| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java TernewbWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
28.03.2015, 02:09
| #1 |
 |  Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Hallo Trojanerboard! Ich habe auf meine Rechner anscheinend schädliches Zeug. Ich würde ja gerne den Avira Log posten, der die 4-8 Viren gefunden hat, allerdings taucht er leider nicht auf, egal wo ich bei Avira suche, außer er ist das hier, aber es sieht irgendwie nicht komplett aus. Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 24. März 2015 18:35
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : demax.yusuf
Computername : DEMAXYUSUF-PC
Versionsinformationen:
BUILD.DAT : 15.0.8.656 91858 Bytes 17.03.2015 13:02:00
AVSCAN.EXE : 15.0.8.652 1014064 Bytes 22.03.2015 20:28:53
AVSCANRC.DLL : 15.0.8.652 63792 Bytes 22.03.2015 20:28:54
LUKE.DLL : 15.0.8.652 60664 Bytes 22.03.2015 20:29:13
AVSCPLR.DLL : 15.0.8.652 93488 Bytes 22.03.2015 20:28:54
REPAIR.DLL : 15.0.8.652 365360 Bytes 22.03.2015 20:28:52
REPAIR.RDF : 1.0.6.82 824582 Bytes 24.03.2015 17:33:47
AVREG.DLL : 15.0.8.652 265464 Bytes 22.03.2015 20:28:52
AVLODE.DLL : 15.0.8.656 645368 Bytes 22.03.2015 20:28:51
AVLODE.RDF : 14.0.4.54 78895 Bytes 10.12.2014 16:43:24
XBV00017.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:36
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:36
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:36
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00223.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00224.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00225.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00226.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00227.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00228.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00229.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00230.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00231.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00232.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00233.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00234.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00235.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00236.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00237.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00238.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00239.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00240.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:00
XBV00241.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00242.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00243.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00244.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00245.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00246.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00247.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00248.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00249.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00250.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00251.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00252.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00253.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00254.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00255.VDF : 8.11.213.176 2048 Bytes 05.03.2015 17:25:01
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:46:18
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 22:53:19
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 17:50:34
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 09:59:04
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 09:26:42
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 17:36:48
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 15:42:20
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 16:08:30
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 18:21:36
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 12:50:22
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14.10.2014 16:13:10
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11.11.2014 22:30:56
XBV00012.VDF : 8.11.190.32 1876992 Bytes 03.12.2014 16:43:25
XBV00013.VDF : 8.11.201.28 2973696 Bytes 14.01.2015 03:31:56
XBV00014.VDF : 8.11.206.252 2695680 Bytes 04.02.2015 20:02:07
XBV00015.VDF : 8.11.213.84 3175936 Bytes 03.03.2015 19:33:14
XBV00016.VDF : 8.11.213.176 212480 Bytes 05.03.2015 17:24:55
XBV00042.VDF : 8.11.213.202 3584 Bytes 05.03.2015 17:24:55
XBV00043.VDF : 8.11.213.204 2048 Bytes 05.03.2015 17:24:55
XBV00044.VDF : 8.11.213.230 40960 Bytes 05.03.2015 17:24:55
XBV00045.VDF : 8.11.214.2 29184 Bytes 05.03.2015 17:24:55
XBV00046.VDF : 8.11.214.28 25088 Bytes 05.03.2015 17:24:56
XBV00047.VDF : 8.11.214.30 14848 Bytes 05.03.2015 17:24:56
XBV00048.VDF : 8.11.214.32 3072 Bytes 05.03.2015 17:24:56
XBV00049.VDF : 8.11.214.34 2048 Bytes 06.03.2015 17:24:56
XBV00050.VDF : 8.11.214.38 39424 Bytes 06.03.2015 17:24:56
XBV00051.VDF : 8.11.214.40 6656 Bytes 06.03.2015 17:24:56
XBV00052.VDF : 8.11.214.42 4608 Bytes 06.03.2015 17:24:56
XBV00053.VDF : 8.11.214.44 5120 Bytes 06.03.2015 17:24:56
XBV00054.VDF : 8.11.214.46 23552 Bytes 06.03.2015 17:24:56
XBV00055.VDF : 8.11.214.48 3072 Bytes 06.03.2015 17:24:56
XBV00056.VDF : 8.11.214.50 25600 Bytes 06.03.2015 17:24:56
XBV00057.VDF : 8.11.214.72 2048 Bytes 06.03.2015 17:24:56
XBV00058.VDF : 8.11.214.92 48128 Bytes 06.03.2015 17:24:56
XBV00059.VDF : 8.11.214.112 12800 Bytes 06.03.2015 22:46:49
XBV00060.VDF : 8.11.214.114 2560 Bytes 06.03.2015 22:46:49
XBV00061.VDF : 8.11.214.136 32256 Bytes 06.03.2015 22:46:49
XBV00062.VDF : 8.11.214.138 2048 Bytes 06.03.2015 22:46:49
XBV00063.VDF : 8.11.214.140 2048 Bytes 07.03.2015 22:46:49
XBV00064.VDF : 8.11.214.144 34304 Bytes 07.03.2015 22:46:49
XBV00065.VDF : 8.11.214.146 2048 Bytes 07.03.2015 22:46:49
XBV00066.VDF : 8.11.214.168 33792 Bytes 07.03.2015 22:46:49
XBV00067.VDF : 8.11.214.188 71168 Bytes 08.03.2015 22:46:49
XBV00068.VDF : 8.11.214.190 2048 Bytes 08.03.2015 22:46:49
XBV00069.VDF : 8.11.214.192 2048 Bytes 08.03.2015 22:46:49
XBV00070.VDF : 8.11.214.212 2048 Bytes 08.03.2015 22:46:49
XBV00071.VDF : 8.11.214.232 28672 Bytes 08.03.2015 22:46:49
XBV00072.VDF : 8.11.214.252 69120 Bytes 09.03.2015 20:29:20
XBV00073.VDF : 8.11.215.14 3584 Bytes 09.03.2015 20:29:20
XBV00074.VDF : 8.11.215.32 7168 Bytes 09.03.2015 20:29:20
XBV00075.VDF : 8.11.215.50 12800 Bytes 09.03.2015 20:29:20
XBV00076.VDF : 8.11.215.52 5120 Bytes 09.03.2015 20:29:21
XBV00077.VDF : 8.11.215.70 17920 Bytes 09.03.2015 20:29:21
XBV00078.VDF : 8.11.215.90 2048 Bytes 09.03.2015 20:29:22
XBV00079.VDF : 8.11.215.110 2048 Bytes 09.03.2015 20:29:22
XBV00080.VDF : 8.11.215.132 29696 Bytes 09.03.2015 20:29:22
XBV00081.VDF : 8.11.215.134 11264 Bytes 09.03.2015 20:29:22
XBV00082.VDF : 8.11.215.136 11264 Bytes 09.03.2015 20:29:22
XBV00083.VDF : 8.11.215.138 12288 Bytes 10.03.2015 20:29:23
XBV00084.VDF : 8.11.215.140 35840 Bytes 10.03.2015 20:29:23
XBV00085.VDF : 8.11.215.158 6144 Bytes 10.03.2015 20:29:23
XBV00086.VDF : 8.11.215.174 5632 Bytes 10.03.2015 20:29:23
XBV00087.VDF : 8.11.215.190 8704 Bytes 10.03.2015 20:29:23
XBV00088.VDF : 8.11.215.206 19968 Bytes 10.03.2015 20:29:23
XBV00089.VDF : 8.11.215.222 12800 Bytes 10.03.2015 20:29:24
XBV00090.VDF : 8.11.215.226 2048 Bytes 10.03.2015 20:29:24
XBV00091.VDF : 8.11.215.230 14336 Bytes 10.03.2015 20:29:24
XBV00092.VDF : 8.11.215.234 26112 Bytes 10.03.2015 20:29:24
XBV00093.VDF : 8.11.215.236 11776 Bytes 10.03.2015 20:29:24
XBV00094.VDF : 8.11.215.240 22016 Bytes 11.03.2015 20:29:25
XBV00095.VDF : 8.11.215.242 2048 Bytes 11.03.2015 20:29:25
XBV00096.VDF : 8.11.215.244 2048 Bytes 11.03.2015 20:29:25
XBV00097.VDF : 8.11.216.4 7680 Bytes 11.03.2015 20:29:25
XBV00098.VDF : 8.11.216.20 12800 Bytes 11.03.2015 20:29:25
XBV00099.VDF : 8.11.216.36 19968 Bytes 11.03.2015 20:29:25
XBV00100.VDF : 8.11.216.52 2560 Bytes 11.03.2015 20:29:25
XBV00101.VDF : 8.11.216.54 22016 Bytes 11.03.2015 20:29:26
XBV00102.VDF : 8.11.216.56 8192 Bytes 11.03.2015 20:29:26
XBV00103.VDF : 8.11.216.58 4608 Bytes 11.03.2015 20:29:26
XBV00104.VDF : 8.11.216.60 16896 Bytes 11.03.2015 20:29:26
XBV00105.VDF : 8.11.216.76 14336 Bytes 11.03.2015 20:29:26
XBV00106.VDF : 8.11.216.90 30208 Bytes 11.03.2015 20:29:26
XBV00107.VDF : 8.11.216.104 5632 Bytes 12.03.2015 20:29:27
XBV00108.VDF : 8.11.216.118 6656 Bytes 12.03.2015 20:29:27
XBV00109.VDF : 8.11.216.120 24576 Bytes 12.03.2015 20:29:27
XBV00110.VDF : 8.11.216.122 16896 Bytes 12.03.2015 20:29:27
XBV00111.VDF : 8.11.216.124 2048 Bytes 12.03.2015 20:29:27
XBV00112.VDF : 8.11.216.138 16896 Bytes 12.03.2015 20:29:27
XBV00113.VDF : 8.11.216.140 2048 Bytes 12.03.2015 20:29:27
XBV00114.VDF : 8.11.216.154 3584 Bytes 12.03.2015 20:29:28
XBV00115.VDF : 8.11.216.168 2048 Bytes 12.03.2015 20:29:28
XBV00116.VDF : 8.11.216.182 70144 Bytes 12.03.2015 20:29:28
XBV00117.VDF : 8.11.216.196 2048 Bytes 13.03.2015 20:29:28
XBV00118.VDF : 8.11.216.200 46080 Bytes 13.03.2015 20:29:28
XBV00119.VDF : 8.11.216.214 11776 Bytes 13.03.2015 20:29:29
XBV00120.VDF : 8.11.216.228 4096 Bytes 13.03.2015 20:29:29
XBV00121.VDF : 8.11.216.242 2560 Bytes 13.03.2015 20:29:29
XBV00122.VDF : 8.11.216.254 2560 Bytes 13.03.2015 20:29:29
XBV00123.VDF : 8.11.217.10 7680 Bytes 13.03.2015 20:29:29
XBV00124.VDF : 8.11.217.14 2048 Bytes 13.03.2015 20:29:29
XBV00125.VDF : 8.11.217.16 24576 Bytes 13.03.2015 20:29:29
XBV00126.VDF : 8.11.217.22 17408 Bytes 13.03.2015 20:29:29
XBV00127.VDF : 8.11.217.24 2048 Bytes 13.03.2015 20:29:29
XBV00128.VDF : 8.11.217.26 2048 Bytes 13.03.2015 20:29:29
XBV00129.VDF : 8.11.217.28 15872 Bytes 13.03.2015 20:29:29
XBV00130.VDF : 8.11.217.42 84480 Bytes 14.03.2015 20:29:30
XBV00131.VDF : 8.11.217.54 2048 Bytes 14.03.2015 20:29:30
XBV00132.VDF : 8.11.217.66 2048 Bytes 14.03.2015 20:29:30
XBV00133.VDF : 8.11.217.78 19456 Bytes 14.03.2015 20:29:30
XBV00134.VDF : 8.11.217.90 71680 Bytes 15.03.2015 20:29:30
XBV00135.VDF : 8.11.217.102 2048 Bytes 15.03.2015 20:29:30
XBV00136.VDF : 8.11.217.124 6656 Bytes 15.03.2015 20:29:30
XBV00137.VDF : 8.11.217.136 76800 Bytes 16.03.2015 20:29:30
XBV00138.VDF : 8.11.217.146 3584 Bytes 16.03.2015 20:29:30
XBV00139.VDF : 8.11.217.156 3584 Bytes 16.03.2015 20:29:30
XBV00140.VDF : 8.11.217.166 4096 Bytes 16.03.2015 20:29:31
XBV00141.VDF : 8.11.217.176 12288 Bytes 16.03.2015 20:29:31
XBV00142.VDF : 8.11.217.186 13312 Bytes 16.03.2015 20:29:31
XBV00143.VDF : 8.11.217.188 24064 Bytes 16.03.2015 20:29:31
XBV00144.VDF : 8.11.217.194 7680 Bytes 16.03.2015 20:29:31
XBV00145.VDF : 8.11.217.198 31232 Bytes 16.03.2015 20:29:31
XBV00146.VDF : 8.11.217.208 13824 Bytes 16.03.2015 20:29:31
XBV00147.VDF : 8.11.217.216 7680 Bytes 16.03.2015 20:29:31
XBV00148.VDF : 8.11.217.224 2048 Bytes 17.03.2015 20:29:31
XBV00149.VDF : 8.11.217.232 23552 Bytes 17.03.2015 20:29:32
XBV00150.VDF : 8.11.217.240 7168 Bytes 17.03.2015 20:29:32
XBV00151.VDF : 8.11.217.242 9216 Bytes 17.03.2015 20:29:32
XBV00152.VDF : 8.11.217.244 13824 Bytes 17.03.2015 20:29:32
XBV00153.VDF : 8.11.217.252 4608 Bytes 17.03.2015 20:29:32
XBV00154.VDF : 8.11.218.4 10240 Bytes 17.03.2015 20:29:33
XBV00155.VDF : 8.11.218.6 12800 Bytes 17.03.2015 20:29:33
XBV00156.VDF : 8.11.218.16 14848 Bytes 17.03.2015 20:29:33
XBV00157.VDF : 8.11.218.20 2048 Bytes 17.03.2015 20:29:33
XBV00158.VDF : 8.11.218.28 4096 Bytes 17.03.2015 20:29:33
XBV00159.VDF : 8.11.218.30 25600 Bytes 17.03.2015 20:29:33
XBV00160.VDF : 8.11.218.32 2048 Bytes 17.03.2015 20:29:33
XBV00161.VDF : 8.11.218.34 18432 Bytes 17.03.2015 20:29:33
XBV00162.VDF : 8.11.218.38 26112 Bytes 18.03.2015 20:29:33
XBV00163.VDF : 8.11.218.46 4096 Bytes 18.03.2015 20:29:33
XBV00164.VDF : 8.11.218.52 3584 Bytes 18.03.2015 20:29:33
XBV00165.VDF : 8.11.218.66 5120 Bytes 18.03.2015 20:29:33
XBV00166.VDF : 8.11.218.78 24576 Bytes 18.03.2015 20:29:34
XBV00167.VDF : 8.11.218.88 15360 Bytes 18.03.2015 20:29:34
XBV00168.VDF : 8.11.218.98 17408 Bytes 18.03.2015 20:29:34
XBV00169.VDF : 8.11.218.100 10240 Bytes 18.03.2015 20:29:34
XBV00170.VDF : 8.11.218.102 7680 Bytes 18.03.2015 20:29:34
XBV00171.VDF : 8.11.218.106 39936 Bytes 19.03.2015 20:29:34
XBV00172.VDF : 8.11.218.116 37888 Bytes 19.03.2015 20:29:34
XBV00173.VDF : 8.11.218.126 14336 Bytes 19.03.2015 20:29:35
XBV00174.VDF : 8.11.218.136 58880 Bytes 19.03.2015 20:29:35
XBV00175.VDF : 8.11.218.148 79872 Bytes 19.03.2015 20:29:35
XBV00176.VDF : 8.11.218.150 16896 Bytes 19.03.2015 20:29:35
XBV00177.VDF : 8.11.218.152 2048 Bytes 19.03.2015 20:29:35
XBV00178.VDF : 8.11.218.156 44032 Bytes 20.03.2015 20:29:35
XBV00179.VDF : 8.11.218.158 2048 Bytes 20.03.2015 20:29:35
XBV00180.VDF : 8.11.218.168 13312 Bytes 20.03.2015 20:29:35
XBV00181.VDF : 8.11.218.176 7680 Bytes 20.03.2015 20:29:35
XBV00182.VDF : 8.11.218.184 2048 Bytes 20.03.2015 20:29:35
XBV00183.VDF : 8.11.218.192 11264 Bytes 20.03.2015 20:29:35
XBV00184.VDF : 8.11.218.194 15360 Bytes 20.03.2015 20:29:36
XBV00185.VDF : 8.11.218.198 2048 Bytes 20.03.2015 20:29:36
XBV00186.VDF : 8.11.218.206 2048 Bytes 20.03.2015 20:29:36
XBV00187.VDF : 8.11.218.214 2048 Bytes 20.03.2015 20:29:36
XBV00188.VDF : 8.11.218.222 18432 Bytes 20.03.2015 20:29:36
XBV00189.VDF : 8.11.218.224 18944 Bytes 20.03.2015 20:29:36
XBV00190.VDF : 8.11.218.226 2048 Bytes 20.03.2015 20:29:36
XBV00191.VDF : 8.11.218.228 28160 Bytes 20.03.2015 20:29:36
XBV00192.VDF : 8.11.218.230 2048 Bytes 20.03.2015 20:29:36
XBV00193.VDF : 8.11.218.232 14336 Bytes 20.03.2015 20:29:36
XBV00194.VDF : 8.11.218.238 42496 Bytes 21.03.2015 20:29:37
XBV00195.VDF : 8.11.218.240 2048 Bytes 21.03.2015 20:29:37
XBV00196.VDF : 8.11.218.248 24576 Bytes 21.03.2015 20:29:37
XBV00197.VDF : 8.11.218.250 2048 Bytes 21.03.2015 20:29:37
XBV00198.VDF : 8.11.218.252 2048 Bytes 21.03.2015 20:29:37
XBV00199.VDF : 8.11.219.10 33792 Bytes 21.03.2015 20:29:37
XBV00200.VDF : 8.11.219.18 44544 Bytes 22.03.2015 20:29:37
XBV00201.VDF : 8.11.219.26 2048 Bytes 22.03.2015 20:29:37
XBV00202.VDF : 8.11.219.34 8192 Bytes 22.03.2015 20:29:38
XBV00203.VDF : 8.11.219.36 18944 Bytes 22.03.2015 20:29:38
XBV00204.VDF : 8.11.219.38 66560 Bytes 23.03.2015 17:33:44
XBV00205.VDF : 8.11.219.46 2048 Bytes 23.03.2015 17:33:45
XBV00206.VDF : 8.11.219.52 7168 Bytes 23.03.2015 17:33:45
XBV00207.VDF : 8.11.219.58 7680 Bytes 23.03.2015 17:33:45
XBV00208.VDF : 8.11.219.64 8192 Bytes 23.03.2015 17:33:45
XBV00209.VDF : 8.11.219.66 7168 Bytes 23.03.2015 17:33:45
XBV00210.VDF : 8.11.219.68 12800 Bytes 23.03.2015 17:33:45
XBV00211.VDF : 8.11.219.70 25088 Bytes 23.03.2015 17:33:45
XBV00212.VDF : 8.11.219.74 2048 Bytes 23.03.2015 17:33:45
XBV00213.VDF : 8.11.219.76 33280 Bytes 23.03.2015 17:33:45
XBV00214.VDF : 8.11.219.80 22016 Bytes 23.03.2015 17:33:45
XBV00215.VDF : 8.11.219.82 8192 Bytes 23.03.2015 17:33:45
XBV00216.VDF : 8.11.219.84 22528 Bytes 24.03.2015 17:33:45
XBV00217.VDF : 8.11.219.90 4096 Bytes 24.03.2015 17:33:45
XBV00218.VDF : 8.11.219.96 6656 Bytes 24.03.2015 17:33:45
XBV00219.VDF : 8.11.219.102 5120 Bytes 24.03.2015 17:33:45
XBV00220.VDF : 8.11.219.110 5632 Bytes 24.03.2015 17:33:45
XBV00221.VDF : 8.11.219.112 9728 Bytes 24.03.2015 17:33:45
XBV00222.VDF : 8.11.219.114 2048 Bytes 24.03.2015 17:33:45
LOCAL001.VDF : 8.11.219.114 125557760 Bytes 24.03.2015 17:34:03
Engineversion : 8.3.30.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 23.08.2014 18:21:17
AESCRIPT.DLL : 8.2.2.58 560248 Bytes 22.03.2015 20:28:47
AESCN.DLL : 8.3.2.2 139456 Bytes 21.07.2014 15:37:50
AESBX.DLL : 8.2.20.34 1615784 Bytes 04.03.2015 19:33:12
AERDL.DLL : 8.2.1.20 731040 Bytes 12.02.2015 08:34:17
AEPACK.DLL : 8.4.0.62 793456 Bytes 21.02.2015 00:29:43
AEOFFICE.DLL : 8.3.1.14 354216 Bytes 22.03.2015 20:28:47
AEMOBILE.DLL : 8.1.7.0 281456 Bytes 22.03.2015 20:28:48
AEHEUR.DLL : 8.1.4.1606 8256368 Bytes 22.03.2015 20:28:47
AEHELP.DLL : 8.3.2.0 281456 Bytes 22.03.2015 20:28:46
AEGEN.DLL : 8.1.7.40 456608 Bytes 20.12.2014 00:55:25
AEEXP.DLL : 8.4.2.70 255904 Bytes 08.02.2015 20:02:04
AEEMU.DLL : 8.1.3.4 399264 Bytes 23.08.2014 18:21:17
AEDROID.DLL : 8.4.3.116 1050536 Bytes 22.03.2015 20:28:47
AECORE.DLL : 8.3.4.0 243624 Bytes 20.12.2014 00:55:25
AEBB.DLL : 8.1.2.0 60448 Bytes 23.08.2014 18:21:17
AVWINLL.DLL : 15.0.8.652 25904 Bytes 22.03.2015 20:28:45
AVPREF.DLL : 15.0.8.652 53248 Bytes 22.03.2015 20:28:52
AVREP.DLL : 15.0.8.652 221432 Bytes 22.03.2015 20:28:52
AVARKT.DLL : 15.0.8.652 228088 Bytes 22.03.2015 20:28:48
AVEVTLOG.DLL : 15.0.8.652 183600 Bytes 22.03.2015 20:28:49
SQLITE3.DLL : 15.0.8.652 456440 Bytes 22.03.2015 20:29:19
AVSMTP.DLL : 15.0.8.652 79360 Bytes 22.03.2015 20:28:54
NETNT.DLL : 15.0.8.652 17352 Bytes 22.03.2015 20:29:14
RCIMAGE.DLL : 15.0.8.652 4864816 Bytes 22.03.2015 20:28:45
RCTEXT.DLL : 15.0.8.652 75056 Bytes 22.03.2015 20:28:45
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, Y:, A:, D:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Dienstag, 24. März 2015 18:35
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, Y:)'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'FDD0(A:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '156' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'WTabletServicePro.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'HSMServiceEntry.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'PassThruSvr.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDFSSvc.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesService64.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'tvnserver.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDUpdSvc.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWSCSvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WISPTIS.EXE' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'WISPTIS.EXE' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'TabTip.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesApp64.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '175' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_TabletUser.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'WacomHost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_TouchUser.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'TabTip32.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_Tablet.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'adb.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedhlp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'itype.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'ipoint.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'tvnserver.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'V0700Mon.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'htcUPCTLoader.exe' - '141' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDTray.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '146' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '215' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '149' Modul(e) wurden durchsucht
Durchsuche Prozess 'InputPersonalization.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '33' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('34' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '5573' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
[0] Archivtyp: RSRC
--> C:\Users\demax.yusuf\AppData\Local\Temp\RarSFX1\webife\Program Files\System32\64\Drivers\winusbcoinstaller2.dll
[1] Archivtyp: RSRC
--> C:\Users\demax.yusuf\AppData\Local\Temp\RarSFX1\webife\Program Files\System32\Drivers\winusbcoinstaller2.dll
[2] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[3] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[4] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[5] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[6] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[7] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[8] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[9] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[10] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[11] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[12] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[13] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[14] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u40.exe
[15] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u55 (1).exe
[16] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u55.exe
[17] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\Download\Windows Cleaner.exe
[18] Archivtyp: Inno Setup
--> {tmp}\BetterMarkit.exe
[19] Archivtyp: NSIS
--> [PluginsDir]/InstallOptions.dll
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Graftor.131459.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> ProgramFilesDir/[PluginsDir]/nsr.dll
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6840
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\demax.yusuf\Downloads\Download\Windows Cleaner.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6840
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u40.exe
[18] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u55 (1).exe
[19] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\chromeinstall-7u55.exe
[20] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Downloads\Download\Windows Cleaner.exe
[21] Archivtyp: Inno Setup
--> {tmp}\BetterMarkit.exe
[22] Archivtyp: NSIS
--> [PluginsDir]/InstallOptions.dll
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Graftor.131459.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> ProgramFilesDir/[PluginsDir]/nsr.dll
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6840
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\demax.yusuf\Downloads\Download\Windows Cleaner.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6840
--> C:\Users\demax.yusuf\OSBuddy\loader.jar
[21] Archivtyp: ZIP
--> com/ggnoreyd.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternewb.Gen
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\demax.yusuf\OSBuddy\loader.jar
[FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternewb.Gen
Beginne mit der Suche in 'Y:\' <Volume>
Beginne mit der Suche in 'A:\'
Der zu durchsuchende Pfad A:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Desinfektion:
Danach hab ich Avira nochmal drüber laufen lassen und noch 2 Funde bekommen. Hier der Log vom letzten Scan. Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 01. Jänner 2002 04:36
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : demax.yusuf
Computername : DEMAXYUSUF-PC
Versionsinformationen:
BUILD.DAT : 15.0.8.656 91858 Bytes 17.03.2015 13:02:00
AVSCAN.EXE : 15.0.8.652 1014064 Bytes 22.03.2015 20:28:53
AVSCANRC.DLL : 15.0.8.652 63792 Bytes 22.03.2015 20:28:54
LUKE.DLL : 15.0.8.652 60664 Bytes 22.03.2015 20:29:13
AVSCPLR.DLL : 15.0.8.652 93488 Bytes 22.03.2015 20:28:54
REPAIR.DLL : 15.0.8.652 365360 Bytes 22.03.2015 20:28:52
REPAIR.RDF : 1.0.6.86 825079 Bytes 26.03.2015 20:27:25
AVREG.DLL : 15.0.8.652 265464 Bytes 22.03.2015 20:28:52
AVLODE.DLL : 15.0.8.656 645368 Bytes 22.03.2015 20:28:51
AVLODE.RDF : 14.0.4.54 78895 Bytes 10.12.2014 16:43:24
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:36
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:36
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 18:21:37
XBV00056.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00057.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00058.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00059.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00060.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00061.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00062.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00063.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00064.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00065.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00066.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:48
XBV00067.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00068.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00069.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00070.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00071.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00072.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00073.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00074.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00075.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00076.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00077.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00078.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00079.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00080.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00081.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00082.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00083.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00084.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00085.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00086.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00087.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00088.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00089.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:49
XBV00090.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00091.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00092.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00093.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00094.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00095.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00096.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00097.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00098.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00099.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00100.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00101.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00102.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00103.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00104.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00105.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00106.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00107.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00108.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00109.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00110.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00111.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00112.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00113.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00114.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00115.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00116.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00117.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00118.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00119.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00120.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00121.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:50
XBV00122.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00123.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00124.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00125.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00126.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00127.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00128.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00129.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00130.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00131.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00132.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00133.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00134.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00135.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00136.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:51
XBV00137.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00138.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00139.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00140.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00141.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00142.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00143.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00144.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00145.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00146.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00147.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00148.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00149.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00150.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00151.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00152.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00153.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00154.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00155.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00156.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00157.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00158.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00159.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00160.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00161.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00162.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00163.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00164.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00165.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:52
XBV00166.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00167.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00168.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00169.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00170.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00171.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00172.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00173.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00174.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00175.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00176.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00177.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00178.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00179.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00180.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00181.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00182.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00183.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00184.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00185.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00186.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00187.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00188.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00189.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00190.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00191.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00192.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00193.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:53
XBV00194.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00195.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00196.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00197.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00198.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00199.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00200.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00201.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00202.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00203.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00204.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00205.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00206.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00207.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00208.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00209.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00210.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00211.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00212.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00213.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00214.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00215.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00216.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00217.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00218.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00219.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00220.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:54
XBV00221.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00222.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00223.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00224.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00225.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00226.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00227.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00228.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00229.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00230.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00231.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00232.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00233.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00234.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00235.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00236.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00237.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00238.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00239.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00240.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00241.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00242.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00243.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00244.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00245.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00246.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00247.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00248.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00249.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00250.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00251.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:55
XBV00252.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:56
XBV00253.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:56
XBV00254.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:56
XBV00255.VDF : 8.11.219.166 2048 Bytes 25.03.2015 17:36:56
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:46:18
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 22:53:19
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 17:50:34
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 09:59:04
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 09:26:42
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 17:36:48
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 15:42:20
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 16:08:30
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 18:21:36
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 12:50:22
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14.10.2014 16:13:10
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11.11.2014 22:30:56
XBV00012.VDF : 8.11.190.32 1876992 Bytes 03.12.2014 16:43:25
XBV00013.VDF : 8.11.201.28 2973696 Bytes 14.01.2015 03:31:56
XBV00014.VDF : 8.11.206.252 2695680 Bytes 04.02.2015 20:02:07
XBV00015.VDF : 8.11.213.84 3175936 Bytes 03.03.2015 19:33:14
XBV00016.VDF : 8.11.213.176 212480 Bytes 05.03.2015 17:24:55
XBV00017.VDF : 8.11.219.166 2033664 Bytes 25.03.2015 17:36:47
XBV00042.VDF : 8.11.219.194 36864 Bytes 25.03.2015 23:36:00
XBV00043.VDF : 8.11.219.218 7168 Bytes 25.03.2015 23:36:00
XBV00044.VDF : 8.11.219.242 6144 Bytes 25.03.2015 23:36:00
XBV00045.VDF : 8.11.219.244 7680 Bytes 25.03.2015 23:36:00
XBV00046.VDF : 8.11.219.246 5632 Bytes 26.03.2015 11:48:00
XBV00047.VDF : 8.11.219.250 38400 Bytes 26.03.2015 11:48:01
XBV00048.VDF : 8.11.219.252 14336 Bytes 26.03.2015 11:48:01
XBV00049.VDF : 8.11.219.254 18432 Bytes 26.03.2015 11:48:01
XBV00050.VDF : 8.11.220.0 7680 Bytes 26.03.2015 20:27:24
XBV00051.VDF : 8.11.220.2 10240 Bytes 26.03.2015 20:27:24
XBV00052.VDF : 8.11.220.6 2048 Bytes 26.03.2015 20:27:24
XBV00053.VDF : 8.11.220.8 2560 Bytes 26.03.2015 20:27:24
XBV00054.VDF : 8.11.220.10 17408 Bytes 26.03.2015 20:27:24
XBV00055.VDF : 8.11.220.12 2048 Bytes 26.03.2015 20:27:25
LOCAL001.VDF : 8.11.220.12 125327360 Bytes 26.03.2015 20:27:41
Engineversion : 8.3.30.4
AEVDF.DLL : 8.3.1.6 133992 Bytes 23.08.2014 18:21:17
AESCRIPT.DLL : 8.2.2.58 560248 Bytes 22.03.2015 20:28:47
AESCN.DLL : 8.3.2.2 139456 Bytes 21.07.2014 15:37:50
AESBX.DLL : 8.2.20.34 1615784 Bytes 04.03.2015 19:33:12
AERDL.DLL : 8.2.1.20 731040 Bytes 12.02.2015 08:34:17
AEPACK.DLL : 8.4.0.62 793456 Bytes 21.02.2015 00:29:43
AEOFFICE.DLL : 8.3.1.14 354216 Bytes 22.03.2015 20:28:47
AEMOBILE.DLL : 8.1.7.0 281456 Bytes 22.03.2015 20:28:48
AEHEUR.DLL : 8.1.4.1606 8256368 Bytes 22.03.2015 20:28:47
AEHELP.DLL : 8.3.2.0 281456 Bytes 22.03.2015 20:28:46
AEGEN.DLL : 8.1.7.40 456608 Bytes 20.12.2014 00:55:25
AEEXP.DLL : 8.4.2.70 255904 Bytes 08.02.2015 20:02:04
AEEMU.DLL : 8.1.3.4 399264 Bytes 23.08.2014 18:21:17
AEDROID.DLL : 8.4.3.116 1050536 Bytes 22.03.2015 20:28:47
AECORE.DLL : 8.3.4.0 243624 Bytes 20.12.2014 00:55:25
AEBB.DLL : 8.1.2.0 60448 Bytes 23.08.2014 18:21:17
AVWINLL.DLL : 15.0.8.652 25904 Bytes 22.03.2015 20:28:45
AVPREF.DLL : 15.0.8.652 53248 Bytes 22.03.2015 20:28:52
AVREP.DLL : 15.0.8.652 221432 Bytes 22.03.2015 20:28:52
AVARKT.DLL : 15.0.8.652 228088 Bytes 22.03.2015 20:28:48
AVEVTLOG.DLL : 15.0.8.652 183600 Bytes 22.03.2015 20:28:49
SQLITE3.DLL : 15.0.8.652 456440 Bytes 22.03.2015 20:29:19
AVSMTP.DLL : 15.0.8.652 79360 Bytes 22.03.2015 20:28:54
NETNT.DLL : 15.0.8.652 17352 Bytes 22.03.2015 20:29:14
RCIMAGE.DLL : 15.0.8.652 4864816 Bytes 22.03.2015 20:28:45
RCTEXT.DLL : 15.0.8.652 75056 Bytes 22.03.2015 20:28:45
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, Y:, A:, D:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Dienstag, 01. Jänner 2002 04:36
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, Y:)'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'FDD0(A:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '156' Modul(e) wurden durchsucht
Durchsuche Prozess 'WTabletServicePro.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WISPTIS.EXE' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'HSMServiceEntry.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'PassThruSvr.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDFSSvc.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'WISPTIS.EXE' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'TabTip.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'TabTip32.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesService64.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'tvnserver.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '207' Modul(e) wurden durchsucht
Durchsuche Prozess 'adb.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedhlp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'itype.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'ipoint.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'tvnserver.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDUpdSvc.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'V0700Mon.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesApp64.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'htcUPCTLoader.exe' - '143' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDTray.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '149' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWSCSvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'dinotify.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_TabletUser.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'WacomHost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_Tablet.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'Wacom_TouchUser.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '199' Modul(e) wurden durchsucht
Durchsuche Prozess 'InputPersonalization.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '140' Modul(e) wurden durchsucht
Durchsuche Prozess 'steamwebhelper.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'SteamService.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '149' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'CivilizationV_DX11.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '34' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('34' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '5469' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
[0] Archivtyp: RSRC
--> C:\Users\demax.yusuf\AppData\Local\Temp\RarSFX1\webife\Program Files\System32\64\Drivers\winusbcoinstaller2.dll
[1] Archivtyp: RSRC
--> C:\Users\demax.yusuf\AppData\Local\Temp\RarSFX1\webife\Program Files\System32\Drivers\winusbcoinstaller2.dll
[2] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[3] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[4] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[5] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[6] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[7] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[8] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[9] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
[10] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[11] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
[12] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[13] Archivtyp: RSRC
--> C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
[14] Archivtyp: Runtime Packed
--> C:\Users\demax.yusuf\OSBuddy\loader.jar
[15] Archivtyp: ZIP
--> com/ggnoreyd.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternewb.Gen
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\demax.yusuf\OSBuddy\loader.jar
[FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternewb.Gen
Beginne mit der Suche in 'Y:\' <Volume>
Beginne mit der Suche in 'A:\'
Der zu durchsuchende Pfad A:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Desinfektion:
C:\Users\demax.yusuf\OSBuddy\loader.jar
[FUND] Enthält Erkennungsmuster des Exploits EXP/JAVA.Ternewb.Gen
[WARNUNG] Die Datei wurde ignoriert.
Ende des Suchlaufs: Dienstag, 01. Jänner 2002 06:33
Benötigte Zeit: 1:56:08 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
79375 Verzeichnisse wurden überprüft
1038157 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1038155 Dateien ohne Befall
5579 Archive wurden durchsucht
2 Warnungen
0 Hinweise
LG |
|
28.03.2015, 02:59
| #2 |
| /// the machine /// TB-Ausbilder    | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
30.03.2015, 14:06
| #3 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Hier die zwei .txts
__________________FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by demax.yusuf (administrator) on DEMAXYUSUF-PC on 30-03-2015 14:57:05
Running from C:\Users\demax.yusuf\Downloads
Loaded Profiles: demax.yusuf (Available profiles: demax.yusuf)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Creative Technology Ltd.) C:\Windows\V0700Mon.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [362032 2009-11-12] (Acronis)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [V0700Mon.exe] => C:\Windows\V0700Mon.exe [28672 2011-08-22] (Creative Technology Ltd.)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [655360 2012-05-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-16] (InstallShield Software Corporation)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17e9-2f9b-11df-a9b0-00248c78e994} - H:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17ea-2f9b-11df-a9b0-00248c78e994} - I:\autorun.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17eb-2f9b-11df-a9b0-00248c78e994} - J:\autorun.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {875da29f-6290-11e3-8968-00248c78e994} - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {875da2a4-6290-11e3-8968-00248c78e994} - D:\HTC_Sync_Manager_PC.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-05-23] (DivX, LLC)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-25] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-25] (Oracle Corporation)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-08] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-08] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-05-25] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=8 -> C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2419162032-26975598-1423618793-1001: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF user.js: detected! => C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\user.js [2010-03-14]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2010-07-27] (Apple Inc.)
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-images.xml [2014-10-09]
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-maps.xml [2014-10-09]
FF Extension: Avira Browser Safety - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\abs@avira.com [2015-03-22]
FF Extension: LoL eSport Countdown - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\deihjamdkpkfnhlaebfphjfahlfefmnh@slicefactory.com [2013-02-07]
FF Extension: Bitdefender QuickScan - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-07-18]
FF Extension: Cliqz Beta - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\cliqz@cliqz.com.xpi [2014-10-11]
FF Extension: convert2mp3.net YouTube2MP3 Converter - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\info@convert2mp3.net.xpi [2013-07-29]
FF Extension: Lightbeam - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-02-06]
FF Extension: Adblock Plus - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14]
FF Extension: Greasemonkey - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-24]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-11-23]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-09-18]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-01]
CHR Extension: (Google Drive) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-01]
CHR Extension: (YouTube) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-01]
CHR Extension: (Google Search) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-01]
CHR Extension: (AdBlock) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-09]
CHR Extension: (Google Wallet) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-06-01]
CHR Extension: (Gmail) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-01]
CHR HKU\S-1-5-21-2419162032-26975598-1423618793-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-22] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-22] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-01-29] (Nero AG)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2010-03-14] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1398088 2010-02-25] (TuneUp Software)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [598808 2013-06-06] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-03-15] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-03-15] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-10] (Duplex Secure Ltd.)
S2 SVKP; C:\Windows\SysWOW64\SVKP.sys [2368 2013-02-21] (AntiCracking) [File not signed]
R0 tdrpman258; C:\Windows\System32\DRIVERS\tdrpm258.sys [1477728 2010-03-14] (Acronis)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-25] (TuneUp Software)
R3 V0700Vid; C:\Windows\System32\DRIVERS\V0700Vid.sys [393920 2011-09-06] (Creative Technology Ltd.)
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-30 14:57 - 2015-03-30 15:00 - 00025279 _____ () C:\Users\demax.yusuf\Downloads\FRST.txt
2015-03-30 14:56 - 2015-03-30 14:57 - 00000000 ____D () C:\FRST
2015-03-30 14:55 - 2015-03-30 14:55 - 02095616 _____ (Farbar) C:\Users\demax.yusuf\Downloads\FRST64.exe
2015-03-24 19:48 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-24 19:48 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-22 22:50 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-22 22:50 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-22 22:50 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-22 22:50 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-22 22:50 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-22 22:50 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-22 22:50 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-22 22:50 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-22 22:50 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-22 22:50 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-22 22:50 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-22 22:49 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-22 22:49 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-22 22:49 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-22 22:48 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-22 22:48 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-22 22:48 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-22 22:48 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-22 22:48 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-22 22:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-22 22:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-22 22:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-22 22:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-22 22:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-22 22:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-22 22:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-22 22:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-22 22:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-22 22:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-22 22:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-22 22:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-22 22:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-22 22:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-22 22:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-22 22:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-22 22:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-22 22:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-22 22:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-22 22:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-22 22:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-22 22:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-22 22:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-22 22:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-22 22:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-22 22:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-22 22:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-22 22:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-22 22:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-22 22:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-22 22:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-22 22:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-22 22:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-03-04 21:39 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-30 14:59 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-30 14:59 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-30 14:57 - 2010-03-21 14:38 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-30 14:57 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-03-30 14:57 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-03-30 14:57 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-30 14:56 - 2010-03-14 11:12 - 01269567 _____ () C:\Windows\WindowsUpdate.log
2015-03-30 14:52 - 2013-06-22 14:30 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\HTC MediaHub
2015-03-30 14:52 - 2012-07-10 04:31 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\Htc
2015-03-30 14:52 - 2010-11-25 20:13 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Skype
2015-03-30 14:51 - 2013-01-07 18:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-30 14:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-30 14:50 - 2009-07-14 06:51 - 00211859 _____ () C:\Windows\setupact.log
2015-03-29 07:47 - 2013-01-14 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-29 07:38 - 2013-01-07 18:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-28 15:05 - 2014-05-10 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2015-03-28 15:05 - 2010-03-16 08:39 - 00220140 _____ () C:\Windows\PFRO.log
2015-03-28 02:52 - 2010-03-14 21:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-28 02:52 - 2000-05-13 11:19 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Ubisoft
2015-03-28 02:50 - 2013-07-29 12:47 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\DVDVideoSoft
2015-03-25 20:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-25 04:19 - 2014-12-12 16:25 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-25 04:19 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:29 - 2009-07-14 06:45 - 04857072 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-23 02:01 - 2013-07-29 13:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-23 01:57 - 2010-03-19 18:36 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-22 22:28 - 2013-07-31 22:10 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-05 04:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2015-02-28 16:45 - 2013-03-17 19:39 - 00000050 _____ () C:\Users\demax.yusuf\jagex_cl_oldschool_LIVE.dat
==================== Files in the root of some directories =======
2011-05-22 15:03 - 2011-05-22 15:04 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe GIF Format CS5 Prefs
2010-07-19 00:00 - 2013-02-01 10:49 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-10-09 13:18 - 2014-11-02 19:52 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Roaming\winscp.rnd
2014-10-09 12:53 - 2014-11-02 19:48 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Local\PUTTY.RND
2010-03-14 21:55 - 2010-03-14 21:55 - 0000017 _____ () C:\Users\demax.yusuf\AppData\Local\resmon.resmoncfg
2010-11-25 20:19 - 2010-11-25 20:19 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
Files to move or delete:
====================
C:\Users\demax.yusuf\jagex_cl_oldschool_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE1.dat
C:\Users\demax.yusuf\jagex_runescape_preferences.dat
C:\Users\demax.yusuf\jagex_runescape_preferences2.dat
C:\Users\demax.yusuf\jagex__preferences3.dat
C:\Users\demax.yusuf\random.dat
Some content of TEMP:
====================
C:\Users\demax.yusuf\AppData\Local\Temp\avgnt.exe
C:\Users\demax.yusuf\AppData\Local\Temp\drm_dialogs.dll
C:\Users\demax.yusuf\AppData\Local\Temp\DSSExp.exe
C:\Users\demax.yusuf\AppData\Local\Temp\Nexus%20Mod%20Manager-0.49.8.exe
C:\Users\demax.yusuf\AppData\Local\Temp\SkypeSetup.exe
C:\Users\demax.yusuf\AppData\Local\Temp\tmd_34012390.exe
C:\Users\demax.yusuf\AppData\Local\Temp\tmd_34012710.exe
C:\Users\demax.yusuf\AppData\Local\Temp\y6yyzunj.dll
C:\Users\demax.yusuf\AppData\Local\Temp\_is6089.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is6EBB.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is87A8.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8882.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8CB7.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8FA4.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is907.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isADED.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isC7C4.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isE551.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 20:12
==================== End Of Log ============================
Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by demax.yusuf at 2015-03-30 15:04:44
Running from C:\Users\demax.yusuf\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acronis*True*Image*Home (HKLM-x32\...\{67ED38A3-4882-448B-B44D-3428AB00D7D5}) (Version: 13.0.6053 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.01) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.01 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcaniA - Gothic 4 (HKLM-x32\...\ArcaniA) (Version: - JoWooD Entertainment AG)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
ContentMod2.0 (HKLM-x32\...\ContentMod_2.0) (Version: - )
Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)
Creative Live! Cam Chat HD (VF0700) (1.00.06.00) (HKLM\...\Creative VF0700) (Version: - Creative Technology Ltd.)
Dev-C++ 5 beta 9 release (4.9.9.2) (HKLM-x32\...\Dev-C++) (Version: - )
Die Siedler III Gold Edition (HKLM-x32\...\S3) (Version: - )
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.0.34 - DivX, LLC)
GameRanger (HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\GameRanger) (Version: - GameRanger Technologies)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Gothic (HKLM-x32\...\Gothic) (Version: 1.32 - JoWooD Software Productions AG)
Gothic II Gold (HKLM-x32\...\{92510C2A-30E3-4F8D-AE8A-93AB7B63EE8F}) (Version: 2.5.0 - JoWooD Productions Software AG)
Gothic III (HKLM-x32\...\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}) (Version: 1.0.0 - JoWooD Productions Software AG)
Gothic III Release Update (HKLM-x32\...\{1998BD34-1AAB-4169-ACFF-67342E2AF9B4}) (Version: 1.00.0000 - JoWooD Productions Software AG)
Heroes of Might and Magic® III Complete (HKLM-x32\...\Heroes of Might and Magic® III) (Version: - )
Hotfix für Microsoft Visual C++ 2010 Express - DEU (KB2635973) (HKLM-x32\...\{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}.KB2635973) (Version: 1 - Microsoft Corporation)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Sync (HKLM-x32\...\{1F9E5C64-165D-4679-BBB3-498D216D017B}) (Version: 3.3.7 - HTC Corporation)
HTC Sync Manager (HKLM-x32\...\{5002C5B1-B688-474A-AB3A-9B65DBD38FF9}) (Version: 2.0.60.0 - HTC)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
iTunes (HKLM\...\{A04DCB25-7040-4935-A30D-8E0A893ABF2D}) (Version: 11.1.2.32 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JDownloader (HKLM-x32\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt))
League of Legends (HKLM-x32\...\{918A9082-6287-4D25-9002-5E5D5E4971CB}) (Version: 1.02.0000 - Riot Games)
M4-78 Enhancement Project (HKLM-x32\...\The Sith Lords Restored Content Mod_is1) (Version: - )
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - DEU (HKLM-x32\...\Microsoft Visual C++ 2010 Express - DEU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 1.1.500.0 - Microsoft Corporation)
Might and Magic® VI (HKLM-x32\...\Might and Magic® VI) (Version: - )
Might and Magic® VII (HKLM-x32\...\Might and Magic® VII) (Version: - )
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Morrowind (HKLM-x32\...\{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}) (Version: - )
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.49.8 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
QuickTime (HKLM-x32\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
Risen 2 Dark Waters (HKLM-x32\...\Risen 2 Dark Waters_is1) (Version: - )
Shutdowner Version 2.0.2 (HKLM-x32\...\{08CF87BD-F3CD-4D6B-A0F1-9CE86DEF3407}_is1) (Version: 2.0.2 - Scriptinggamer)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Simon the Sorcerer (HKLM-x32\...\Simon the Sorcerer_is1) (Version: - GOG.com)
Simon the Sorcerer 2 (HKLM-x32\...\Simon the Sorcerer 2_is1) (Version: - GOG.com)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Star Wars Battlefront II (HKLM-x32\...\{3D374523-CFDE-461A-827E-2A102E2AB365}) (Version: 1.0 - LucasArts)
Star Wars Empire at War (HKLM-x32\...\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}) (Version: 1.0 - LucasArts)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Star Wars® Knights of the Old Republic Series Version 1.0 Windows 7 (HKLM-x32\...\{78AEEF25-88AA-453A-B2CC-446FE42AA08F}_is1) (Version: 1.0 Windows 7 - Lucas Arts®)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
STEIG EIN! 1.2 (HKLM-x32\...\{565975F6-01B9-409E-A5FF-EA656EE0144F}_is1) (Version: - Hubert Ebner Verlags GmbH)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)
TES Construction Set (HKLM-x32\...\{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}) (Version: - )
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Lord of the Rings FREE Trial (x32 Version: 1.00.0000 - ATI Technologies Inc.) Hidden
ThielHater's Texturepatch v1.0.2 (HKLM-x32\...\ThielHater's Texturepatch_is1) (Version: 1.0 - ThielHater © 2007-2009)
TightVNC (HKLM\...\{BC994A59-6E98-4203-8A35-819938DD5ED1}) (Version: 2.5.2.0 - GlavSoft LLC.)
TuneUp Utilities (HKLM-x32\...\TuneUp Utilities) (Version: 9.0.4030.5 - TuneUp Software)
TuneUp Utilities (x32 Version: 9.0.4030.5 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.4030.5 - TuneUp Software) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 1.0.5 (HKLM-x32\...\VLC media player) (Version: 1.0.5 - VideoLAN Team)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.6-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
WinSCP 5.5.5 (HKLM-x32\...\winscp3_is1) (Version: 5.5.5 - Martin Prikryl)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Restore Points =========================
28-03-2015 15:11:22 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2010-07-18 23:19 - 2010-07-18 23:18 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {182BEAEE-3D7B-4B6C-83ED-B546FDBCAAB1} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-18] (Adobe Systems Incorporated)
Task: {1DA82136-558F-4256-98F4-8EDFD3B5BF97} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17] (Oracle Corporation)
Task: {3C6AAAC3-55AA-4053-8658-EF543231E164} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {40067252-BA55-44E8-8790-AE56CFA4CDA8} - System32\Tasks\AdobeAAMUpdater-1.0-demaxyusuf-PC-demax.yusuf => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {4C4C39B9-3EDD-4ACD-AFFF-2E71011E1A45} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-08] (Adobe Systems Incorporated)
Task: {5ABEC71D-C373-4492-A27C-ECE9A8B68EB4} - System32\Tasks\{2F5D1FC8-7168-4A7F-B025-BDC2135EB0A5} => C:\Program Files (x86)\Hubert Ebner Verlag\STEIG EIN\Vogel.SteigEin.exe [2013-03-05] (Hubert Ebner Verlags GmbH)
Task: {5E643B84-816C-4A76-80BB-735467FD68BE} - System32\Tasks\{6C6C9C3F-C8A5-40CB-98D9-88ACB6B6D8B9} => C:\Program Files (x86)\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe [2005-12-25] ()
Task: {621FCD71-AD23-481C-9163-27E6CBA26FEA} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {62FEEF89-14C0-44DF-8F7D-643DAE807758} - System32\Tasks\{1876A9C8-5AD0-43A1-8005-F5F96EC34315} => G:\SETUP.EXE
Task: {685CF73D-A3C6-4BE2-BBF8-D848E2688536} - System32\Tasks\{B8C255A1-F8C3-4B37-9FCB-702172449023} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/10
Task: {7EA5D474-5EB4-4EFD-86B6-E8279C537B5C} - System32\Tasks\{8BBBBDE5-47C2-4A2D-9EF2-E86C0A932A85} => pcalua.exe -a C:\Users\demax.yusuf\Downloads\mm710-11.exe -d C:\Users\demax.yusuf\Downloads
Task: {987E4598-6DDA-41AD-81E2-3931197045A5} - System32\Tasks\{53F666C0-DE25-4B12-92F0-A84CC1573CF4} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-08-27] (Skype Technologies S.A.)
Task: {A05121B3-A723-4A55-9DDD-51136E5F22D8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07] (Google Inc.)
Task: {A1FC8F1D-1192-4113-BED7-D0101041F4CF} - System32\Tasks\{EF3FCBD7-88DF-4F8A-912B-937FE8F72FE3} => pcalua.exe -a C:\Users\demax.yusuf\Downloads\uniws\uniws.exe -d C:\Users\demax.yusuf\Downloads\uniws
Task: {B5F3135B-C4A7-47E2-8435-40CD34D96B37} - System32\Tasks\{65F2A2CE-DD9A-46F7-A5CB-EB044B64A7DB} => C:\Program Files (x86)\LucasArts\SWKotOR2\swkotor2.exe
Task: {BF1320AA-E97E-4018-A02D-8956BBD04777} - System32\Tasks\{8A87C0C7-4EEF-4EDC-9808-C1B29646628E} => C:\Program Files\LucasArts\SWKotOR\swkotor.exe
Task: {CC0E8313-3399-4A12-8EF9-BF136E50DA42} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-05-29] ()
Task: {D03906BC-F218-4184-B92B-D1B595EB3B7F} - System32\Tasks\{4B77ADDB-1759-4214-88FA-383412F523C6} => C:\Program Files (x86)\JoWooD Productions Software AG\Gothic II Gold\System\Gothic2.exe [2011-12-16] (Piranha Bytes)
Task: {DB196B70-2E29-4B2B-8052-EA854D5AA3DE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {DE0F20A1-1DC6-4ED8-8451-372FEA42BCC8} - System32\Tasks\{E4ED572C-BD8F-41DA-864B-033DFCC33B4E} => C:\Program Files (x86)\JoWooD Productions Software AG\Gothic II Gold\System\Gothic2.exe [2011-12-16] (Piranha Bytes)
Task: {DEA0E1A2-E882-4516-9FFC-20DADBB817FB} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe [2012-06-26] (Microsoft)
Task: {DEF6869C-D451-400D-8EA6-6BFF62F56DC8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E7C25515-4A7D-470F-98D9-26F66B21B12E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07] (Google Inc.)
Task: {E8EC0422-9DFB-468B-A446-9EFEEF7C27D3} - System32\Tasks\{F5F157E9-6311-4A59-89F0-1BB370E6D488} => C:\Program Files (x86)\Hubert Ebner Verlag\STEIG EIN\Vogel.SteigEin.exe [2013-03-05] (Hubert Ebner Verlags GmbH)
Task: {EB831A32-674B-42FB-89AF-7AFC72627EB8} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe [2010-02-25] (TuneUp Software)
Task: {EDE6EA0F-E7B6-412F-A65F-6F6538A4E600} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Device Center\itype.exe [2012-06-26] (Microsoft Corporation)
Task: {EF9312CE-2898-4DEE-BC91-CA7EE8699639} - System32\Tasks\{AD31FAF5-537A-4574-B1CB-19F5249626DE} => pcalua.exe -a G:\setup.exe -d G:\
Task: {F362E1DE-5AC5-4931-B2ED-449353CF5EDD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Device Center\ipoint.exe [2012-06-26] (Microsoft Corporation)
Task: {FE016CB2-7878-477F-9259-4C5D6E6D6C27} - System32\Tasks\InstallShield Software-Aktualisierungsdienst => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [2004-06-16] (InstallShield Software Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2012-09-28 16:44 - 2012-09-28 16:44 - 00210944 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2012-09-23 14:53 - 2012-09-23 14:53 - 00748544 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2012-09-23 14:53 - 2012-09-23 14:53 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2012-12-07 18:27 - 2012-12-07 18:27 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2013-05-17 12:23 - 2013-05-17 12:23 - 00169312 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
2012-05-29 10:06 - 2012-05-29 10:06 - 00655360 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
2014-12-26 15:50 - 2013-06-06 04:09 - 01185048 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2012-09-28 16:43 - 2012-09-28 16:43 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00030056 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00607376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00044392 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00036216 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll
2013-05-17 12:23 - 2013-05-17 12:23 - 00080248 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\ninstallerhelper.dll
2013-05-17 12:27 - 2013-05-17 12:27 - 00223592 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll
2013-12-26 17:03 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-12-26 17:03 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-12-26 17:03 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-12-26 17:03 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-12-26 17:03 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00104448 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00516599 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00094208 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00393216 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00151552 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00172032 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00559244 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 01515520 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll
2014-11-23 19:36 - 2014-11-23 19:36 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-03-25 15:23 - 2015-03-10 08:37 - 00775680 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-29 16:46 - 2014-12-02 02:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-29 16:46 - 2014-12-02 02:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-29 16:46 - 2014-12-02 02:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-05-23 01:16 - 2015-03-24 06:22 - 02371776 _____ () C:\Program Files (x86)\Steam\video.dll
2014-11-01 13:09 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-11-01 13:09 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-11-01 13:09 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-11-01 13:09 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-11-01 13:09 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2012-07-16 18:41 - 2015-03-24 06:22 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2000-04-28 15:50 - 2015-02-25 03:58 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-08-27 23:19 - 2015-02-25 03:58 - 01709960 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
2014-05-18 19:49 - 2014-05-18 19:49 - 00059904 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\zlib1.dll
2014-05-18 19:33 - 2014-12-20 02:52 - 00822784 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\CvLocalizationWin32Final Release.dll
2014-05-18 19:33 - 2014-12-20 02:52 - 00579584 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\CvGameDatabaseWin32Final Release.dll
2014-05-18 19:46 - 2014-05-18 19:46 - 00151040 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\lua51_Win32.dll
2010-03-21 16:22 - 2015-03-24 06:22 - 00363712 _____ () C:\Program Files (x86)\Steam\steam.dll
2014-05-18 19:41 - 2014-05-18 19:41 - 00047616 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\binkawin.asi
2014-05-18 19:49 - 2014-05-18 19:49 - 00078336 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\mssmp3.asi
2014-05-18 19:41 - 2014-05-18 19:41 - 00041472 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\mssogg.asi
2014-05-18 19:47 - 2014-05-18 19:47 - 00153600 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\mssvoice.asi
2014-05-18 19:49 - 2014-05-18 19:49 - 00013312 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\mssds3d.flt
2014-05-18 19:41 - 2014-05-18 19:41 - 00060416 _____ () C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization V\Miles\win32\msseax.flt
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.0.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AcrSch2Svc => 2
MSCONFIG\Services: afcdpsrv => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LOLRecorder.lnk => C:\Windows\pss\LOLRecorder.lnk.CommonStartup
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Facebook Update => "C:\Users\demax.yusuf\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HTC Sync Loader => "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: TrueImageMonitor.exe => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
MSCONFIG\startupreg: Zune Launcher => "c:\Program Files\Zune\ZuneLauncher.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-2419162032-26975598-1423618793-500 - Administrator - Disabled)
demax.yusuf (S-1-5-21-2419162032-26975598-1423618793-1001 - Administrator - Enabled) => C:\Users\demax.yusuf
Gast (S-1-5-21-2419162032-26975598-1423618793-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2419162032-26975598-1423618793-1002 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/30/2015 02:51:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xcd4
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/29/2015 01:42:27 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (03/28/2015 03:52:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x708
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/28/2015 03:42:06 PM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (01/01/2002 05:16:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xd98
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/27/2015 04:04:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e50
Startzeit: 01d068323a685cb4
Endzeit: 1730
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 90ae2fdd-d425-11e4-8234-00248c78e994
Error: (03/27/2015 04:04:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x590
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/26/2015 10:23:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xab4
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/26/2015 01:43:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xb48
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/26/2015 04:48:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xd88
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
System errors:
=============
Error: (03/30/2015 02:50:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SVKP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/30/2015 02:50:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/28/2015 03:05:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SVKP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/28/2015 03:05:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/01/2002 05:16:10 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Error: (01/01/2002 05:15:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SVKP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/01/2002 05:15:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/27/2015 04:03:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/27/2015 04:02:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SVKP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/27/2015 04:02:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (03/30/2015 02:51:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000cd401d06ae8347f82e5C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown875e7561-d6db-11e4-b5a6-00248c78e994
Error: (03/29/2015 01:42:27 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: c:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exec:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exe2
Error: (03/28/2015 03:52:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c00000050000000070801d0695e5ed4275bC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown9d75dff7-d551-11e4-a4d9-00248c78e994
Error: (03/28/2015 03:42:06 PM) (Source: SideBySide) (EventID: 75) (User: )
Description: c:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exec:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exe2
Error: (01/01/2002 05:16:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000d9801c19272a8928b32C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknownf6963ed1-fe65-11d5-819a-00248c78e994
Error: (03/27/2015 04:04:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.17567e5001d068323a685cb41730C:\Windows\Explorer.EXE90ae2fdd-d425-11e4-8234-00248c78e994
Error: (03/27/2015 04:04:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c00000050000000059001d068323d6dfbedC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown893a39ad-d425-11e4-8234-00248c78e994
Error: (03/26/2015 10:23:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000ab401d06802c206efefC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown03f023dc-d3f6-11e4-83b7-00248c78e994
Error: (03/26/2015 01:43:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000b4801d067ba08594ea2C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown616bd6c3-d3ad-11e4-b6f0-00248c78e994
Error: (03/26/2015 04:48:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000d8801d0676f5ab7bd6dC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown9a61fd14-d362-11e4-bbfc-00248c78e994
CodeIntegrity Errors:
===================================
Date: 2013-03-11 21:44:56.905
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 21:33:46.874
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 21:27:58.597
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 16:28:45.007
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 23:50:19.188
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 16:20:34.419
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 15:09:55.252
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 15:09:28.434
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 03:52:51.758
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-09 21:42:05.925
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 955 Processor
Percentage of memory in use: 68%
Total physical RAM: 4095.18 MB
Available physical RAM: 1276.89 MB
Total Pagefile: 8188.55 MB
Available Pagefile: 2820.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:351.93 GB) (Free:176.58 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive y: (Volume) (Fixed) (Total:244.14 GB) (Free:231.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: F1A34866)
Partition 1: (Active) - (Size=351.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=244.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
30.03.2015, 17:35
| #4 | |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java TernewbZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.03.2015, 18:06
| #5 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Ok. Erledigt |
|
31.03.2015, 05:11
| #6 |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb FRST öffnen , Haken setzen bei Addition und scannen, poste bitte beide Logs.
__________________ --> Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb |
|
31.03.2015, 14:16
| #7 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Hier bitte FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by demax.yusuf (administrator) on DEMAXYUSUF-PC on 31-03-2015 15:04:01
Running from C:\Users\demax.yusuf\Downloads
Loaded Profiles: demax.yusuf (Available profiles: demax.yusuf)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(Creative Technology Ltd.) C:\Windows\V0700Mon.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [362032 2009-11-12] (Acronis)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [V0700Mon.exe] => C:\Windows\V0700Mon.exe [28672 2011-08-22] (Creative Technology Ltd.)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [655360 2012-05-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-16] (InstallShield Software Corporation)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17e9-2f9b-11df-a9b0-00248c78e994} - H:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17ea-2f9b-11df-a9b0-00248c78e994} - I:\autorun.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {300f17eb-2f9b-11df-a9b0-00248c78e994} - J:\autorun.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {875da29f-6290-11e3-8968-00248c78e994} - D:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\MountPoints2: {875da2a4-6290-11e3-8968-00248c78e994} - D:\HTC_Sync_Manager_PC.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-05-23] (DivX, LLC)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-25] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-25] (Oracle Corporation)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll [523344] (Avira Operations GmbH & Co. KG)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-08] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-08] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-05-25] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=8 -> C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2419162032-26975598-1423618793-1001: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF user.js: detected! => C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\user.js [2010-03-14]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2010-07-27] (Apple Inc.)
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-images.xml [2014-10-09]
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-maps.xml [2014-10-09]
FF Extension: Avira Browser Safety - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\abs@avira.com [2015-03-22]
FF Extension: LoL eSport Countdown - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\deihjamdkpkfnhlaebfphjfahlfefmnh@slicefactory.com [2013-02-07]
FF Extension: Bitdefender QuickScan - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-07-18]
FF Extension: Cliqz Beta - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\cliqz@cliqz.com.xpi [2014-10-11]
FF Extension: convert2mp3.net YouTube2MP3 Converter - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\info@convert2mp3.net.xpi [2013-07-29]
FF Extension: Lightbeam - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-02-06]
FF Extension: Adblock Plus - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14]
FF Extension: Greasemonkey - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-24]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-11-23]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-09-18]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-01]
CHR Extension: (Google Drive) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-01]
CHR Extension: (YouTube) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-01]
CHR Extension: (Google Search) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-01]
CHR Extension: (AdBlock) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-09]
CHR Extension: (Google Wallet) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-06-01]
CHR Extension: (Gmail) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-01]
CHR HKU\S-1-5-21-2419162032-26975598-1423618793-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-22] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-22] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-01-29] (Nero AG)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2010-03-14] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1398088 2010-02-25] (TuneUp Software)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
U2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [598808 2013-06-06] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-03-15] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-03-15] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-10] (Duplex Secure Ltd.)
S2 SVKP; C:\Windows\SysWOW64\SVKP.sys [2368 2013-02-21] (AntiCracking) [File not signed]
R0 tdrpman258; C:\Windows\System32\DRIVERS\tdrpm258.sys [1477728 2010-03-14] (Acronis)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2010-02-25] (TuneUp Software)
R3 V0700Vid; C:\Windows\System32\DRIVERS\V0700Vid.sys [393920 2011-09-06] (Creative Technology Ltd.)
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-30 15:01 - 2015-03-30 15:05 - 00045096 _____ () C:\Users\demax.yusuf\Downloads\Addition.txt
2015-03-30 14:57 - 2015-03-31 15:05 - 00024413 _____ () C:\Users\demax.yusuf\Downloads\FRST.txt
2015-03-30 14:56 - 2015-03-31 15:04 - 00000000 ____D () C:\FRST
2015-03-30 14:55 - 2015-03-30 14:55 - 02095616 _____ (Farbar) C:\Users\demax.yusuf\Downloads\FRST64.exe
2015-03-24 19:48 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-24 19:48 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-22 22:50 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-22 22:50 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-22 22:50 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-22 22:50 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-22 22:50 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-22 22:50 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-22 22:50 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-22 22:50 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-22 22:50 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-22 22:50 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-22 22:50 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-22 22:49 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-22 22:49 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-22 22:49 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-22 22:48 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-22 22:48 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-22 22:48 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-22 22:48 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-22 22:48 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-22 22:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-22 22:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-22 22:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-22 22:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-22 22:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-22 22:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-22 22:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-22 22:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-22 22:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-22 22:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-22 22:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-22 22:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-22 22:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-22 22:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-22 22:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-22 22:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-22 22:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-22 22:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-22 22:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-22 22:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-22 22:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-22 22:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-22 22:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-22 22:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-22 22:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-22 22:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-22 22:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-22 22:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-22 22:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-22 22:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-22 22:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-22 22:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-22 22:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-04 21:39 - 2015-01-09 05:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-03-04 21:39 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-31 15:03 - 2010-11-25 20:13 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Skype
2015-03-31 15:01 - 2013-06-22 14:30 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\HTC MediaHub
2015-03-31 15:01 - 2012-07-10 04:31 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\Htc
2015-03-31 15:00 - 2013-01-07 18:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-31 15:00 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-31 15:00 - 2009-07-14 06:51 - 00212027 _____ () C:\Windows\setupact.log
2015-03-31 04:27 - 2010-03-14 11:12 - 01298576 _____ () C:\Windows\WindowsUpdate.log
2015-03-31 03:47 - 2013-01-14 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-31 03:38 - 2013-01-07 18:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-30 19:15 - 2000-06-26 16:10 - 00000000 ____D () C:\ProgramData\Adobe
2015-03-30 19:14 - 2000-06-26 16:09 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-03-30 19:13 - 2010-07-18 23:09 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-03-30 15:04 - 2012-05-13 12:12 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\TS3Client
2015-03-30 15:02 - 2010-03-21 14:38 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-30 14:59 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-30 14:59 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-30 14:57 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-03-30 14:57 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-03-30 14:57 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-28 15:05 - 2014-05-10 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2015-03-28 15:05 - 2010-03-16 08:39 - 00220140 _____ () C:\Windows\PFRO.log
2015-03-28 02:52 - 2010-03-14 21:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-28 02:52 - 2000-05-13 11:19 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Ubisoft
2015-03-28 02:50 - 2013-07-29 12:47 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\DVDVideoSoft
2015-03-25 20:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-25 04:19 - 2014-12-12 16:25 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-25 04:19 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:29 - 2009-07-14 06:45 - 04857072 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-23 02:01 - 2013-07-29 13:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-23 01:57 - 2010-03-19 18:36 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-22 22:28 - 2013-07-31 22:10 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-05 04:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
==================== Files in the root of some directories =======
2011-05-22 15:03 - 2011-05-22 15:04 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe GIF Format CS5 Prefs
2010-07-19 00:00 - 2013-02-01 10:49 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-10-09 13:18 - 2014-11-02 19:52 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Roaming\winscp.rnd
2014-10-09 12:53 - 2014-11-02 19:48 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Local\PUTTY.RND
2010-03-14 21:55 - 2010-03-14 21:55 - 0000017 _____ () C:\Users\demax.yusuf\AppData\Local\resmon.resmoncfg
2010-11-25 20:19 - 2010-11-25 20:19 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
Files to move or delete:
====================
C:\Users\demax.yusuf\jagex_cl_oldschool_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE1.dat
C:\Users\demax.yusuf\jagex_runescape_preferences.dat
C:\Users\demax.yusuf\jagex_runescape_preferences2.dat
C:\Users\demax.yusuf\jagex__preferences3.dat
C:\Users\demax.yusuf\random.dat
Some content of TEMP:
====================
C:\Users\demax.yusuf\AppData\Local\Temp\avgnt.exe
C:\Users\demax.yusuf\AppData\Local\Temp\drm_dialogs.dll
C:\Users\demax.yusuf\AppData\Local\Temp\DSSExp.exe
C:\Users\demax.yusuf\AppData\Local\Temp\Nexus%20Mod%20Manager-0.49.8.exe
C:\Users\demax.yusuf\AppData\Local\Temp\SkypeSetup.exe
C:\Users\demax.yusuf\AppData\Local\Temp\tmd_34012390.exe
C:\Users\demax.yusuf\AppData\Local\Temp\tmd_34012710.exe
C:\Users\demax.yusuf\AppData\Local\Temp\y6yyzunj.dll
C:\Users\demax.yusuf\AppData\Local\Temp\_is6089.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is6EBB.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is87A8.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8882.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8CB7.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is8FA4.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_is907.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isADED.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isC7C4.exe
C:\Users\demax.yusuf\AppData\Local\Temp\_isE551.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 20:12
==================== End Of Log ============================
und die Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by demax.yusuf at 2015-03-31 15:13:11
Running from C:\Users\demax.yusuf\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acronis*True*Image*Home (HKLM-x32\...\{67ED38A3-4882-448B-B44D-3428AB00D7D5}) (Version: 13.0.6053 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.01) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.01 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.656 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)
Creative Live! Cam Chat HD (VF0700) (1.00.06.00) (HKLM\...\Creative VF0700) (Version: - Creative Technology Ltd.)
Dev-C++ 5 beta 9 release (4.9.9.2) (HKLM-x32\...\Dev-C++) (Version: - )
Die Siedler III Gold Edition (HKLM-x32\...\S3) (Version: - )
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.0.34 - DivX, LLC)
GameRanger (HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\GameRanger) (Version: - GameRanger Technologies)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Gothic (HKLM-x32\...\Gothic) (Version: 1.32 - JoWooD Software Productions AG)
Gothic II Gold (HKLM-x32\...\{92510C2A-30E3-4F8D-AE8A-93AB7B63EE8F}) (Version: 2.5.0 - JoWooD Productions Software AG)
Gothic III (HKLM-x32\...\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}) (Version: 1.0.0 - JoWooD Productions Software AG)
Gothic III Release Update (HKLM-x32\...\{1998BD34-1AAB-4169-ACFF-67342E2AF9B4}) (Version: 1.00.0000 - JoWooD Productions Software AG)
Hotfix für Microsoft Visual C++ 2010 Express - DEU (KB2635973) (HKLM-x32\...\{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}.KB2635973) (Version: 1 - Microsoft Corporation)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Sync (HKLM-x32\...\{1F9E5C64-165D-4679-BBB3-498D216D017B}) (Version: 3.3.7 - HTC Corporation)
HTC Sync Manager (HKLM-x32\...\{5002C5B1-B688-474A-AB3A-9B65DBD38FF9}) (Version: 2.0.60.0 - HTC)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
iTunes (HKLM\...\{A04DCB25-7040-4935-A30D-8E0A893ABF2D}) (Version: 11.1.2.32 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JDownloader (HKLM-x32\...\JDownloader) (Version: 0.89 - AppWork UG (haftungsbeschränkt))
League of Legends (HKLM-x32\...\{918A9082-6287-4D25-9002-5E5D5E4971CB}) (Version: 1.02.0000 - Riot Games)
M4-78 Enhancement Project (HKLM-x32\...\The Sith Lords Restored Content Mod_is1) (Version: - )
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - DEU (HKLM-x32\...\Microsoft Visual C++ 2010 Express - DEU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 1.1.500.0 - Microsoft Corporation)
Might and Magic® VI (HKLM-x32\...\Might and Magic® VI) (Version: - )
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.49.8 - Black Tree Gaming)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
QuickTime (HKLM-x32\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
Shutdowner Version 2.0.2 (HKLM-x32\...\{08CF87BD-F3CD-4D6B-A0F1-9CE86DEF3407}_is1) (Version: 2.0.2 - Scriptinggamer)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Simon the Sorcerer (HKLM-x32\...\Simon the Sorcerer_is1) (Version: - GOG.com)
Simon the Sorcerer 2 (HKLM-x32\...\Simon the Sorcerer 2_is1) (Version: - GOG.com)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Star Wars Battlefront II (HKLM-x32\...\{3D374523-CFDE-461A-827E-2A102E2AB365}) (Version: 1.0 - LucasArts)
Star Wars Empire at War (HKLM-x32\...\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}) (Version: 1.0 - LucasArts)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Star Wars® Knights of the Old Republic Series Version 1.0 Windows 7 (HKLM-x32\...\{78AEEF25-88AA-453A-B2CC-446FE42AA08F}_is1) (Version: 1.0 Windows 7 - Lucas Arts®)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11.1 - TeamSpeak Systems GmbH)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Lord of the Rings FREE Trial (x32 Version: 1.00.0000 - ATI Technologies Inc.) Hidden
ThielHater's Texturepatch v1.0.2 (HKLM-x32\...\ThielHater's Texturepatch_is1) (Version: 1.0 - ThielHater © 2007-2009)
TightVNC (HKLM\...\{BC994A59-6E98-4203-8A35-819938DD5ED1}) (Version: 2.5.2.0 - GlavSoft LLC.)
TuneUp Utilities (HKLM-x32\...\TuneUp Utilities) (Version: 9.0.4030.5 - TuneUp Software)
TuneUp Utilities (x32 Version: 9.0.4030.5 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.4030.5 - TuneUp Software) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 1.0.5 (HKLM-x32\...\VLC media player) (Version: 1.0.5 - VideoLAN Team)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.6-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.3 - Wacom Technology Corp.)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
WinSCP 5.5.5 (HKLM-x32\...\winscp3_is1) (Version: 5.5.5 - Martin Prikryl)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-2419162032-26975598-1423618793-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Restore Points =========================
28-03-2015 15:11:22 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2010-07-18 23:19 - 2010-07-18 23:18 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {182BEAEE-3D7B-4B6C-83ED-B546FDBCAAB1} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-18] (Adobe Systems Incorporated)
Task: {1DA82136-558F-4256-98F4-8EDFD3B5BF97} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17] (Oracle Corporation)
Task: {3C6AAAC3-55AA-4053-8658-EF543231E164} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {40067252-BA55-44E8-8790-AE56CFA4CDA8} - System32\Tasks\AdobeAAMUpdater-1.0-demaxyusuf-PC-demax.yusuf => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {4C4C39B9-3EDD-4ACD-AFFF-2E71011E1A45} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-08] (Adobe Systems Incorporated)
Task: {5ABEC71D-C373-4492-A27C-ECE9A8B68EB4} - System32\Tasks\{2F5D1FC8-7168-4A7F-B025-BDC2135EB0A5} => C:\Program Files (x86)\Hubert Ebner Verlag\STEIG EIN\Vogel.SteigEin.exe [2013-03-05] (Hubert Ebner Verlags GmbH)
Task: {5E643B84-816C-4A76-80BB-735467FD68BE} - System32\Tasks\{6C6C9C3F-C8A5-40CB-98D9-88ACB6B6D8B9} => C:\Program Files (x86)\LucasArts\Star Wars Battlefront II\GameData\BattlefrontII.exe [2005-12-25] ()
Task: {621FCD71-AD23-481C-9163-27E6CBA26FEA} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {62FEEF89-14C0-44DF-8F7D-643DAE807758} - System32\Tasks\{1876A9C8-5AD0-43A1-8005-F5F96EC34315} => G:\SETUP.EXE
Task: {685CF73D-A3C6-4BE2-BBF8-D848E2688536} - System32\Tasks\{B8C255A1-F8C3-4B37-9FCB-702172449023} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/10
Task: {7EA5D474-5EB4-4EFD-86B6-E8279C537B5C} - System32\Tasks\{8BBBBDE5-47C2-4A2D-9EF2-E86C0A932A85} => pcalua.exe -a C:\Users\demax.yusuf\Downloads\mm710-11.exe -d C:\Users\demax.yusuf\Downloads
Task: {987E4598-6DDA-41AD-81E2-3931197045A5} - System32\Tasks\{53F666C0-DE25-4B12-92F0-A84CC1573CF4} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-08-27] (Skype Technologies S.A.)
Task: {A05121B3-A723-4A55-9DDD-51136E5F22D8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07] (Google Inc.)
Task: {A1FC8F1D-1192-4113-BED7-D0101041F4CF} - System32\Tasks\{EF3FCBD7-88DF-4F8A-912B-937FE8F72FE3} => pcalua.exe -a C:\Users\demax.yusuf\Downloads\uniws\uniws.exe -d C:\Users\demax.yusuf\Downloads\uniws
Task: {B5F3135B-C4A7-47E2-8435-40CD34D96B37} - System32\Tasks\{65F2A2CE-DD9A-46F7-A5CB-EB044B64A7DB} => C:\Program Files (x86)\LucasArts\SWKotOR2\swkotor2.exe
Task: {BF1320AA-E97E-4018-A02D-8956BBD04777} - System32\Tasks\{8A87C0C7-4EEF-4EDC-9808-C1B29646628E} => C:\Program Files\LucasArts\SWKotOR\swkotor.exe
Task: {CC0E8313-3399-4A12-8EF9-BF136E50DA42} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2012-05-29] ()
Task: {D03906BC-F218-4184-B92B-D1B595EB3B7F} - System32\Tasks\{4B77ADDB-1759-4214-88FA-383412F523C6} => C:\Program Files (x86)\JoWooD Productions Software AG\Gothic II Gold\System\Gothic2.exe [2011-12-16] (Piranha Bytes)
Task: {DB196B70-2E29-4B2B-8052-EA854D5AA3DE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {DE0F20A1-1DC6-4ED8-8451-372FEA42BCC8} - System32\Tasks\{E4ED572C-BD8F-41DA-864B-033DFCC33B4E} => C:\Program Files (x86)\JoWooD Productions Software AG\Gothic II Gold\System\Gothic2.exe [2011-12-16] (Piranha Bytes)
Task: {DEA0E1A2-E882-4516-9FFC-20DADBB817FB} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe [2012-06-26] (Microsoft)
Task: {DEF6869C-D451-400D-8EA6-6BFF62F56DC8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E7C25515-4A7D-470F-98D9-26F66B21B12E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07] (Google Inc.)
Task: {E8EC0422-9DFB-468B-A446-9EFEEF7C27D3} - System32\Tasks\{F5F157E9-6311-4A59-89F0-1BB370E6D488} => C:\Program Files (x86)\Hubert Ebner Verlag\STEIG EIN\Vogel.SteigEin.exe [2013-03-05] (Hubert Ebner Verlags GmbH)
Task: {EB831A32-674B-42FB-89AF-7AFC72627EB8} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe [2010-02-25] (TuneUp Software)
Task: {EDE6EA0F-E7B6-412F-A65F-6F6538A4E600} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Device Center\itype.exe [2012-06-26] (Microsoft Corporation)
Task: {EF9312CE-2898-4DEE-BC91-CA7EE8699639} - System32\Tasks\{AD31FAF5-537A-4574-B1CB-19F5249626DE} => pcalua.exe -a G:\setup.exe -d G:\
Task: {F362E1DE-5AC5-4931-B2ED-449353CF5EDD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Device Center\ipoint.exe [2012-06-26] (Microsoft Corporation)
Task: {FE016CB2-7878-477F-9259-4C5D6E6D6C27} - System32\Tasks\InstallShield Software-Aktualisierungsdienst => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [2004-06-16] (InstallShield Software Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2012-12-07 18:27 - 2012-12-07 18:27 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
2010-03-14 22:37 - 2010-02-10 19:10 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2013-05-17 12:23 - 2013-05-17 12:23 - 00169312 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
2012-05-29 10:06 - 2012-05-29 10:06 - 00655360 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
2014-12-26 15:50 - 2013-06-06 04:09 - 01185048 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00030056 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00607376 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00044392 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll
2013-05-17 12:22 - 2013-05-17 12:22 - 00036216 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll
2013-05-17 12:23 - 2013-05-17 12:23 - 00080248 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\ninstallerhelper.dll
2013-05-17 12:27 - 2013-05-17 12:27 - 00223592 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00104448 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00516599 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00094208 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00393216 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00151552 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00172032 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 00559244 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll
2012-05-29 10:06 - 2012-05-29 10:06 - 01515520 _____ () C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll
2013-12-26 17:03 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-12-26 17:03 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-11-23 19:36 - 2014-11-23 19:36 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.0.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: AcrSch2Svc => 2
MSCONFIG\Services: afcdpsrv => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LOLRecorder.lnk => C:\Windows\pss\LOLRecorder.lnk.CommonStartup
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Facebook Update => "C:\Users\demax.yusuf\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HTC Sync Loader => "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: TrueImageMonitor.exe => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
MSCONFIG\startupreg: Zune Launcher => "c:\Program Files\Zune\ZuneLauncher.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-2419162032-26975598-1423618793-500 - Administrator - Disabled)
demax.yusuf (S-1-5-21-2419162032-26975598-1423618793-1001 - Administrator - Enabled) => C:\Users\demax.yusuf
Gast (S-1-5-21-2419162032-26975598-1423618793-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2419162032-26975598-1423618793-1002 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/31/2015 03:01:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xb18
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/30/2015 02:51:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xcd4
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/29/2015 01:42:27 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (03/28/2015 03:52:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x708
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/28/2015 03:42:06 PM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (01/01/2002 05:16:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xd98
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/27/2015 04:04:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e50
Startzeit: 01d068323a685cb4
Endzeit: 1730
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 90ae2fdd-d425-11e4-8234-00248c78e994
Error: (03/27/2015 04:04:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x590
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/26/2015 10:23:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xab4
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
Error: (03/26/2015 01:43:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: kdbsync.exe, Version: 0.0.0.0, Zeitstempel: 0x4f27c7d5
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xb48
Startzeit der fehlerhaften Anwendung: 0xkdbsync.exe0
Pfad der fehlerhaften Anwendung: kdbsync.exe1
Pfad des fehlerhaften Moduls: kdbsync.exe2
Berichtskennung: kdbsync.exe3
System errors:
=============
Error: (03/31/2015 03:03:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (03/31/2015 03:03:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (03/31/2015 03:02:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/31/2015 03:02:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (03/31/2015 03:02:43 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Updating Service erreicht.
Error: (03/31/2015 03:01:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SVKP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/31/2015 03:01:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (03/31/2015 03:01:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
Error: (03/31/2015 03:00:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/31/2015 04:26:40 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Microsoft Office Sessions:
=========================
Error: (03/31/2015 03:01:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000b1801d06bb2b5988c50C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown0c262e65-d7a6-11e4-af2e-00248c78e994
Error: (03/30/2015 02:51:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000cd401d06ae8347f82e5C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown875e7561-d6db-11e4-b5a6-00248c78e994
Error: (03/29/2015 01:42:27 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: c:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exec:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exe2
Error: (03/28/2015 03:52:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c00000050000000070801d0695e5ed4275bC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown9d75dff7-d551-11e4-a4d9-00248c78e994
Error: (03/28/2015 03:42:06 PM) (Source: SideBySide) (EventID: 75) (User: )
Description: c:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exec:\program files (x86)\Skype\Toolbars\internet explorer\SkypeIEPluginBroker.exe2
Error: (01/01/2002 05:16:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000d9801c19272a8928b32C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknownf6963ed1-fe65-11d5-819a-00248c78e994
Error: (03/27/2015 04:04:33 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.17567e5001d068323a685cb41730C:\Windows\Explorer.EXE90ae2fdd-d425-11e4-8234-00248c78e994
Error: (03/27/2015 04:04:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c00000050000000059001d068323d6dfbedC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown893a39ad-d425-11e4-8234-00248c78e994
Error: (03/26/2015 10:23:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000ab401d06802c206efefC:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown03f023dc-d3f6-11e4-83b7-00248c78e994
Error: (03/26/2015 01:43:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: kdbsync.exe0.0.0.04f27c7d5unknown0.0.0.000000000c000000500000000b4801d067ba08594ea2C:\Program Files (x86)\AMD AVT\bin\kdbsync.exeunknown616bd6c3-d3ad-11e4-b6f0-00248c78e994
CodeIntegrity Errors:
===================================
Date: 2013-03-11 21:44:56.905
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 21:33:46.874
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 21:27:58.597
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-11 16:28:45.007
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 23:50:19.188
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 16:20:34.419
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 15:09:55.252
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 15:09:28.434
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-10 03:52:51.758
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-03-09 21:42:05.925
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\CTAFX64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 955 Processor
Percentage of memory in use: 40%
Total physical RAM: 4095.18 MB
Available physical RAM: 2443.48 MB
Total Pagefile: 8188.55 MB
Available Pagefile: 5799.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:351.93 GB) (Free:178.32 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive y: (Volume) (Fixed) (Total:244.14 GB) (Free:231.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: F1A34866)
Partition 1: (Active) - (Size=351.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=244.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
lg |
|
01.04.2015, 05:15
| #8 |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.04.2015, 01:34
| #9 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Soo, Combifix arbeitet. Er hat anfangs angeschlagen, dass Spybot noch läuft, dann habe ich einfach alle Prozesse von Spybot beendet und dann ging es. Eine Frage habe ich allerdings. Und zwar: Wie beende ich Avira komplett? Ich habe den Echtzeitscanner ausgeschaltet und alle Prozesse beendet, allerdings ließen sich 2 Prozesse nicht beenden (auch mit admin Rechten nicht). Folgende Meldung (so ähnlich) habe ich erhalten: "Warnung! Avira hat einen unbekannten Zugriff auf die Registry blockiert." Stört das Combifix bei seiner arbeit? EDIT: Die Maus habe ich bewegt und auf das Avira Symbol geklickt wegen der Meldung :s, soll ich es nochmal drüberlaufen lassen? EDIT 2: Hier nun der LOG Code:
ATTFilter ComboFix 15-04-01.01 - demax.yusuf 02.04.2015 2:28.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.43.1031.18.4095.2756 [GMT 2:00]
ausgeführt von:: c:\users\demax.yusuf\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Program Files
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\launcher\launcher.ini
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\launcher\swlauncher.bmp
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\modules\401DXN_dlg.erf
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\modules\401DXN_s.rim
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\modules\702KOR_dlg.erf
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\modules\702KOR_s.rim
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\backup\modules\853NIH_s.rim
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\lips\301NAR_loc.mod
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\lips\303NAR_loc.mod
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\lips\602DAN_loc.mod
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\lips\605DAN_loc.mod
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\lips\610DAN_loc.mod
c:\program files (x86)\Program Files\LucasArts\SWKotOR2\StreamVoice\301\Tienn\301TIENN006.wav
c:\users\demax.yusuf\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\DEMAX~1.YUS\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-02 bis 2015-04-02 ))))))))))))))))))))))))))))))
.
.
2015-04-02 00:39 . 2015-04-02 00:39 -------- d-----w- c:\users\hedev\AppData\Local\temp
2015-04-02 00:39 . 2015-04-02 00:39 -------- d-----w- c:\users\DEMAX~1~YUS\AppData\Local\temp
2015-04-02 00:39 . 2015-04-02 00:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-04-01 10:16 . 2015-04-01 22:45 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{589FE074-66A2-40C6-9970-959302D43B78}\offreg.dll
2015-03-31 13:08 . 2015-03-14 10:02 12002392 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{589FE074-66A2-40C6-9970-959302D43B78}\mpengine.dll
2015-03-30 12:56 . 2015-03-31 13:13 -------- d-----w- C:\FRST
2015-03-24 17:48 . 2015-03-11 04:06 677888 ----a-w- c:\windows\system32\generaltel.dll
2015-03-24 17:48 . 2015-03-11 04:06 760832 ----a-w- c:\windows\system32\invagent.dll
2015-03-24 17:48 . 2015-03-11 04:06 414720 ----a-w- c:\windows\system32\devinv.dll
2015-03-24 17:48 . 2015-03-11 04:06 943616 ----a-w- c:\windows\system32\appraiser.dll
2015-03-24 17:48 . 2015-03-11 04:05 30720 ----a-w- c:\windows\system32\acmigration.dll
2015-03-24 17:48 . 2015-03-11 04:05 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-03-24 17:48 . 2015-03-11 04:05 192000 ----a-w- c:\windows\system32\aepic.dll
2015-03-24 17:48 . 2015-03-11 04:02 1107456 ----a-w- c:\windows\system32\aeinv.dll
2015-03-22 20:49 . 2015-02-03 03:31 37376 ----a-w- c:\windows\system32\pcadm.dll
2015-03-22 20:48 . 2015-02-03 03:31 215552 ----a-w- c:\windows\system32\ubpm.dll
2015-03-22 20:47 . 2015-01-17 02:48 1067520 ----a-w- c:\windows\system32\msctf.dll
2015-03-22 20:46 . 2015-02-04 03:16 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-22 20:46 . 2015-02-04 02:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-03-04 19:39 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-03-04 19:39 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-03-04 19:39 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-03-04 19:39 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-22 23:57 . 2010-03-19 16:36 122905848 ----a-w- c:\windows\system32\MRT.exe
2015-03-22 20:28 . 2013-07-31 20:09 44088 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-03-22 20:28 . 2013-07-31 20:09 132120 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-03-22 20:28 . 2013-07-31 20:09 128536 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-02-25 02:24 . 2014-05-17 03:02 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-02-24 03:17 . 2010-03-14 16:41 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-08 21:47 . 2012-06-30 10:35 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-08 21:47 . 2011-12-01 20:54 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-27 23:36 . 2015-02-12 08:56 1239720 ----a-w- c:\windows\system32\aitstatic.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-08-27 22041192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]
"V0700Mon.exe"="c:\windows\V0700Mon.exe" [2011-08-22 28672]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-05-29 655360]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-04-01 726320]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-01-19 126712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AML Device Install.lnk - c:\program files (x86)\AMD AVT\bin\kdbsync.exe aml [2012-1-31 10752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAVolume"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
R2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys;c:\windows\SYSNATIVE\SVKP.sys [x]
R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\DRIVERS\tdrpm258.sys;c:\windows\SYSNATIVE\DRIVERS\tdrpm258.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 HTCMonitorService;HTCMonitorService;c:\program files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe;c:\program files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [x]
S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe;c:\program files\TightVNC\tvnserver.exe [x]
S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe;c:\program files\Tablet\Wacom\WTabletServicePro.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [x]
S3 V0700Vid;Creative Live! Cam Chat HD Driver;c:\windows\system32\DRIVERS\V0700Vid.sys;c:\windows\SYSNATIVE\DRIVERS\V0700Vid.sys [x]
S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-03-22 20:49 1061704 ----a-w- c:\program files (x86)\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-30 21:47]
.
2015-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07 16:46]
.
2015-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-07 16:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-11-12 362032]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"IntelliType Pro"="c:\program files\Microsoft Device Center\itype.exe" [2012-06-26 1464928]
"IntelliPoint"="c:\program files\Microsoft Device Center\ipoint.exe" [2012-06-26 2004584]
"tvncontrol"="c:\program files\TightVNC\tvnserver.exe" [2012-06-26 1652280]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: network.http.max-persistent-connections-per-server - 4
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Might and Magic® VI - c:\windows\IsUn0407.exe
AddRemove-S3 - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
c:\program files\Tablet\Wacom\WacomHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-02 02:55:22 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-02 00:55
.
Vor Suchlauf: 16 Verzeichnis(se), 190.967.730.176 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 191.063.035.904 Bytes frei
.
- - End Of File - - 11CD066E4E4DDC18CCB7C457421AA495
A36C5E4F47E84449FF07ED3517B43A31
Danach habe ich es neu geöffnet und das Download-Symbol hat geblinkt. Dieses File wollte er herunterladen, was mir komisch vorkommt. Darunter steht "Fehlgeschlagen - moddb.com" Hier der Link (Hyperlink funktioniert nicht) hxxp://www.herdprotect.com/m478ep_1.1.exe-5657b00f8515306bc0de8ff7aa3cbe16ee67669d.aspx LG Geändert von himynameis (02.04.2015 um 02:13 Uhr) |
|
02.04.2015, 19:53
| #10 |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.04.2015, 01:30
| #11 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Vielen Dank für die Hilfe, hier sind die ganzen Logs. Mbam: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 02.04.2015 Suchlauf-Zeit: 22:48:06 Logdatei: mbam.txt Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.04.02.05 Rootkit Datenbank: v2015.03.31.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: demax.yusuf Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 404800 Verstrichene Zeit: 12 Min, 26 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 1 PUP.Optional.DVDVideoSoftTB.A, HKU\S-1-5-21-2419162032-26975598-1423618793-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nikpibnbobmbdbheedjfogjlikpgpnhp, In Quarantäne, [8c4193d4b3d7dc5a8b427a5a8b78956b], Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 Trojan.Agent, C:\Windows\SysWOW64\SVKP.sys, In Quarantäne, [2aa35c0b98f2ad89ec719a2f18ec4eb2], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.200 - Bericht erstellt 02/04/2015 um 23:36:58
# Aktualisiert 29/03/2015 von Xplode
# Datenbank : 2015-03-29.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : demax.yusuf - DEMAXYUSUF-PC
# Gestarted von : C:\Users\demax.yusuf\Desktop\AdwCleaner_4.200.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\demax.yusuf\AppData\Roaming\dvdvideosoftiehelpers
Datei Gelöscht : C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\user.js
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\dt soft\daemon tools toolbar
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17689
-\\ Mozilla Firefox v36.0.4 (x86 de)
[yxiaavno.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.facetweak.addit.remoteInstallItems", "{ \"software\": {\"7\": {\"id\": \"7\",\"title\": \"Billeo\",\"type\": \"XPI\",\"url\": \"hxxps://addons.mozilla.org/firefox/downloads/file/[...]
-\\ Google Chrome v41.0.2272.101
*************************
AdwCleaner[R0].txt - [2183 Bytes] - [02/04/2015 23:32:59]
AdwCleaner[S0].txt - [1953 Bytes] - [02/04/2015 23:36:58]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2012 Bytes] ##########
und hier noch JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.1 (04.02.2015:1)
OS: Windows 7 Professional x64
Ran by demax.yusuf on 02.04.2015 at 23:45:34,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\demax.yusuf\AppData\Roaming\mozilla\firefox\profiles\yxiaavno.default\minidumps [743 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.04.2015 at 23:49:26,47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
habe den FRST Log vergessen ist mir gerade eingefallen. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by demax.yusuf (administrator) on DEMAXYUSUF-PC on 03-04-2015 02:28:59 Running from C:\Users\demax.yusuf\Downloads Loaded Profiles: demax.yusuf & (Available profiles: demax.yusuf) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe (GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Creative Technology Ltd.) C:\Windows\V0700Mon.exe () C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated) HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation) HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [V0700Mon.exe] => C:\Windows\V0700Mon.exe [28672 2011-08-22] (Creative Technology Ltd.) HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [655360 2012-05-29] () HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Policies\Explorer: [HideSCAVolume] 0 HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [HideSCAVolume] 0 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk ShortcutTarget: AML Device Install.lnk -> C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe () BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2419162032-26975598-1423618793-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-05-23] (DivX, LLC) BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-25] (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-25] (Oracle Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-08] () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-08] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-05-25] (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-25] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-25] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=8 -> C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-12-18] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2419162032-26975598-1423618793-1001: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-12-18] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2010-07-27] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2010-07-27] (Apple Inc.) FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-images.xml [2014-10-09] FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-maps.xml [2014-10-09] FF Extension: Avira Browser Safety - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\abs@avira.com [2015-03-31] FF Extension: LoL eSport Countdown - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\deihjamdkpkfnhlaebfphjfahlfefmnh@slicefactory.com [2013-02-07] FF Extension: Bitdefender QuickScan - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-07-18] FF Extension: Cliqz Beta - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\cliqz@cliqz.com.xpi [2014-10-11] FF Extension: convert2mp3.net YouTube2MP3 Converter - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\info@convert2mp3.net.xpi [2013-07-29] FF Extension: Lightbeam - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-02-06] FF Extension: Adblock Plus - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14] FF Extension: Greasemonkey - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-24] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-04-02] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-09-18] FF HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\extensions\cliqz@cliqz.com FF HKU\S-1-5-21-2419162032-26975598-1423618793-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\extensions\cliqz@cliqz.com Chrome: ======= CHR Profile: C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-01] CHR Extension: (Google Drive) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-01] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-01] CHR Extension: (YouTube) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-01] CHR Extension: (Google Search) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-01] CHR Extension: (AdBlock) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-09] CHR Extension: (Google Wallet) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28] CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-06-01] CHR Extension: (Gmail) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-01] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) [File not signed] S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-01] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG) R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-01-29] (Nero AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [598808 2013-06-06] (Wacom Technology, Corp.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-03-15] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-22] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-22] (Avira Operations GmbH & Co. KG) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-03-15] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-03] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] () R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-10] (Duplex Secure Ltd.) R3 V0700Vid; C:\Windows\System32\DRIVERS\V0700Vid.sys [393920 2011-09-06] (Creative Technology Ltd.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X] S2 SVKP; \??\C:\Windows\system32\SVKP.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-02 23:49 - 2015-04-02 23:49 - 00000770 _____ () C:\Users\demax.yusuf\Desktop\JRT.txt 2015-04-02 23:45 - 2015-04-02 23:45 - 02690981 _____ (Thisisu) C:\Users\demax.yusuf\Desktop\JRT.exe 2015-04-02 23:45 - 2015-04-02 23:45 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-DEMAXYUSUF-PC-Windows-7-Professional-(64-bit).dat 2015-04-02 23:45 - 2015-04-02 23:45 - 00000000 ____D () C:\RegBackup 2015-04-02 23:44 - 2015-04-02 23:44 - 00001437 _____ () C:\Users\demax.yusuf\Desktop\mbam.txt 2015-04-02 23:32 - 2015-04-02 23:37 - 00000000 ____D () C:\AdwCleaner 2015-04-02 23:32 - 2015-04-02 23:32 - 02208768 _____ () C:\Users\demax.yusuf\Desktop\AdwCleaner_4.200.exe 2015-04-02 22:42 - 2015-04-03 01:29 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-04-02 22:42 - 2015-04-02 22:42 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\demax.yusuf\Desktop\mbam-setup-2.1.4.1018.exe 2015-04-02 22:42 - 2015-04-02 22:42 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-04-02 22:42 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-04-02 22:42 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-04-02 22:42 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-04-02 03:28 - 2015-04-02 03:28 - 00068006 _____ () C:\Users\demax.yusuf\Downloads\Shortcut.txt 2015-04-02 03:04 - 2015-04-02 03:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-04-02 02:55 - 2015-04-02 02:55 - 00021835 _____ () C:\ComboFix.txt 2015-04-02 02:25 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-04-02 02:25 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-04-02 02:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-04-02 02:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-04-02 02:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-04-02 02:25 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2015-04-02 02:25 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2015-04-02 02:25 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2015-04-02 02:21 - 2015-04-02 02:55 - 00000000 ____D () C:\Qoobox 2015-04-02 02:20 - 2015-04-02 02:52 - 00000000 ____D () C:\Windows\erdnt 2015-04-02 02:19 - 2015-04-02 02:19 - 05617096 ____R (Swearware) C:\Users\demax.yusuf\Desktop\ComboFix.exe 2015-03-30 15:01 - 2015-04-02 03:28 - 00040067 _____ () C:\Users\demax.yusuf\Downloads\Addition.txt 2015-03-30 14:57 - 2015-04-03 02:28 - 00022714 _____ () C:\Users\demax.yusuf\Downloads\FRST.txt 2015-03-30 14:56 - 2015-04-03 02:29 - 00000000 ____D () C:\FRST 2015-03-30 14:55 - 2015-03-30 14:55 - 02095616 _____ (Farbar) C:\Users\demax.yusuf\Downloads\FRST64.exe 2015-03-24 19:48 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-03-24 19:48 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-03-24 19:48 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-03-24 19:48 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-03-24 19:48 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-03-24 19:48 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-03-24 19:48 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll 2015-03-24 19:48 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-03-22 22:50 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2015-03-22 22:50 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2015-03-22 22:50 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-03-22 22:50 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2015-03-22 22:50 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2015-03-22 22:50 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2015-03-22 22:50 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2015-03-22 22:50 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2015-03-22 22:50 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-03-22 22:50 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2015-03-22 22:50 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2015-03-22 22:50 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-03-22 22:50 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-03-22 22:50 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2015-03-22 22:50 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-03-22 22:50 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2015-03-22 22:50 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-03-22 22:50 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-03-22 22:50 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2015-03-22 22:50 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2015-03-22 22:50 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-03-22 22:50 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-03-22 22:50 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-03-22 22:50 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2015-03-22 22:50 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe 2015-03-22 22:49 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-03-22 22:49 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2015-03-22 22:49 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe 2015-03-22 22:49 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe 2015-03-22 22:49 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll 2015-03-22 22:49 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-03-22 22:49 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2015-03-22 22:49 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys 2015-03-22 22:49 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll 2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx 2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll 2015-03-22 22:49 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2015-03-22 22:49 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2015-03-22 22:49 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2015-03-22 22:49 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2015-03-22 22:49 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-03-22 22:49 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2015-03-22 22:48 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-03-22 22:48 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-03-22 22:48 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-03-22 22:48 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-03-22 22:48 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-03-22 22:48 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-03-22 22:48 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-03-22 22:48 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-03-22 22:48 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-03-22 22:48 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-03-22 22:48 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-03-22 22:48 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-03-22 22:48 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-03-22 22:48 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-03-22 22:48 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-03-22 22:48 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2015-03-22 22:48 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll 2015-03-22 22:48 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-03-22 22:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-03-22 22:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-03-22 22:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-03-22 22:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-03-22 22:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-03-22 22:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-03-22 22:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-03-22 22:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-03-22 22:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-03-22 22:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-03-22 22:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-03-22 22:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-03-22 22:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-03-22 22:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-03-22 22:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-03-22 22:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-03-22 22:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-03-22 22:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-03-22 22:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-03-22 22:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-03-22 22:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-03-22 22:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-03-22 22:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-03-22 22:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-03-22 22:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-03-22 22:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-03-22 22:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-03-22 22:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-03-22 22:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-03-22 22:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-03-22 22:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-03-22 22:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-03-22 22:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-03-22 22:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-03-22 22:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-03-22 22:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-03-22 22:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-03-22 22:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-03-22 22:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-03-22 22:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-03-22 22:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-03-22 22:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-03-22 22:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-03-22 22:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-03-22 22:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-03-22 22:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-03-22 22:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-03-22 22:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-03-22 22:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-03-22 22:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-03-22 22:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-03-22 22:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-03-22 22:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-03-22 22:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-03-22 22:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-03-22 22:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-03-22 22:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-03-22 22:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-03-22 22:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-03-22 22:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-03-22 22:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll 2015-03-22 22:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2015-03-22 22:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2015-03-04 21:39 - 2015-01-09 05:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-03-04 21:39 - 2015-01-09 05:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-03-04 21:39 - 2015-01-09 05:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-03-04 21:39 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-03 01:47 - 2013-01-14 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-03 01:38 - 2013-01-07 18:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-03 00:44 - 2010-03-14 11:12 - 01492852 _____ () C:\Windows\WindowsUpdate.log 2015-04-03 00:00 - 2010-03-21 14:38 - 00000000 ____D () C:\Program Files (x86)\Steam 2015-04-02 23:47 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-02 23:47 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-02 23:45 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat 2015-04-02 23:45 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat 2015-04-02 23:45 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-02 23:41 - 2010-11-25 20:13 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Skype 2015-04-02 23:39 - 2013-06-22 14:30 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\HTC MediaHub 2015-04-02 23:39 - 2013-01-07 18:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-02 23:39 - 2012-07-10 04:31 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\Htc 2015-04-02 23:38 - 2010-03-16 08:39 - 00395028 _____ () C:\Windows\PFRO.log 2015-04-02 23:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-02 23:38 - 2009-07-14 06:51 - 00212363 _____ () C:\Windows\setupact.log 2015-04-02 23:23 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Offline Web Pages 2015-04-02 22:49 - 2010-03-14 19:55 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-04-02 13:54 - 2012-04-25 16:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-04-02 03:32 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-04-02 03:23 - 2011-06-12 11:56 - 00003934 _____ () C:\Windows\System32\Tasks\InstallShield Software-Aktualisierungsdienst 2015-04-02 03:18 - 2010-03-14 21:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-04-02 03:15 - 2012-12-09 16:31 - 00010295 _____ () C:\Users\demax.yusuf\Documents\Uninstall STAR WARS The Old Republic.log 2015-04-02 03:14 - 2011-01-13 19:46 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\GameRanger 2015-04-02 02:55 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2015-04-02 02:43 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2015-04-01 12:10 - 2013-07-31 22:15 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Avira 2015-04-01 12:09 - 2013-07-31 22:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-04-01 12:09 - 2013-07-31 22:09 - 00000000 ____D () C:\ProgramData\Avira 2015-03-31 15:12 - 2010-10-26 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gothic III 2015-03-30 19:15 - 2000-06-26 16:10 - 00000000 ____D () C:\ProgramData\Adobe 2015-03-30 19:14 - 2000-06-26 16:09 - 00000000 ____D () C:\Program Files (x86)\Adobe 2015-03-30 19:13 - 2010-07-18 23:09 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-03-30 15:04 - 2012-05-13 12:12 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\TS3Client 2015-03-28 15:05 - 2014-05-10 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite 2015-03-28 02:52 - 2000-05-13 11:19 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Ubisoft 2015-03-28 02:50 - 2013-07-29 12:47 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\DVDVideoSoft 2015-03-25 20:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2015-03-25 04:19 - 2014-12-12 16:25 - 00000000 ____D () C:\Windows\system32\appraiser 2015-03-25 04:19 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-03-24 19:29 - 2009-07-14 06:45 - 04857072 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism 2015-03-23 02:01 - 2013-07-29 13:14 - 00000000 ____D () C:\Windows\system32\MRT 2015-03-23 01:57 - 2010-03-19 18:36 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-03-22 22:28 - 2013-07-31 22:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-03-22 22:28 - 2013-07-31 22:09 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-03-22 22:28 - 2013-07-31 22:09 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-03-05 04:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing ==================== Files in the root of some directories ======= 2011-05-22 15:03 - 2011-05-22 15:04 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe GIF Format CS5 Prefs 2010-07-19 00:00 - 2013-02-01 10:49 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe PNG Format CS5 Prefs 2014-10-09 13:18 - 2014-11-02 19:52 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Roaming\winscp.rnd 2014-10-09 12:53 - 2014-11-02 19:48 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Local\PUTTY.RND 2010-03-14 21:55 - 2010-03-14 21:55 - 0000017 _____ () C:\Users\demax.yusuf\AppData\Local\resmon.resmoncfg 2010-11-25 20:19 - 2010-11-25 20:19 - 0000056 ____H () C:\ProgramData\ezsidmv.dat Files to move or delete: ==================== C:\Users\demax.yusuf\jagex_cl_oldschool_LIVE.dat C:\Users\demax.yusuf\jagex_cl_runescape_LIVE.dat C:\Users\demax.yusuf\jagex_cl_runescape_LIVE1.dat C:\Users\demax.yusuf\jagex_runescape_preferences.dat C:\Users\demax.yusuf\jagex_runescape_preferences2.dat C:\Users\demax.yusuf\jagex__preferences3.dat C:\Users\demax.yusuf\random.dat Some content of TEMP: ==================== C:\Users\demax.yusuf\AppData\Local\Temp\avgnt.exe C:\Users\demax.yusuf\AppData\Local\Temp\Quarantine.exe C:\Users\demax.yusuf\AppData\Local\Temp\sqlite3.dll C:\Users\demax.yusuf\AppData\Local\Temp\_isA054.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-25 20:12 ==================== End Of Log ============================ --- --- --- |
|
03.04.2015, 13:44
| #12 |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java TernewbESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.04.2015, 22:14
| #13 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Hier die Logs. Bin mir nicht sicher, ob alles passt, lasse nachher noch den Scanner drüber laufen, hier sind mal die Logs. Das ganze Zeug was gefunden wurde muss ja noch gelöscht werden ne? ESET Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=4cac42108d4a88458f27311e32b0bc09
# engine=23235
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-04 08:22:57
# local_time=2015-04-04 10:22:57 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 7127 179808827 0 0
# scanned=297537
# found=4
# cleaned=0
# scan_time=5761
sh=BA13D7E96EF4752C023FFA2E89D12CB6B78DAD26 ft=1 fh=73aec11bdd02d28f vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe"
sh=44A415FDB866F6FA488AB13F27E60223A7B7D609 ft=1 fh=45bdf47be7f9214e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe"
sh=965F09046FD19200F55BBACB6CF09B97F6E11200 ft=1 fh=3d97f68e2575398c vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe"
sh=5C3362CF502687ED178A6E69C58248EC05A447CA ft=1 fh=7353deba403df184 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\demax.yusuf\Pictures\Skins\SoftonicDownloader_fuer_gopod.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.99 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Java 8 Update 31 Java version 32-bit out of Date! Adobe Flash Player 16.0.0.305 Flash Player out of Date! Adobe Reader XI Mozilla Firefox (36.0.4) Google Chrome (41.0.2272.101) Google Chrome (41.0.2272.118) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Spybot Teatimer.exe is disabled! Avira Antivir avgnt.exe Avira Antivir avguard.exe ESET ESET Online Scanner OnlineScannerApp.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by demax.yusuf (administrator) on DEMAXYUSUF-PC on 04-04-2015 23:09:50
Running from C:\Users\demax.yusuf\Downloads
Loaded Profiles: demax.yusuf (Available profiles: demax.yusuf)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Creative Technology Ltd.) C:\Windows\V0700Mon.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
() C:\Users\demax.yusuf\Desktop\SecurityCheck.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [V0700Mon.exe] => C:\Windows\V0700Mon.exe [28672 2011-08-22] (Creative Technology Ltd.)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [655360 2012-05-29] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Policies\Explorer: [HideSCAVolume] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2419162032-26975598-1423618793-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-05-23] (DivX, LLC)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-25] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-25] (Oracle Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-08] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-08] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-05-25] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=8 -> C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2419162032-26975598-1423618793-1001: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-12-25] (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-12-18] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2010-07-27] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2010-07-27] (Apple Inc.)
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-images.xml [2014-10-09]
FF SearchPlugin: C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\searchplugins\google-maps.xml [2014-10-09]
FF Extension: Avira Browser Safety - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\abs@avira.com [2015-03-31]
FF Extension: LoL eSport Countdown - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\deihjamdkpkfnhlaebfphjfahlfefmnh@slicefactory.com [2013-02-07]
FF Extension: Bitdefender QuickScan - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-07-18]
FF Extension: Cliqz Beta - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\cliqz@cliqz.com.xpi [2014-10-11]
FF Extension: convert2mp3.net YouTube2MP3 Converter - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\info@convert2mp3.net.xpi [2013-07-29]
FF Extension: Lightbeam - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-02-06]
FF Extension: Adblock Plus - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14]
FF Extension: Greasemonkey - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-24]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-04-02]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011-09-18]
FF HKU\S-1-5-21-2419162032-26975598-1423618793-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\demax.yusuf\AppData\Roaming\Mozilla\Firefox\Profiles\yxiaavno.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-01]
CHR Extension: (Google Drive) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-01]
CHR Extension: (YouTube) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-01]
CHR Extension: (Google Search) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-01]
CHR Extension: (AdBlock) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-09]
CHR Extension: (Google Wallet) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-06-01]
CHR Extension: (Gmail) - C:\Users\demax.yusuf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-01]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-05-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-01-29] (Nero AG)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [1652280 2012-06-26] (GlavSoft LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [598808 2013-06-06] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-03-15] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-22] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-03-15] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-10] (Duplex Secure Ltd.)
R3 V0700Vid; C:\Windows\System32\DRIVERS\V0700Vid.sys [393920 2011-09-06] (Creative Technology Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 HTCAND64; System32\Drivers\ANDROIDUSB.sys [X]
S2 SVKP; \??\C:\Windows\system32\SVKP.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-04 20:13 - 2015-04-04 20:13 - 00852607 _____ () C:\Users\demax.yusuf\Desktop\SecurityCheck.exe
2015-04-04 17:03 - 2015-04-04 17:03 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-04-04 17:02 - 2015-04-04 17:02 - 02347384 _____ (ESET) C:\Users\demax.yusuf\Desktop\esetsmartinstaller_deu.exe
2015-04-02 23:49 - 2015-04-02 23:49 - 00000770 _____ () C:\Users\demax.yusuf\Desktop\JRT.txt
2015-04-02 23:45 - 2015-04-02 23:45 - 02690981 _____ (Thisisu) C:\Users\demax.yusuf\Desktop\JRT.exe
2015-04-02 23:45 - 2015-04-02 23:45 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-DEMAXYUSUF-PC-Windows-7-Professional-(64-bit).dat
2015-04-02 23:45 - 2015-04-02 23:45 - 00000000 ____D () C:\RegBackup
2015-04-02 23:44 - 2015-04-02 23:44 - 00001437 _____ () C:\Users\demax.yusuf\Desktop\mbam.txt
2015-04-02 23:32 - 2015-04-02 23:37 - 00000000 ____D () C:\AdwCleaner
2015-04-02 23:32 - 2015-04-02 23:32 - 02208768 _____ () C:\Users\demax.yusuf\Desktop\AdwCleaner_4.200.exe
2015-04-02 22:42 - 2015-04-04 19:41 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-02 22:42 - 2015-04-02 22:42 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\demax.yusuf\Desktop\mbam-setup-2.1.4.1018.exe
2015-04-02 22:42 - 2015-04-02 22:42 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-02 22:42 - 2015-04-02 22:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-02 22:42 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-02 22:42 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-02 22:42 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-02 03:28 - 2015-04-02 03:28 - 00068006 _____ () C:\Users\demax.yusuf\Downloads\Shortcut.txt
2015-04-02 03:04 - 2015-04-02 03:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-02 02:55 - 2015-04-02 02:55 - 00021835 _____ () C:\ComboFix.txt
2015-04-02 02:25 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-02 02:25 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-02 02:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-02 02:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-02 02:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-02 02:25 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-02 02:25 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-02 02:25 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-02 02:21 - 2015-04-02 02:55 - 00000000 ____D () C:\Qoobox
2015-04-02 02:20 - 2015-04-02 02:52 - 00000000 ____D () C:\Windows\erdnt
2015-04-02 02:19 - 2015-04-02 02:19 - 05617096 ____R (Swearware) C:\Users\demax.yusuf\Desktop\ComboFix.exe
2015-03-30 15:01 - 2015-04-02 03:28 - 00040067 _____ () C:\Users\demax.yusuf\Downloads\Addition.txt
2015-03-30 14:57 - 2015-04-04 23:09 - 00021330 _____ () C:\Users\demax.yusuf\Downloads\FRST.txt
2015-03-30 14:56 - 2015-04-04 23:09 - 00000000 ____D () C:\FRST
2015-03-30 14:55 - 2015-03-30 14:55 - 02095616 _____ (Farbar) C:\Users\demax.yusuf\Desktop\FRST64.exe
2015-03-24 19:48 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-24 19:48 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-24 19:48 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-24 19:48 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-22 22:50 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-22 22:50 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-22 22:50 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-22 22:50 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-22 22:50 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-22 22:50 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-22 22:50 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-22 22:50 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-22 22:50 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-22 22:50 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-22 22:50 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-22 22:50 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-22 22:50 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-22 22:50 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-22 22:50 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-22 22:50 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-22 22:50 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-22 22:49 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-22 22:49 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-22 22:49 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-22 22:49 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-22 22:49 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-22 22:49 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-22 22:49 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-22 22:49 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-22 22:49 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-22 22:49 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-22 22:49 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-22 22:49 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-22 22:48 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-22 22:48 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-22 22:48 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-22 22:48 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-22 22:48 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-22 22:48 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-22 22:48 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-22 22:48 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-22 22:48 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-22 22:48 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-22 22:48 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-22 22:47 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-22 22:47 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-22 22:47 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-22 22:47 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-22 22:47 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-22 22:47 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-22 22:47 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-22 22:47 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-22 22:47 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-22 22:47 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-22 22:47 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-22 22:47 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-22 22:47 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-22 22:47 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-22 22:47 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-22 22:47 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-22 22:47 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-22 22:47 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-22 22:47 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-22 22:47 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-22 22:47 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-22 22:47 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-22 22:47 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-22 22:47 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-22 22:47 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-22 22:47 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-22 22:47 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-22 22:47 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-22 22:47 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-22 22:47 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-22 22:47 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-22 22:47 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-22 22:47 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-22 22:47 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-22 22:47 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-22 22:47 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-22 22:47 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-22 22:47 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-22 22:47 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-22 22:47 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-22 22:47 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-22 22:47 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-22 22:47 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-22 22:47 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-22 22:46 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-22 22:46 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-04 22:47 - 2013-01-14 18:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-04 22:38 - 2013-01-07 18:46 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-04 22:06 - 2010-03-14 11:12 - 01586074 _____ () C:\Windows\WindowsUpdate.log
2015-04-04 21:38 - 2013-01-07 18:46 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-04 20:49 - 2010-03-21 14:38 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-04-04 20:13 - 2012-05-13 12:12 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\TS3Client
2015-04-04 17:05 - 2009-07-14 19:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-04-04 17:05 - 2009-07-14 19:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-04-04 17:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-04 17:03 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-04 17:03 - 2009-07-14 06:45 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-04 17:01 - 2010-11-25 20:13 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Skype
2015-04-04 16:55 - 2013-06-22 14:30 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\HTC MediaHub
2015-04-04 16:55 - 2012-07-10 04:31 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Local\Htc
2015-04-04 16:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-04 16:53 - 2009-07-14 06:51 - 00212475 _____ () C:\Windows\setupact.log
2015-04-02 23:38 - 2010-03-16 08:39 - 00395028 _____ () C:\Windows\PFRO.log
2015-04-02 23:25 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Offline Web Pages
2015-04-02 22:49 - 2010-03-14 19:55 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-04-02 13:54 - 2012-04-25 16:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-02 03:32 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-04-02 03:23 - 2011-06-12 11:56 - 00003934 _____ () C:\Windows\System32\Tasks\InstallShield Software-Aktualisierungsdienst
2015-04-02 03:18 - 2010-03-14 21:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-02 03:15 - 2012-12-09 16:31 - 00010295 _____ () C:\Users\demax.yusuf\Documents\Uninstall STAR WARS The Old Republic.log
2015-04-02 03:14 - 2011-01-13 19:46 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\GameRanger
2015-04-02 02:55 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-04-02 02:43 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-04-01 12:10 - 2013-07-31 22:15 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Avira
2015-04-01 12:09 - 2013-07-31 22:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-01 12:09 - 2013-07-31 22:09 - 00000000 ____D () C:\ProgramData\Avira
2015-03-31 15:12 - 2010-10-26 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gothic III
2015-03-30 19:15 - 2000-06-26 16:10 - 00000000 ____D () C:\ProgramData\Adobe
2015-03-30 19:14 - 2000-06-26 16:09 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-03-30 19:13 - 2010-07-18 23:09 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-03-28 15:05 - 2014-05-10 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2015-03-28 02:52 - 2000-05-13 11:19 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\Ubisoft
2015-03-28 02:50 - 2013-07-29 12:47 - 00000000 ____D () C:\Users\demax.yusuf\AppData\Roaming\DVDVideoSoft
2015-03-25 20:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-25 04:19 - 2014-12-12 16:25 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-25 04:19 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-24 19:29 - 2009-07-14 06:45 - 04857072 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-24 19:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-23 02:01 - 2013-07-29 13:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-23 01:57 - 2010-03-19 18:36 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-22 22:28 - 2013-07-31 22:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-22 22:28 - 2013-07-31 22:09 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-05 04:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
==================== Files in the root of some directories =======
2011-05-22 15:03 - 2011-05-22 15:04 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe GIF Format CS5 Prefs
2010-07-19 00:00 - 2013-02-01 10:49 - 0000132 _____ () C:\Users\demax.yusuf\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-10-09 13:18 - 2014-11-02 19:52 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Roaming\winscp.rnd
2014-10-09 12:53 - 2014-11-02 19:48 - 0000600 _____ () C:\Users\demax.yusuf\AppData\Local\PUTTY.RND
2010-03-14 21:55 - 2010-03-14 21:55 - 0000017 _____ () C:\Users\demax.yusuf\AppData\Local\resmon.resmoncfg
2010-11-25 20:19 - 2010-11-25 20:19 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
Files to move or delete:
====================
C:\Users\demax.yusuf\jagex_cl_oldschool_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE.dat
C:\Users\demax.yusuf\jagex_cl_runescape_LIVE1.dat
C:\Users\demax.yusuf\jagex_runescape_preferences.dat
C:\Users\demax.yusuf\jagex_runescape_preferences2.dat
C:\Users\demax.yusuf\jagex__preferences3.dat
C:\Users\demax.yusuf\random.dat
Some content of TEMP:
====================
C:\Users\demax.yusuf\AppData\Local\Temp\avgnt.exe
C:\Users\demax.yusuf\AppData\Local\Temp\Quarantine.exe
C:\Users\demax.yusuf\AppData\Local\Temp\sqlite3.dll
C:\Users\demax.yusuf\AppData\Local\Temp\_isA054.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-04 19:08
==================== End Of Log ============================
--- --- --- LG EDIT: Soll ich Java und Flash schon jetzt updated oder bis zum Ende warten? |
|
05.04.2015, 13:08
| #14 |
| /// the machine /// TB-Ausbilder | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Jetzt updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
C:\Users\demax.yusuf\Pictures\Skins\SoftonicDownloader_fuer_gopod.exe
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Noch was zu lesen: CHIP-Installer - was ist das? - Anleitungen Noch Probleme mit dem Rechner?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.04.2015, 12:46
| #15 |
| | Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb Hier ist der Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by demax.yusuf at 2001-12-31 23:05:55 Run:1
Running from C:\Users\demax.yusuf\Desktop
Loaded Profiles: demax.yusuf (Available profiles: demax.yusuf)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe
C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe
C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe
C:\Users\demax.yusuf\Pictures\Skins\SoftonicDownloader_fuer_gopod.exe
Emptytemp:
*****************
C:\Users\demax.yusuf\Documents\UNI\OpenOffice - CHIP-Installer.exe => Moved successfully.
C:\Users\demax.yusuf\Documents\UNI\PDF Editor - CHIP-Installer.exe => Moved successfully.
C:\Users\demax.yusuf\Documents\UNI\Visual C 2010 Express - CHIP-Installer.exe => Moved successfully.
C:\Users\demax.yusuf\Pictures\Skins\SoftonicDownloader_fuer_gopod.exe => Moved successfully.
EmptyTemp: => Removed 1.5 GB temporary data.
The system needed a reboot.
==== End of Fixlog 23:07:18 ====
Falls ich noch Probleme habe, dann werde ich nochmal posten, aber ohne den Virenscanner hätte ich nichts bemerkt. Was hatte ich denn da oben? Danke für den Artikel. LG |
|
| Themen zu Adware.Gen2 und 3 mal Java.Rafold.V.Gen und Java Ternewb |
| adware, avira, desktop, dnsapi.dll, explorer.exe, infizierte, log, lsass.exe, modul, pdf, programm, prozesse, registry, rundll, server.exe, services.exe, suche, svchost.exe, system32, temp, viren, warnung, windows, winlogon.exe, wmp, wuauclt.exe |
WARNUNG an die MITLESER: 
Linear-Darstellung
