| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: IE lässt sich nicht updaten, Defender wird blockiertWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.03.2015, 10:38
| #11 |
 |  IE lässt sich nicht updaten, Defender wird blockiert Hallo Schrauber Eset-online-scanner hatte zwei Bedrohungen gefunden, ich bin nicht sicher ob diese auch entfernt wurden. Oder kann ESET gar nich bereinigen? Hier die Log von ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c7733ed7ddfa1541b1cceb8aa368a405
# engine=23019
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-22 12:14:48
# local_time=2015-03-22 01:14:48 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 143614 264516016 0 0
# scanned=257130
# found=2
# cleaned=0
# scan_time=10995
sh=19A86F0DEBB54A4C068A27E7A403178A174B5E9A ft=0 fh=0000000000000000 vn="Win32/Packed.VMProtect.D Trojaner" ac=I fn="C:\Stefan Spiele\Anno.1404.Venedig.GERMAN-0x0007\de-a14v.iso"
sh=58FD5BFD5621171F4F1C69389E3ACA9BC3C80F64 ft=1 fh=ee2985aba3d07ac3 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AEUTJE3\SkywalkerSetup[1].exe"
Hier die nächsten Logs. SecurityCheck: Code:
ATTFilter Results of screen317's Security Check version 0.99.97
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Java DB 10.5.3.0
Java(TM) 6 Update 38
Java-Editor 9.15d, 2010.09.28
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.305
Adobe Reader 10.1.13 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
Google Chrome (41.0.2272.101)
Google Chrome (41.0.2272.89)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Patrick (administrator) on PATRICK-PC on 22-03-2015 10:24:12
Running from C:\Users\Patrick\Desktop
Loaded Profiles: Patrick (Available profiles: Patrick)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\BASVC.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(AlcorMicro Co., Ltd.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\PdtWzd.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor Corp.) C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Acer Corp.) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_16_0_0_305_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ArcadeDeluxeAgent] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2008-10-24] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6957600 2009-03-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-09-05] ()
HKLM\...\Run: [VitaKeyPdtWzd] => c:\Program Files\Acer Bio Protection\PdtWzd.exe [3549696 2009-02-13] (Egis Technology Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [870920 2009-02-24] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] => C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] => C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [173288 2008-12-26] (Acer Corp.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [413696 2009-01-22] (Acer)
Lsa: [Notification Packages] c:\Program Files\Acer Bio Protection\PwdFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
DPF: {538793D5-659C-4639-A56C-A179AD87ED44} https://rz-asa.hs-ulm.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-09] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll [2008-07-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default
FF DefaultSearchUrl:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-11] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 -> C:\Windows\system32\npdeployJava1.dll [2012-11-14] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-360123627-3130887994-3134240397-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-20] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\searchplugins\keepmysearch.xml [2014-06-28]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Snap.Do - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
FF Extension: Greasemonkey - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-28]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-30]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-06-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2013-01-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-17]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com [Not Found]
Chrome:
=======
CHR HomePage: Default ->
CHR RestoreOnStartup: Default -> "hxxp://start.iminent.com/?appId=A455CC52-8EFB-4ED3-AA1E-20EE9CD10917"
CHR DefaultSearchKeyword: Default -> start.iminent.com
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-20]
CHR Extension: (Google Search) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-20]
CHR Extension: (Avira Browser Safety) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-21]
CHR Extension: (Gmail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [860160 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 IGBASVC; c:\Program Files\Acer Bio Protection\BASVC.exe [3440640 2009-02-13] (Egis Technology Inc.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-12-18] ()
R2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated) [File not signed]
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2010-03-17] (SolidWorks) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [38440 2012-06-07] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [57256 2012-06-07] (Cisco Systems, Inc.)
R0 AlfaFF; C:\Windows\System32\drivers\AlfaFF.sys [42608 2009-02-13] (Alfa Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-17] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-02-25] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R1 ElRawDisk; C:\Windows\system32\drivers\dddsk.sys [22312 2009-02-12] (EldoS Corporation)
R2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [26928 2008-12-24] (Egis)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; c:\Windows\system32\drivers\int15.sys [69632 2009-02-13] () [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-17] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-12-17] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-02-25] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Patrick\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-22 10:24 - 2015-03-22 10:24 - 00021363 _____ () C:\Users\Patrick\Desktop\FRST.txt
2015-03-22 10:22 - 2015-03-22 10:22 - 00001171 _____ () C:\Users\Patrick\Desktop\checkup.txt
2015-03-22 10:12 - 2015-03-22 10:12 - 00852604 _____ () C:\Users\Patrick\Desktop\SecurityCheck.exe
2015-03-21 22:06 - 2015-03-21 22:06 - 02347384 _____ (ESET) C:\Users\Patrick\Desktop\esetsmartinstaller_deu.exe
2015-03-21 11:47 - 2015-03-21 11:48 - 00041429 _____ () C:\Users\Patrick\Desktop\2.FRST.txt
2015-03-21 11:42 - 2015-03-21 11:42 - 00000636 _____ () C:\Users\Patrick\Desktop\JRT.txt
2015-03-21 11:37 - 2015-03-21 11:37 - 01388672 _____ (Thisisu) C:\Users\Patrick\Desktop\JRT.exe
2015-03-21 11:30 - 2015-03-21 11:23 - 00001100 _____ () C:\Users\Patrick\Desktop\AdwCleaner[S3].txt
2015-03-21 11:13 - 2015-03-21 11:23 - 00000000 ____D () C:\AdwCleaner
2015-03-21 11:11 - 2015-03-21 11:11 - 02171392 _____ () C:\Users\Patrick\Desktop\AdwCleaner_4.112.exe
2015-03-21 11:09 - 2015-03-21 11:09 - 00001573 _____ () C:\Users\Patrick\Desktop\mbam.txt
2015-03-21 10:32 - 2015-03-21 10:32 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-03-21 10:32 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-21 10:32 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-21 10:30 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-21 10:28 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-20 08:30 - 2015-03-20 08:30 - 00011532 _____ () C:\Users\Patrick\Desktop\ComboFix.txt
2015-03-20 08:14 - 2015-03-20 08:30 - 00000000 ____D () C:\ComboFix
2015-03-20 08:10 - 2015-03-20 08:10 - 05615380 ____R (Swearware) C:\Users\Patrick\Desktop\ComboFix.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 12375040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-03-19 12:15 - 2015-03-19 12:15 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-19 12:15 - 2015-03-19 12:15 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-19 12:15 - 2015-03-19 12:15 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-19 12:15 - 2015-03-19 12:15 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-03-19 12:15 - 2015-03-19 12:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-19 11:41 - 2015-03-19 11:41 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Patrick\Desktop\tdsskiller.exe
2015-03-19 11:04 - 2015-03-21 10:34 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-19 11:04 - 2015-03-19 11:35 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-19 11:02 - 2015-03-19 11:37 - 00000000 ____D () C:\Users\Patrick\Desktop\mbar
2015-03-19 11:02 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-19 10:58 - 2015-03-19 10:58 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Patrick\Desktop\mbar-1.09.1.1004.exe
2015-03-19 10:48 - 2015-03-19 10:48 - 00001061 _____ () C:\Users\Patrick\Desktop\Revo Uninstaller.lnk
2015-03-19 10:48 - 2015-03-19 10:48 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-03-19 10:40 - 2015-03-19 10:35 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Patrick\Desktop\revosetup95.exe
2015-03-18 17:36 - 2015-03-18 19:18 - 00043637 _____ () C:\Users\Patrick\Desktop\Addition.txt
2015-03-18 17:36 - 2015-03-18 17:36 - 00033280 _____ () C:\Users\Patrick\Desktop\1.FRST.txt
2015-03-18 17:35 - 2015-03-22 10:24 - 00000000 ____D () C:\FRST
2015-03-18 17:34 - 2015-03-18 17:34 - 01135104 _____ (Farbar) C:\Users\Patrick\Desktop\FRST.exe
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Intel
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Common Files\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Cisco
2015-03-18 13:34 - 2015-03-18 13:34 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-03-16 18:14 - 2015-03-16 18:14 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Avira
2015-03-16 18:13 - 2015-03-16 18:13 - 00001851 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-03-16 18:13 - 2015-03-16 18:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-16 18:12 - 2015-02-25 17:54 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-03-16 18:07 - 2015-03-16 18:08 - 163016912 _____ () C:\Users\Patrick\Downloads\avira_free650_antivirus_de.exe
2015-03-16 18:02 - 2015-02-24 04:23 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-15 20:12 - 2015-03-20 08:30 - 00000000 ____D () C:\Qoobox
2015-03-15 20:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 20:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 20:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 20:11 - 2015-03-15 20:34 - 00000000 ____D () C:\Windows\erdnt
2015-03-14 13:46 - 2015-03-19 11:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-14 11:50 - 2015-01-29 02:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-14 11:49 - 2015-01-29 02:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-14 11:47 - 2015-02-26 01:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-14 11:35 - 2015-02-20 03:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-14 11:35 - 2015-02-20 01:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-14 11:34 - 2015-02-26 03:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-14 11:34 - 2015-02-26 03:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-14 11:34 - 2015-01-21 03:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-14 11:34 - 2015-01-09 03:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-14 11:34 - 2015-01-09 01:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-14 11:33 - 2015-03-06 05:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-14 11:32 - 2015-02-18 03:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-14 11:32 - 2014-10-13 02:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-22 10:13 - 2010-03-17 10:18 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-22 10:01 - 2012-12-27 17:33 - 00000260 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2015-03-22 10:01 - 2009-09-05 16:39 - 01402652 _____ () C:\Windows\WindowsUpdate.log
2015-03-22 10:01 - 2006-11-02 11:33 - 01597796 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-22 09:59 - 2014-09-20 14:30 - 00000000 ____D () C:\ProgramData\Origin
2015-03-22 09:54 - 2012-07-11 12:20 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-03-22 09:54 - 2010-03-17 10:18 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-22 09:54 - 2009-09-05 16:48 - 00220268 _____ () C:\ProgramData\nvModes.001
2015-03-22 09:54 - 2009-09-05 16:47 - 00220268 _____ () C:\ProgramData\nvModes.dat
2015-03-22 09:54 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-22 09:54 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-22 09:54 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-22 01:15 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-22 00:43 - 2012-04-04 06:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-21 11:24 - 2008-01-21 03:47 - 01095982 _____ () C:\Windows\PFRO.log
2015-03-21 11:14 - 2013-02-20 12:42 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-20 19:59 - 2014-09-20 13:47 - 00000000 ____D () C:\Users\Patrick\Documents\Settlers7
2015-03-20 19:58 - 2009-12-16 09:42 - 00000000 ____D () C:\Program Files\OpenOffice.org 3
2015-03-20 19:57 - 2009-12-16 09:43 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.1
2015-03-20 19:37 - 2012-12-27 17:28 - 00000000 ____D () C:\Users\Patrick\AppData\Local\HP
2015-03-20 19:37 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\twain_32
2015-03-20 08:28 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2015-03-20 08:12 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ___RD () C:\Windows\Offline Web Pages
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-03-19 12:15 - 2011-05-18 06:54 - 00014861 _____ () C:\Windows\IE9_main.log
2015-03-19 12:15 - 2006-11-02 07:32 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2015-03-19 12:15 - 2006-11-02 07:32 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2015-03-18 14:03 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-03-18 13:51 - 2009-10-24 16:19 - 00000000 ____D () C:\Users\Patrick
2015-03-18 13:51 - 2009-09-05 16:54 - 00014358 _____ () C:\Windows\DPINST.LOG
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2015-03-18 13:49 - 2009-02-11 21:12 - 00000000 ____D () C:\Program Files\Intel
2015-03-18 13:38 - 2009-11-24 19:09 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Microsoft Help
2015-03-16 18:23 - 2009-03-12 04:26 - 00000000 ____D () C:\ProgramData\Temp
2015-03-16 18:12 - 2013-08-08 23:03 - 00000000 ____D () C:\Program Files\Avira
2015-03-16 18:04 - 2010-03-21 11:47 - 00007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2015-03-16 17:51 - 2012-01-05 16:31 - 00000000 ____D () C:\ProgramData\Avira
2015-03-16 12:32 - 2014-07-20 22:54 - 00000000 ____D () C:\Windows\system32\mjcm
2015-03-16 10:29 - 2009-10-24 16:20 - 00000000 ____D () C:\Program Files\Google
2015-03-15 21:10 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2015-03-15 21:01 - 2009-12-16 09:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\ProgramData\Google
2015-03-15 20:53 - 2013-11-09 13:38 - 00000901 _____ () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-15 10:00 - 2006-11-02 13:52 - 00168874 _____ () C:\Windows\setupact.log
2015-03-15 08:38 - 2012-06-16 15:55 - 00000000 ____D () C:\Users\Patrick\Tracing
2015-03-14 12:56 - 2006-11-02 13:47 - 00396760 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-14 11:50 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-14 11:47 - 2013-08-14 13:28 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-14 11:37 - 2006-11-02 11:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-03-08 16:20 - 2010-03-10 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PokerStars.NET
2015-03-08 16:19 - 2010-03-10 13:43 - 00000000 ____D () C:\Program Files\PokerStars.NET
2015-02-27 10:23 - 2014-09-20 14:30 - 00000000 ____D () C:\Program Files\Origin
2015-02-22 11:25 - 2010-03-31 08:38 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\vlc
==================== Files in the root of some directories =======
2015-02-11 23:03 - 2015-02-11 23:03 - 6103040 _____ () C:\Program Files\GUT21F3.tmp
2009-12-18 10:53 - 2009-12-18 10:53 - 0139152 _____ () C:\Users\Patrick\AppData\Roaming\PnkBstrK.sys
2013-10-14 19:02 - 2013-10-14 19:02 - 0023888 _____ () C:\Users\Patrick\AppData\Roaming\UserTile.png
2009-10-24 16:28 - 2013-01-02 09:38 - 0000232 _____ () C:\Users\Patrick\AppData\Roaming\wklnhst.dat
2010-03-21 11:47 - 2015-03-16 18:04 - 0007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2009-12-18 11:31 - 2014-10-10 21:14 - 0012288 _____ () C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-02-28 18:24 - 2012-12-27 00:03 - 0000000 _____ () C:\Users\Patrick\AppData\Local\Temptable.xml
2011-01-11 11:35 - 2012-12-27 00:16 - 0018052 _____ () C:\Users\Patrick\AppData\Local\Temp_table.xml
2012-12-27 17:29 - 2012-12-27 17:29 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-03-12 04:26 - 2009-09-05 17:02 - 0004789 _____ () C:\ProgramData\ArcadeDeluxe2.log
2009-09-05 16:48 - 2015-03-22 09:54 - 0220268 _____ () C:\ProgramData\nvModes.001
2009-09-05 16:47 - 2015-03-22 09:54 - 0220268 _____ () C:\ProgramData\nvModes.dat
Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\temp\avgnt.exe
C:\Users\Patrick\AppData\Local\temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
C:\Users\Patrick\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-22 10:01
==================== End Of Log ============================
--- --- --- |
| Themen zu IE lässt sich nicht updaten, Defender wird blockiert |
| ausgeführt, avira, beim starten, blockiert, defender, deinstallieren, entfernt, funktioniert, gestartet, hoffe, installiert, laptop, mbam, meldung, neu, neuinstallation, neuinstallieren, probleme, schei, seite, seiten, starte, starten, update, updaten |
Baum-Darstellung