. (238706 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (239795 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (240253 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (240520 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (241184 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (242802 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (242992 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (243430 von 281940 Indexeintr„gen verarbeitet)
56 Prozent abgeschlossen. (244045 von 281940 Indexeintr„gen verarbeitet)
281940 Indexeintr„ge verarbeitet.
Indexberprfung beendet.
Fehler gefunden. CHKDSK kann im schreibgeschtzten Modus nicht
fortgesetzt werden.
C:\>
|
|
| Themen zu Windows 7 Home Premium 64bit: diverse Virenfunde |
| csrss.exe, dllhost.exe, explorer.exe, fehlercode 0x5, fehlercode 0xc0000005, logfiles, lsass.exe, microsoft, neustart, pdfforge toolbar v11.0 entfernen, programm, prozesse, pup.optional.spigot.a, registry, services.exe, software, svchost.exe, tr/drop.softomat.an, win32/toolbar.widgi, win32/toolbar.widgi.a, win64/toolbar.widgi.b, winlogon.exe |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
